CVE-2011-2494: Infoleak

taskstats information may be used for gathering private information. E.g. for openssh and vsftpd daemons readcharacters/writecharacters may be used to learn the precise password length. Restrict it to processes being able to ptrace the target process. For TASKSTATSCMDATTRREGISTERCPUMASK the fix is euid check instead of a ptrace check as the handler is processed in the context of the target process, not the listener process'. When ptracetaskmayaccesscurrent() is introduced, it should be used instead of euid check. Currently there is a small race when a process temporarily changes its euid (e.g. to access user's files), until the process sets euid back user's processes may gather privileged process' statistics.

taskstats authorizedkeys presence infoleak PoC http://seclists.org/oss-sec/2011/q2/659

[0/2] restrict statistics information to user https://lkml.org/lkml/2011/6/24/88 [1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495) https://patchwork.kernel.org/patch/916032/ [2/2] taskstats: restrict access to user (CVE-2011-2494) https://patchwork.kernel.org/patch/916042/

http://article.gmane.org/gmane.comp.security.oss.general/5337 Linus suggested returning accounting information at a 1k granularity instead.

Acknowledgements:

Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.

— Red Hat