In association with heise online

« previous | next »

24 March 2009, 13:35

FreeBSD bug gives local root privileges

Due to a bug in FreeBSD's kernel, local users can gain complete control over vulnerable systems. The vulnerability is located in the KTimes module which was, according the the FreeBSD developers, only introduced in version 7.0 of the free operating system.

The programming flaw in question is a missing range check on the ID of the timer to be used which can be exploited to cause integer overflow. The overflow allows an unprivileged process to overwrite arbitrary areas of kernel memory. Administrators should install one of the available patches immediately, recompile their kernel and reboot.

See also:

FreeBSD-SA-09:06.ktimer, developers' advisory.

« previous | next »

Print Version | Send by email | Permalink: http://h-online.com/-740735

Also on The H: