johan berg

http://deadly.org

An improper bounds check in the semget(2) system call can allow a local
user to cause a kernel panic. No privilege escalation is possible, the
attack simply runs the kernel out of memory. The bug was introduced in
OpenBSD 3.3, previous versions of OpenBSD are unaffected.

The bug has been fixed in OpenBSD-current as well as the 3.3 stable
branch. In addition, a patch is available for OpenBSD 3.3:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/002_semget.patch

Credit goes to blexim for finding and reporting the problem.


--
Johan Berg

johan berg

http://deadly.org

An improper bounds check in the semget(2) system call can allow a local
user to cause a kernel panic. No privilege escalation is possible, the
attack simply runs the kernel out of memory. The bug was introduced in
OpenBSD 3.3, previous versions of OpenBSD are unaffected.

The bug has been fixed in OpenBSD-current as well as the 3.3 stable
branch. In addition, a patch is available for OpenBSD 3.3:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/002_semget.patch

Credit goes to blexim for finding and reporting the problem.


--
Johan Berg