CVE-2011-0726: Input Validation

The dotaskstat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the startcode and endcode fields in the /proc/#####/stat file for a process executing a PIE binary.

— Launchpad

While mm->startstack was protected from cross-uid viewing (commit f83ce3e6b02d5e48b3a43b001390e2b58820389d), the startcode and endcode values were not. This would allow the text location of a PIE binary to leak, defeating ASLR.

Note that the value "1" is used instead of "0" for a protected value since "ps", "killall", and likely other readers of /proc/pid/stat, take startcode of "0" to mean a kernel thread and will misbehave. Thanks to Brad Spengler for pointing this out.

https://lkml.org/lkml/2011/3/11/380

Acknowledgements:

Red Hat would like to thank Kees Cook for reporting this issue.

— Red Hat