-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-16:04.linux                                      Security Advisory
                                                          The FreeBSD Project

Topic:          Linux compatibility layer setgroups(2) system call
                vulnerability

Category:       core
Module:         kernel
Announced:      2016-01-14
Credits:        Dmitry Chagin
Affects:        All supported versions of FreeBSD
Corrected:      2016-01-14 09:11:42 UTC (stable/10, 10.2-STABLE)
                2016-01-14 09:10:46 UTC (releng/10.2, 10.2-RELEASE-p9)
                2016-01-14 09:11:16 UTC (releng/10.1, 10.1-RELEASE-p26)
                2016-01-14 09:11:48 UTC (stable/9, 9.3-STABLE)
                2016-01-14 09:11:26 UTC (releng/9.3, 9.3-RELEASE-p33)
CVE Name:       CVE-2016-1881

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

FreeBSD is binary-compatible with the Linux operating system through a
loadable kernel module/optional kernel component.  The support is
provided on amd64 and i386 machines.

II.  Problem Description

A programming error in the Linux compatibility layer setgroups(2) system
call can lead to an unexpected results, such as overwriting random kernel
memory contents.

III. Impact

It is possible for a local attacker to overwrite portions of kernel
memory, which may result in a privilege escalation or cause a system
panic.

IV.  Workaround

No workaround is available, but systems not using the Linux binary
compatibility layer are not vulnerable.

The following command can be used to test if the Linux binary
compatibility layer is loaded:

# kldstat -m linuxelf

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.

Reboot the system or unload and reload the linux.ko kernel module.

2) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

Reboot the system or unload and reload the linux.ko kernel module.

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-16:04/linux.patch
# fetch https://security.FreeBSD.org/patches/SA-16:04/linux.patch.asc
# gpg --verify linux.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html>.

Reboot the system or unload and reload the linux.ko kernel module.

VI.  Correction details

The following list contains the correction revision numbers for each
affected branch.

Branch/path                                                      Revision
- -------------------------------------------------------------------------
stable/9/                                                         r293898
releng/9.3/                                                       r293896
stable/10/                                                        r293897
releng/10.1/                                                      r293894
releng/10.2/                                                      r293893
- -------------------------------------------------------------------------

To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:

# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

Or visit the following URL, replacing NNNNNN with the revision number:

<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>

VII. References

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1881>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:04.linux.asc>
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJWmodEAAoJEO1n7NZdz2rnMiIP/3AW22n5L6L2f9S+ZHo0059k
jycZy/7pDi8H3OKoBea1WT9R5cgpRMj+o4vHuxoRN1qYlmc/2NK/cX7N7s+92jMY
R/9I1aDI0bcRDbYK1ekLR3802Qlkc3nU5eKjXH+01MLoclpAQg3LN5iLOL46SXmW
HkO6S6cNA/oAsbWCUKXKQvMaJEO8mHd2dAq91rGy7SCYdOzazya7pSRiAb2GMHjB
dR+7socU4TAHxHNZtyLrVWjrzfN/hDNSyvm2bzRDxx/4FHjNEpD8+8Tj1cVchVJS
aZqvfUKtENSjVy2dybo1kH4zSzAthr+rSoemUu6GmNkUg37XuGtFGbjDKKUfIeCw
D923+I6UqDLGzGwmlAijq84wq/6lm68sgAzz2n269e1uYJZyp8K8WAZ7H4Z8PN2a
wF0ozsMuUv9FOHRE0VaADVw3TE5Rc0Ie5Th9CLWfRtSrpeVw3D68orPYGV1aH0+Y
bkW3S1CcPffbL8C0ufm9ZM9sybwnjw0e/1hBpeHi1pWmjqN62lBdTLUGQz4o2Ig3
OeBemOq02QSy/2qw8QNTMBxwNGNUOKqbQDjDmMC/tVvKUsqEZKGDs6IjXM1mdoiV
GFkbVr3VwkT/q93d1JmOnKsCh3vHbnHmUxEbDFHyxBcTsCWbziAU3hTRoWs969Ii
Rv0MJKD92D6mGZ+S6j5S
=8TiG
-----END PGP SIGNATURE-----