RDot - CVE-2016-1886/CVE-2016-1887 FreeBSD SETFKEY stack overflow / heap overflow in sendmsg

FreeBSD-SA-16:18.atkbd / CVE-2016-1886

Код:

Affects:        All supported versions of FreeBSD.

Corrected:      2016-05-17 22:29:59 UTC (stable/10, 10.3-STABLE)

                2016-05-17 22:28:27 UTC (releng/10.3, 10.3-RELEASE-p3)

                2016-05-17 22:28:20 UTC (releng/10.2, 10.2-RELEASE-p17)

                2016-05-17 22:28:11 UTC (releng/10.1, 10.1-RELEASE-p34)

                2016-05-17 22:31:12 UTC (stable/9, 9.3-STABLE)

                2016-05-17 22:28:36 UTC (releng/9.3, 9.3-RELEASE-p42)

Переполнение стэка в буфере ядра. Должно работать и на прошлых версиях. Stack canary не мешает.

Отличный write-up: Analysis of CVE-2016-1886, SETFKEY FreeBSD kernel vulnerability

FreeBSD-SA-16:19.sendmsg / CVE-2016-1887

Код:

Affects:        FreeBSD 10.x

Corrected:      2016-05-17 22:30:43 UTC (stable/10, 10.3-STABLE)

                2016-05-17 22:28:27 UTC (releng/10.3, 10.3-RELEASE-p3)

                2016-05-17 22:28:20 UTC (releng/10.2, 10.2-RELEASE-p17)

                2016-05-17 22:28:11 UTC (releng/10.1, 10.1-RELEASE-p34)

Heap overflow из-за type confusion.

Также отличный write-up: Analysis of CVE-2016-1887, sendmsg FreeBSD kernel heap overflow