Secunia

An information disclosure vulnerability has been identified in FreeBSD, which can be exploited by malicious, local users to gain knowledge of content in kernel memory.

Reportedly, the vulnerability is caused due to the IBCS2 system call translator for "statfs()" erroneously using the user-supplied length parameter when copying kernel data structures into userland. This can be exploited to return a big portion of kernel memory by specifying a large value.

The vulnerability affects all FreeBSD releases up to and including 4.8-RELEASE-p2 and 5.1-RELEASE-p1.

NOTE: iBCS2 support is only enabled if the administrator has included "option IBCS2" in the kernel configuration file, or loaded it dynamically using "kldload()" or by setting "ibcs2_enable" in "rc.conf()".

Solution
Upgrade vulnerable systems to 4.8-STABLE, or to any of the RELENG_4_8 (4.8-RELEASE-p3), RELENG_4_7 (4.7-RELEASE-p13), or RELENG_5_1 (5.1-RELEASE-p2) security branches dated after the respective correction dates (see original advisory).
Further details available in Customer Area

Provided and/or discovered by
David Rhodus

Original Advisory
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:10.ibcs2.asc

Deep Links
Links available in Customer Area