FreeBSD Security Advisory FreeBSD-SA-18:02.ntp
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 = FreeBSD-SA-18:02.ntpSecurity Advisory The FreeBSD Project Topic: Multiple vulnerabilities of ntp Category: contrib Module: ntp Announced: 2018-03-07 Credits:Network Time Foundation Affects:All supported versions of FreeBSD. Corrected: 2018-02-28 09:01:03 UTC (stable/11, 11.1-STABLE) 2018-03-07 05:58:24 UTC (releng/11.1, 11.1-RELEASE-p7) 2018-03-01 04:06:49 UTC (stable/10, 10.4-STABLE) 2018-03-07 05:58:24 UTC (releng/10.4, 10.4-RELEASE-p6) 2018-03-07 05:58:24 UTC (releng/10.3, 10.3-RELEASE-p27) CVE Name: CVE-2018-7182, CVE-2018-7170, CVE-2018-7184, CVE-2018-7185, CVE-2018-7183 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit https://security.FreeBSD.org/>. I. Background The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP) used to synchronize the time of a computer system to a reference time source. II. Problem Description The ctl_getitem() function is used by ntpd(8) to process incoming "mode 6" packets. A malicious "mode 6" packet can be sent to an ntpd instance, and if the ntpd instance is from 4.2.8p6 through 4.2.8p10, ctl_getitem() will read past the end of its buffer. [CVE-2018-7182] The ntpd(8) service can be vulnerable to Sybil attacks. If a system is configured to use a trustedkey and if one is not using the feature introduced in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to specify which IPs can serve time, a malicious authenticated peer, i.e., one where the attacker knows the private symmetric key, can create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock. [CVE-2018-7170] The fix for NtpBug2952 was incomplete, and while it fixed one problem it created another. Specifically, it drops bad packets before updating the "received" timestamp. This means a third-party can inject a packet with a zero-origin timestamp, meaning the sender wants to reset the association, and the transmit timestamp in this bogus packet will be saved as the most recent "received" timestamp. The real remote peer does not know this value and this will disrupt the association until the association resets. [CVE-2018-7184] The NTP Protocol allows for both non-authenticated and authenticated associations, in client/server, symmetric (peer), and several broadcast modes. In addition to the basic NTP operational modes, symmetric mode and broadcast servers can support an interleaved mode of operation. In ntp-4.2.8p4, a bug was inadvertently introduced into the protocol engine that allows a non-authenticated zero-origin (reset) packet to reset an authenticated interleaved peer association. If an attacker can send a packet with a zero-origin timestamp and the source IP address of the "other side" of an interleaved association, the 'victim' ntpd will reset its association. The attacker must continue sending these packets in order to maintain the disruption of the association. [CVE-2018-7185] The ntpq(8) utility is a monitoring and control program for ntpd. The internal decodearr() function of ntpq(8) that is used to decode an array in a response string when formatted data is being displayed. This is a problem in affected versions of ntpq if a maliciously-altered ntpd returns an array result that will trip this bug, or if a bad actor is able to read an ntpq(8) request on its way to a remote ntpd server and forge and send a response before the remote ntpd sends its response. It is potentially possible that the malicious data could become injectable/executable code. [CVE-2017-7183] III. Impact Malicious remote attackers may be able to break time synchornization, or cause the ntpq(8) utility to crash. IV. Workaround No workaround is available, but systems not running ntpd(8) or ntpq(8) are not affected. Network administrators are advised to implement BCP-38 which helps to reduce risk associated with the attacks. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. The ntpd service has to be restarted after the update. A reboot is recommended but not required. 2) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install The ntpd service has to be restarted after the update. A reboot is recommended but not required. 3) To update your vulner
FreeBSD Security Advisory FreeBSD-SA-18:01.ipsec
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 = FreeBSD-SA-18:01.ipsec Security Advisory The FreeBSD Project Topic: ipsec validation and use-after-free Category: core Module: ipsec Announced: 2018-03-07 Credits:Maxime Villard Affects:All supported versions of FreeBSD. Corrected: 2018-02-24 13:04:02 UTC (stable/11, 11.1-STABLE) 2018-03-07 05:53:35 UTC (releng/11.1, 11.1-RELEASE-p7) 2018-03-07 05:47:48 UTC (stable/10, 10.4-STABLE) 2018-03-07 05:53:35 UTC (releng/10.4, 10.4-RELEASE-p6) 2018-03-07 05:53:35 UTC (releng/10.3, 10.3-RELEASE-p27) CVE Name: CVE-2018-6916 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit https://security.FreeBSD.org/>. I. Background The IPsec suite of protocols provide network level security for IPv4 and IPv6 packets. FreeBSD includes software originally developed by the KAME project which implements the various protocols that make up IPsec. In IPsec, the IP Authentication Header (AH) is used to provide protection against replay attacks and connectionless integrity and data origin authentication for IP datagrams. II. Problem Description Due to a lack of strict checking, an attacker from a trusted host can send a specially constructed IP packet that may lead to a system crash. Additionally, a use-after-free vulnerability in the AH handling code could cause unpredictable results. III. Impact Access to out of bounds or freed mbuf data can lead to a kernel panic or other unpredictable results. IV. Workaround No workaround is available, but systems not using IPsec are not vulnerable. