-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Advisory 2005-002 ================================= Topic: Local DoS via audio device with specific drivers Version: NetBSD-current: source prior to June 13, 2005 NetBSD 2.0.2: affected NetBSD 2.0.1: affected NetBSD 2.0: affected NetBSD 1.6.2: affected NetBSD 1.6.1: affected NetBSD 1.6: affected Severity: local user with access to audio device can cause kernel trap Fixed: NetBSD-current: June 12, 2005 NetBSD-3.0 branch: June 12, 2005 (3.0 will include the fix) NetBSD-2.0 branch: June 13, 2005 (2.0.3 and 2.1 will include the fix) NetBSD-1.6 branch: June 17, 2005 (1.6.3 will include the fix Abstract ======== With CS4280/4281, or SB Live, or SB PC 512 audio hardware, a local user of the audio device can crash the machine through the ioctl system call. Technical Details ================= The set-parameters ioctl() call of the audio subsystem allows programs to set audio stream parameters as well as the pause state, the internal ring buffer, and audio DMA block size used. When pause state was set to "unpaused" in the same ioctl() call as changing the block size information, playing/recording used to be started without recomputing the buffering parameters. Some drivers would use this information in a division by zero, thus crashing the kernel. The clcs and emuxki drivers are affected. If you do not have Cirrus Logic CS4280/CS4281, SB Live!, or SB PC 512 hardware installed in a system, then this vulnerability does not affect that system. Solutions and Workarounds ========================= The common part of the audio subsystem has been changed to ensure that the device parameters are not left in an uninitialized state. So, while the vulnerability was exposed by certain drivers, the fix is in the device-independent audio code. As a temporary measure, system administrators of multi-user machines may want to disable access to the audio device for all users until an upgraded kernel can be booted. To do this, as the root user, execute: chown root /dev/audio* /dev/audioctl* /dev/sound* chmod 000 /dev/audio* /dev/audioctl* /dev/sound* Single-user machines can be left as-is if the user can be trusted to not crash the machine willingly or to not complain afterwards. Solutions and Workarounds ========================= *** Updating with a GENERIC or other kernel from the base distribution: The NetBSD-daily source builds provide a set of kernels that can be used on systems that run GENERIC, or one of the other distribution kernels. Below, BRANCH, DATE, and ARCH are: BRANCH with the appropriate CVS branch ARCH with your architecture (from uname -m), and DATE Any date after the fixed dates, shown here: NetBSD-current: June 12, 2005 NetBSD-3.0 branch: June 12, 2005 NetBSD-2.0 branch: June 13, 2005 NetBSD-1.6 branch: June 17, 2005 * Note, the latest 1-6 build at the time of issuing this advisory does not yet include the fix. (June 16) ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-daily/{BRANCH}/{DATE}/i386/binary/kernel/{ARCH}/binary/kernel/netbsd-GENERIC.gz Retrieve the kernel from the appropriate location, then: cd / && cp /path/to/netbsd-GENERIC.gz / gzip -d netbsd-GENERIC.gz The tar file will extract a new copy of: netbsd-GENERIC Back up your old kernel: mv netbsd netbsd.old Then either rename: mv netbsd-GENERIC netbsd or link, as per local site policy: ln netbsd-GENERIC netbsd Then, reboot. *** Patching from sources: The following instructions describe how to upgrade your kernel by updating your source tree and rebuilding and installing a new version of the kernel. For all NetBSD versions, you need to download the source patch, apply it to your kernel source tree using the patch(1) command, and rebuild, install the kernel, and reboot. For more information on how to do this, see: http://www.netbsd.org/Documentation/kernel/#building_a_kernel The fix for this issue is contained in one file, sys/dev/audio.c The following table lists the fixed revisions and dates of this file for each branch: CVS branch revision date ------------- ----------- ---------------- HEAD 1.196 2005/06/11 netbsd-3 1.192.4.2 2005/06/11 netbsd-2-0 1.182.2.2 2005/06/12 netbsd-2 1.182.2.1.2.2 2005/06/12 netbsd-1-6 1.155.4.7 2005/06/17 The following instructions describe how to upgrade your kernel binaries by updating your source tree and rebuilding and installing a new version of the kernel. In these instructions, replace: BRANCH with the appropriate CVS branch (from the above table) ARCH with your architecture (from uname -m), and KERNCONF with the name of your kernel configuration file. To update from CVS, re-build, and re-install the kernel: # cd src # cvs update -d -P -r BRANCH sys/dev/audio.c # cd sys/arch/ARCH/conf # config KERNCONF # cd ../compile/KERNCONF # make depend;make; make install # reboot Thanks To ========= Ignatios Souvatzis discovery, initial analysis, implementation of fix YAMAMOTO Takashi analysis, suggestion for fix Revision History ================ 2005-06-30 Initial release More Information ================ Advisories may be updated as new information becomes available. The most recent version of this advisory (PGP signed) can be found at ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2005-002.txt.asc Information about NetBSD and NetBSD security can be found at http://www.NetBSD.org/ and http://www.NetBSD.org/Security/. Copyright 2005, The NetBSD Foundation, Inc. All Rights Reserved. Redistribution permitted only in full, unmodified form. $NetBSD: NetBSD-SA2005-002.txt,v 1.5 2005/06/30 09:22:48 wiz Exp $ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (NetBSD) iQCVAwUBQsQFPT5Ru2/4N2IFAQJDfgQAnhPQpnUwxAqg4Xci5bAafb1T5WlDf+lB o+aYn08gy9AUHwaw+T7rO1p6H+KSxB+4cCJ/rytRJefFgD60wbo8CuVHi/uT57Cy lGO9GpVuRz2HAInVg0f3TT0z2Kz6X0cn+Z+vrLf1buzR8wsQxyNhZwYzZQ8s27mk BBbuA26OoCI= =KIPN -----END PGP SIGNATURE-----