Executive brief
A vulnerability in the 4.4BSD-based operating system kernels allows a local user to disrupt or terminate other running programs. By exploiting a flaw in how the system handles background data notifications, an attacker can force the kernel to send signals to processes they do not own. This can lead to a denial of service where critical system services or other users' applications are unexpectedly shut down.
Technical details
The vulnerability exists in the kernel's asynchronous I/O facility, specifically within the handling of fcntl (F_SETOWN) and ioctl (FIOSETOWN, TIOCSPGRP) operations. The kernel does not verify if the calling process has the necessary permissions to signal the target process ID (PID) specified for I/O notification. Furthermore, the kernel fails to track credentials at the time of signal delivery, which allows for exploitation via PID reuse. An attacker can use this to send SIGIO or SIGURG signals to arbitrary processes; on some systems like SGI IRIX, these signals may default to process termination, enabling a local denial of service or potential service hijacking. Patches were released in September 1997 to implement credential checking during both the assignment and delivery of I/O notifications.
Affected products
- BSD 4.4BSD kernel All versions prior to September 1997 patches
- OpenBSD OpenBSD Versions prior to 1997-09-15 patches
- FreeBSD FreeBSD Versions prior to 1997-09-15 patches
- NetBSD NetBSD Versions prior to 1997-09-15 patches
- SGI IRIX All versions prior to September 1997 patches
Timeline
- 1997-09-15: advisory: OpenBSD security advisory released
- 1997-09-15: patched: Patches provided for OpenBSD kernel
- 1997-09-15: disclosed: Vulnerability publicly disclosed via NVD and vendor advisories