FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO)

Affected packages
11.1 <= FreeBSD-kernel < 11.1_4
11.0 <= FreeBSD-kernel < 11.0_15
10.4 <= FreeBSD-kernel < 10.4_3
10.3 <= FreeBSD-kernel < 10.3_24

Details

VuXML ID 34a3f9b5-dab3-11e7-b5af-a4badb2f4699
Discovery 2017-11-15
Entry 2017-12-06

Problem Description:

Not all information in the struct ptrace_lwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information of the kernel stack of the thread is possible from the debugger.

Impact:

Some bytes from the kernel stack of the thread using ptrace(PT_LWPINFO) call can be observed in userspace.

References

CVE Name CVE-2017-1086
FreeBSD Advisory SA-17:08.ptrace

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.