COMMAND

    ptrace(2)

SYSTEMS AFFECTED

    NetBSD/vax 1.4.1 and earlier; -current prior to 19991212

PROBLEM

    Following is based on NetBSD Security Advisory 1999-012.  As  part
    of an ongoing effort to construct a secure kernel and  application
    environment, the  NetBSD project  has identified  and corrected  a
    possible security issue.  A wrapper program can be constructed  by
    a  local  user  that  can  modify  the  hardware  privileges  of a
    ptrace(2)'d  process.    It   might  be   possible  to   write   a
    security-related exploit via this mechanism.

    NetBSD uses  the ptrace(2)  system call  to trace  and debug other
    processes.   The debugging  process can  also modify  the internal
    registers, including  the status  (PSL) register,  for the process
    being debugged.   Besides the  normal user-accessible  flags,  the
    VAX hardware  also stores  information about  privilege levels and
    used stacks  in the  PSL.   Those flags  are only  altered via the
    instruction REI  (return from  interrupt) or  LDPCTX (load process
    context)  and  cannot  be  modified  while running in "user" mode.
    When the PSL  contents are altered  by the debugging  process, the
    debugged process  is in  the kernel,  and will  get the privileges
    defined by the PSL when it REI to userspace to continue execution.
    Discovery of the problem by Klaus Klein.

SOLUTION

    Upgrade to NetBSD-current, or apply the following patch to 1.4.1:

    Index: machdep.c
    ===================================================================
    RCS file: /cvsroot/syssrc/sys/arch/vax/vax/machdep.c,v
    retrieving revision 1.76.2.1
    diff -c -r1.76.2.1 machdep.c
    *** machdep.c   1999/04/16 16:26:01     1.76.2.1
    - --- machdep.c   1999/12/12 11:08:46
    ***************
    *** 770,776 ****
            tf->fp = regs->fp;
            tf->sp = regs->sp;
            tf->pc = regs->pc;
    !       tf->psl = regs->psl;
            return 0;
      }
    
    - --- 770,777 ----
            tf->fp = regs->fp;
            tf->sp = regs->sp;
            tf->pc = regs->pc;
    !       tf->psl = (regs->psl|PSL_U|PSL_PREVU) &
    !           ~(PSL_MBZ|PSL_IS|PSL_IPL1F|PSL_CM); /* Allow compat mode? */
            return 0;
      }