|
|
Info |
Last Modified |
| 10 months ago |
|
|
|
|
Description |
NetBSD contains a flaw that may allow a local denial of service. The issue is triggered when a malicious user tricks a system call into running for an extended period of time, and will result in loss of availability for the platform.
|
|
Classification |
Location:
Local Access Required
Attack Type:
Denial of Service
Impact:
Loss of Availability
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Technical |
Processes runnning in the NetBSD kernel cannot be terminated by SIGHUP, SIGKILL or any other terminating signal and must yield the CPU voluntarily. Therefore, certain system calls can execute for an extended period of time in the kernel without yielding.
Two examples of this are a read from "/dev/zero" and a call to ktrace that could use large amounts of kernel memory when tracing large I/O's.
|
|
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, NetBSD has released a patch to address this vulnerability.
|
|
Products |
|
NetBSD
 |
0.x |
1.0.x |
1.1.x |
1.2.x |
1.3.x |
1.4 |
1.4.1 |
1.4.2 |
|
|
|
|
Credit |
- Artur Grabowski - art
 stacken.kth.se -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
