Multiple Vendor BSD Semaphore IPC Denial Of Service Vulnerability

386BSD-derived OSes' implementation of SysV semaphores is vulnerable to a locally exploitable denial of service attack. There exists an undocumented system call, semconfig(), which freezes the state of all semaphores on the system. Normally, this is used to generate a "snapshot" of their states but can be exploited so that all processes using semaphores cannot progress. The end result is that a local user with no special priviliges can freeze operations in processes utilizing semaphores.

From the NetBSD Advisory: "FreeBSD-SA-00:19 describes a similar, but significantly more severe problem affecting FreeBSD, and notes that NetBSD is also affected. The impact of the problem on NetBSD is much less, because NetBSD's semaphore implementation was fixed (in 1994) so that only semaphore-using processes would be blocked at exit time. "

OpenBSD (post 1994) applied the same patch as NetBSD and thus is significantly less affected than FreeBSD.


Privacy Statement
Copyright 2010, SecurityFocus