OpenBSD 3.3: improper kernel bounds check

An improper bounds check in the semget(2) system call can allow a local user to cause a kernel panic. No privilege escalation is possible, the attack simply runs the kernel out of memory. The bug was introduced in OpenBSD 3.3, previous versions of OpenBSD are unaffected.

The bug has been fixed in OpenBSD-current as well as the 3.3 stable branch. In addition, a patch is available for OpenBSD 3.3:

    ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/002_semget.patch

Credit goes to blexim for finding and reporting the problem. Received on Wed Aug 20 17:07:43 2003