Subject: Re: bin/2646: eeprom: another insecure kvm program
To: None <kashmir@umiacs.UMD.EDU>
From: Gordon W. Ross <gwr@mc.com>
List: netbsd-bugs
Date: 07/23/1996 11:40:35
What about the sun3?  (The fix is in an #ifdef sparc section.)

> Date: Sat, 20 Jul 1996 17:28:35 -0400 (EDT)
> From: Mike Grupenhoff <kashmir@vanquish.umiacs.umd.edu>
...
> >Number:         2646
> >Category:       bin
> >Synopsis:       eeprom: another insecure kvm program
...
> >Description:
> 	/usr/sbin/eeprom is another kvm prog that doesn't discard setgid
> 	perms when an alternate kernel is specified.
> >How-To-Repeat:
> 	eeprom -N bogus_kernel .....
> >Fix:
> patch for /usr/src/usr.sbin/eeprom/main.c:

>  #ifdef __sparc__
> +	/*
> +	 * Discard setgid privileges if not the running kernel so that bad
> +	 * guys can't print interesting stuff from kernel memory.
> +	 */
> +	if (system != NULL)
> +		setgid(getgid());
>  	if (getcputype() != CPU_SUN4)
>  		use_openprom = 1;
>  #endif /* __sparc__ */