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. And reboot the system. 2) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install And reboot the system 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 10.x] # fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-10.patch # fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-10.patch.asc # gpg --verify ipsec-10.patch.asc [FreeBSD 11.1] # fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-11.patch # fetch https://security.FreeBSD.org/patches/SA-18:01/ipsec-11.patch.asc # gpg --verify ipsec-11.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile your kernel as described in https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - - stable/10/r330565 releng/10.3/ r330566 releng/10.4/ r330566 stable/11/r329907 releng/11.1/ r330566 - - To see which files were modified by a particular revision, run the following command, replacing NN with the revision number, on a machine with Subversion installed: # svn diff -cNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NN with the revision number: https://svnweb.freebsd.org/base?view=revision&revision=NN> VII. References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6916> The latest revision of this advisory is available at https://security.FreeBSD.org/advisories/FreeBSD-SA-18:01.ipsec.asc> -BEGIN PGP SIGNATURE- iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAlqfhClfFIAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n 5cISCQ//f9bjAzuou4wlbaoVBp+csfE8qwJl0PJAs/guwO9dO/TMLrVzJ+oNtAIR VO6T7j2uC/eLD80PFsGoTpDAm4O1gqcGGX4OZm/6rE/OdqC3/UhhqpMYke0ZdNuh ugUyztXZkHuvsLgoR/peW9QqAxRRABTUWL0NPQU4YvtEpa5iOOkzNYuPQ9+dltQC SXkbGDr
Call for Testing: 11.1-RELEASE Meltdown/Spectre mitigation merge
Background -- A number of issues relating to speculative execution were found last year and publicly announced January 3rd. A variety of techniques used to mitigate these issues have been committed to FreeBSD-CURRENT and have been merged to the stable/11 branch. The changes will be merged and released as an update to FreeBSD 11.1-RELEASE in the near future, but the candidate patch is now available for broader testing. The patch addresses these issues: CVE-2017-5754 (Meltdown) This issue relies on a speculative execution of instructions that attempt to read kernel memory, but fault. Although the architectural state is as expected (the faulting instruction is not retired), cache or other microarchitectureal state is changed and may be used to observe privileged data. The mitigation is known as Page Table Isolation (PTI). PTI largely separates kernel and user mode page tables, so that even during speculative execution most of the kernel's data is unmapped and not accessible. A demonstration of the Meltdown vulnerability is available at https://github.com/dag-erling/meltdown. A positive result is definitive (that is, the vulnerability exists with certainty). A negative result indicates either that the CPU is not affected, or that the test is not capable of demonstrating the issue on the CPU (and may need to be modified). CVE-2017-5715 (Spectre V2) -- Spectre V2 uses branch target injection to speculatively execute kernel code at an address under an attacker's control. There are two common mitigations for Spectre V2. This patch includes a mitigation using Indirect Branch Restricted Speculation, a feature available via a microcode update from processor manufacturers. The alternate mitigation, Retpoline, is a feature available in newer compilers and is available in FreeBSD-CURRENT now. It will be made available in stable branches in the future. Patch - The patch against 11.1-RELEASE is available at https://people.freebsd.org/~emaste/patches/amd64_11.1_meltdown.3.patch A patched kernel will automatically enable PTI on Intel CPUs, and the status can be checked via the vm.pmap.pti sysctl: # sysctl vm.pmap.pti vm.pmap.pti: 1 The default setting can be overridden by setting loader tunable vm.pmap.pti to 1 or 0 in /boot/loader.conf. This setting takes effect only at boot. The patch includes the IBRS mitigation for Spectre V2. To use the mitigation the system must have an updated microcode; with older microcode a patched kernel will function without the mitigation. IBRS can be disabled via the hw.ibrs_disable sysctl (and tunable), and the status can be checked via the hw.ibrs_active sysctl. IBRS may be enabled or disabled at runtime. Additional detail on microcode updates will follow. Limitations --- This patch applies only to 11.1-RELEASE. It does not include mitigations for architectures other than amd64 (x86_64). Work on other branches, architectures and vulnerabilities is ongoing, and will be available at a later date. Testing --- We are soliciting functionality and performance results from testing this 11.1-RELEASE patch under a variety of workloads. If you have the ability to test, please apply the patch and run the system with your usual workload and follow up with details, either here or directly to me. Benchmark data from our testing will soon be shared more widely. In brief, the PTI mitigation shows on the order of a 30% impact on system call microbenchmarks, to 1% to 2% for realistic workloads. This work is supported by the FreeBSD Foundation. ___ freebsd-security@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
