CVE-2011-2494: Infoleak
kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password.
Other sources
taskstats information may be used for gathering private information. E.g. for openssh and vsftpd daemons readcharacters/writecharacters may be used to learn the precise password length. Restrict it to processes being able to ptrace the target process. For TASKSTATSCMDATTRREGISTERCPUMASK the fix is euid check instead of a ptrace check as the handler is processed in the context of the target process, not the listener process'. When ptracetaskmayaccesscurrent() is introduced, it should be used instead of euid check. Currently there is a small race when a process temporarily changes its euid (e.g. to access user's files), until the process sets euid back user's processes may gather privileged process' statistics.
taskstats authorizedkeys presence infoleak PoC http://seclists.org/oss-sec/2011/q2/659
[0/2] restrict statistics information to user https://lkml.org/lkml/2011/6/24/88 [1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495) https://patchwork.kernel.org/patch/916032/ [2/2] taskstats: restrict access to user (CVE-2011-2494) https://patchwork.kernel.org/patch/916042/
http://article.gmane.org/gmane.comp.security.oss.general/5337 Linus suggested returning accounting information at a 1k granularity instead.
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 3.1Patch 916032 - Compensating control
Restrict taskstats statistics access to processes that are able to ptrace the target process.
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2494?
CVE-2011-2494 has a moderate severity rating as it allows local users to obtain sensitive information.
How do I fix CVE-2011-2494?
To fix CVE-2011-2494, upgrade your Linux kernel to version 3.1 or later.
Who is affected by CVE-2011-2494?
CVE-2011-2494 affects local users of versions of the Linux kernel prior to 3.1.
What type of information can be disclosed due to CVE-2011-2494?
CVE-2011-2494 can be exploited to disclose sensitive I/O statistics, including potentially discovering user passwords.
When was CVE-2011-2494 discovered?
CVE-2011-2494 was discovered and reported in June 2011.