3 ms·
The flaw appears in the oldest version of the source on GitHub, circa 1994; "BSD 4.4 Lite Lib Sources." Who knows how far back it really goes. It's really bas
by topspin 10y ago
The flaw appears in the oldest version of the source on GitHub, circa 1994; "BSD 4.4 Lite Lib Sources." Who knows how far back it really goes.
It's really basic; get the kernel to cough up a bad sockaddr and bcopy will scribble on your memory. That may seem far fetched but then you remember LKM and maybe not. Incidentally OpenBSD dropped LKM support in 2014 [1], presumably for hardening purposes.
[1] https://news.ycombinator.com/item?id=8554003 https://news.ycombinator.com/item?id=8554003
- kps 10y ago4.3 Reno, apparently added as part of OSI networking, which explains why no one has ever heard of it. (Pretty sure 4.3BSD didn't have loadable kernel modules; you built your kernel from source, uphill both ways in the snow.)
- kjs3 10y agoYou may not have heard of it, but many of us have (and ran it back in the day). The key things most people care about in Reno are NFS and POSIX, which did end up being more important than OSI.
- ben_bai 10y ago4.3BSD-Reno, basically unchanged since 1990 until yesterday. http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/lib/libc/net/linkaddr.c http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src... Personally I'm more worried about the function returning obuf, a pointer to a stack variable in link_ntoa.
- tedunangst 10y agoThat's not on the stack.
- ben_bai 10y agoOh indeed. Static it is...