University of Cambridge researcher Robert Watson has published a paper at the First USENIX Workshop On Offensive Technology in which he describes serious vulnerabilities in OpenBSD's Systrace, Sudo, Sysjail, the TIS GSWTK framework, and CerbNG. The technique is also effective against many commercially available anti-virus systems. His slides include sample exploit code that bypasses access control, virtualization, and intrusion detection in under 20 lines of C code consisting solely of memcpy() and fork(). Sysjail has now withdrawn their software, recommending against any use, and NetBSD has disabled Systrace by default in their upcoming release.
Post a Comment
Member since:
2006-01-16
Member since:2007-01-18
Member since:2005-08-18
Member since:
2006-04-25
.. that this is only exploitable on multiprocessor systems.
Also, it seems that there is a solution available:
There is a straight forward solution for this problem. The initial
prototype of Systrace had a look-aside buffer in the kernel for
copyin. I told Robert about this, not sure if he mentioned that in
his paper or not. There obviously would be some associated
performance impacts. (Niels Provos, on the OpenBSD mailing list)
Still pretty serious though.
Member since:2007-08-09
No, this is exploitable also on Uniprocessor systems.
Read the paper/slides before posting comments.
http://www.watson.org/~robert/2007woot/
Member since:
2006-09-01
Member since:2005-11-05
Member since:2006-09-01
Member since:
2007-03-14
"Just so it is clear, systrace is just a tool included in the distribution. It is not used by anything in the base system by default but be wary of using this tool as it stands."
http://undeadly.org/cgi?action=article&sid=20070809201304
Member since:
2007-07-10
The NetBSD Toaster has a clear i/o channel (bread goes in the slot, toast goes out the slot), so that is at least one architecture that should be invulnerable to attack. If these researchers can have the machine produce toast without bread, then this may be bigger than I thought.
I don't doubt that it'll be fixed in a few weeks.
Member since:
2007-03-08
This has been in the BUGS section of systrace for a while.
"BUGS
Applications that use clone()-like system calls to share the complete address space between processes may be able to replace system call arguments after they have been evaluated by systrace and escape policy enforcement."
This has never been something that is enabled by default so I do not see how this can be a serious problem.
Watson has done some very interesting research though and it's good somebody decided to really dive into it and see what the problems in. Kudos!
Member since:
2007-05-02