CVE-2019-3901: Race Condition
First published: Mon Apr 25 2016(Updated: )
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:3.10.0-1127.rt56.1093.el7 | 0:3.10.0-1127.rt56.1093.el7 |
| redhat/kernel | <0:3.10.0-1127.el7 | 0:3.10.0-1127.el7 |
| redhat/kernel | <0:3.10.0-957.56.1.el7 | 0:3.10.0-957.56.1.el7 |
| redhat/kernel | <0:3.10.0-1062.26.1.el7 | 0:3.10.0-1062.26.1.el7 |
| IBM Data Risk Manager | <=2.0.6 | |
| Linux Linux kernel | <4.8 | |
| Debian Debian Linux | =8.0 | |
| Netapp Active Iq Unified Manager For Vmware Vsphere | >=9.5 | |
| Netapp Hci Management Node | ||
| Netapp Snapprotect | ||
| Netapp Solidfire | ||
| Netapp Storage Replication Adapter For Clustered Data Ontap For Vmware Vsphere | >=7.2 | |
| Netapp Vasa Provider For Clustered Data Ontap | >=7.2 | |
| NetApp Virtual Storage Console for VMware vSphere | >=7.2 | |
| Netapp Cn1610 Firmware | ||
| Netapp Cn1610 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/159973
- https://www.ibm.com/support/pages/node/6335281 (Advisory)
- http://www.securityfocus.com/bid/89937
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3901
- https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html
- https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html
- https://security.netapp.com/advisory/ntap-20190517-0005/
- https://bugs.chromium.org/p/project-zero/issues/detail?id=807
- https://seclists.org/oss-sec/2019/q2/9
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=79c9ce57eb2d5f1497546a3946b4ae21b6fdc438
- https://access.redhat.com/errata/RHSA-2020:1016
- https://access.redhat.com/errata/RHSA-2020:1070
- https://access.redhat.com/security/cve/cve-2019-3901
- https://access.redhat.com/errata/RHSA-2020:2522
- https://access.redhat.com/errata/RHSA-2020:2851
- https://bugzilla.redhat.com/show_bug.cgi?id=1701245
- https://www.cve.org/CVERecord?id=CVE-2019-3901 https://nvd.nist.gov/vuln/detail/CVE-2019-3901
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-3901
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/remedy
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- vendor/netapp
- canonical/netapp active iq unified manager for vmware vsphere
- version/netapp active iq unified manager for vmware vsphere/9.5
- canonical/netapp hci management node
- canonical/netapp snapprotect
- canonical/netapp solidfire
- canonical/netapp storage replication adapter for clustered data ontap for vmware vsphere
- version/netapp storage replication adapter for clustered data ontap for vmware vsphere/7.2
- canonical/netapp vasa provider for clustered data ontap
- version/netapp vasa provider for clustered data ontap/7.2
- canonical/netapp virtual storage console for vmware vsphere
- version/netapp virtual storage console for vmware vsphere/7.2
- canonical/netapp cn1610 firmware
- canonical/netapp cn1610
- vendor/ibm
- canonical/ibm data risk manager
- version/ibm data risk manager/2.0.6