NetBSD Security Advisory 2023-004: procfs environ exposure

[NetBSD Security-Officer <security-officer%netbsd.org@localhost>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

		 NetBSD Security Advisory 2023-004
		 =================================

Topic:		procfs environ exposure

Version:	NetBSD-current:		affected prior to 9.99.78
		NetBSD 10.0_BETA:	unaffected
		NetBSD 9.3:		unaffected
		NetBSD 9.2:		affected
		NetBSD 9.1:		affected
		NetBSD 9.0:		affected
		NetBSD 8.2:		unaffected
		NetBSD 8.1:		unaffected
		NetBSD 8.0:		unaffected

Severity:	Secret disclosure across privilege boundaries

Fixed:		NetBSD-current:		2020-12-28
		NetBSD-10 branch:	N/A
		NetBSD-9 branch:	2022-06-17
		NetBSD-8 branch:	N/A

Please note that NetBSD releases prior to 8.2 are no longer supported.
It is recommended that all users upgrade to a supported release.


Abstract
========

/proc/N/environ was world-readable, enabling anyone to read other
processes' environments even across privilege boundaries.  This can
expose secrets, since the process environment is often used to hold
things like secret access keys.


Technical Details
=================

When procfs is mounted at /proc, the process environment (environ(7))
for the process with pid N is exposed as /proc/N/environ.

The process environment is often used to transmit secrets such as
secret access keys:

https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html

Normally a process's environment is exposed only to that process and to
other processes with the same privileges -- one user cannot read the
environment of another user's process, for example with the `-e' option
to ps(1).

However, procfs exposed the /proc/N/environ with group and other read
permission, allowing any user's process on the system to read any other
process's environment, potentially disclosing secrets across privilege
boundaries.


Solutions and Workarounds
=========================

Workaround: Avoid mounting procfs.

If you need to mount procfs, update the kernel to a fixed version and reboot.

There are pre-built binaries for all architectures and NetBSD versions at:

    https://nycdn.netbsd.org/pub/NetBSD-daily/

For example you can find the standard GENERIC kernel for NetBSD-9/amd64 at:

    https://nycdn.netbsd.org/pub/NetBSD-daily/netbsd-9/latest/amd64/binary/kernel/netbsd-GENERIC.gz

Alternatively to build from source for all NetBSD versions, you
need to obtain fixed kernel sources, rebuild and install the new
kernel, and reboot the system.

The fixed source may be obtained from the NetBSD CVS repository. The
following instructions briefly summarize how to upgrade your kernel.
In these instructions, replace:

	ARCH     with your architecture (from uname -m), and
	KERNCONF with the name of your kernel configuration file.

To update from CVS, re-build, and re-install the kernel:

	# cd src
	# cvs update -d -P sys/miscfs/procfs/procfs_vfsops.c
	# ./build.sh kernel=KERNCONF
	# mv /netbsd /netbsd.old
	# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
	# shutdown -r now

For more information on how to do this, see:

	https://www.NetBSD.org/docs/guide/en/chap-kernel.html


Thanks To
=========

Maya Rashish for finding the bug.


Revision History
================

	2023-06-28	Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at

	https://cdn.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2023-NNN.txt.asc

Information about NetBSD and NetBSD security can be found at

	https://www.NetBSD.org/
	https://www.NetBSD.org/Security/


Copyright 2023, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2023-004.txt,v 1.1 2023/06/28 15:33:18 christos Exp $
-----BEGIN PGP SIGNATURE-----

iQJQBAEBCAA6FiEEJxEzJivzXLUNT1BGiSYeF/XvSf8FAmScUr8cHHNlY3VyaXR5
LW9mZmljZXJAbmV0YnNkLm9yZwAKCRCJJh4X9e9J/yXzD/9gO9YosHsm4ILgcj4b
IPxgTjx0UHvY36Q0QSo+XjJm+de0OeLayd5hHo2sWycrGSbJXap543ac1/x1FlbL
c7CpcrdmWzZOGAYVBbV5Mb0UQkFiVreiIX7/haw/Rx6GFmI8FCCBCfjjDBhOKGOl
N6cPNnywlT6+DYjrwXkqKfX8clv9cAaeNQf/e2m7P4DXzgEAkcpNmroGebzrzDMP
Acqf1Fmdf5atGaTiORINhtT2wJebl0Ev2KU5vojIHT/my8ojyiDQPatIlZNl0NA3
R1xotCBrpFai2tZeFwppdYTdxFA4RW/JYm9f69rVCMi3BgnoA3X2+gie3it8I7gI
9DQP2dXbSHtDUaVVRGjr5/cC25T9Gclcg5oC5mmHj8HC6MrtItEO5vX6fl64jg36
n4vZ8XxYTxX01Pi1oz6AIh5x5XybvvwKYqWV3hw5s+YvBXsZ9KFRIl/TUyTO8I5T
MUCgB3tEqcO86yJNV5gDnwqmL4D0hsVkN4c+MPHvoQO4nT6oQEa7ggNpz1ZoOR0J
e3BlI3PqQ8XZyBPwrc+tF8moYMkmlH1OxXN/wiRZojCyKTHqUTPW0l2fjmT+l5y1
Y8W5sRu7s2yhbIC7O77nfRYZKLShjmJIw3/wldbcS+aN5zQXxY1JnAFVqszLRIvZ
I/AmJ6SncGpNSW/ADDwwk71TjQ==
=MCLq
-----END PGP SIGNATURE-----