CVE-2019-3901: Race Condition
First published: Mon Apr 25 2016(Updated: )
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:3.10.0-1127.rt56.1093.el7 | 0:3.10.0-1127.rt56.1093.el7 |
| redhat/kernel | <0:3.10.0-1127.el7 | 0:3.10.0-1127.el7 |
| redhat/kernel | <0:3.10.0-957.56.1.el7 | 0:3.10.0-957.56.1.el7 |
| redhat/kernel | <0:3.10.0-1062.26.1.el7 | 0:3.10.0-1062.26.1.el7 |
| IBM Data Risk Manager | <=2.0.6 | |
| Linux Kernel | <4.8 | |
| Debian | =8.0 | |
| NetApp Active IQ Unified Manager | >=9.5 | |
| NetApp SolidFire & HCI Management Node | ||
| NetApp SnapProtect | ||
| NetApp SolidFire & HCI Storage Node | ||
| NetApp Storage Replication Adapter | >=7.2 | |
| NetApp VASA Provider | >=7.2 | |
| NetApp Virtual Storage Console | >=7.2 | |
| All of | ||
| NetApp CN1610 | ||
| NetApp CN1610 Firmware | ||
| NetApp CN1610 | ||
| NetApp CN1610 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/159973
- https://www.ibm.com/support/pages/node/6335281 (Advisory)
- http://www.securityfocus.com/bid/89937
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3901
- https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html
- https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html
- https://security.netapp.com/advisory/ntap-20190517-0005/
- https://bugs.chromium.org/p/project-zero/issues/detail?id=807
- https://seclists.org/oss-sec/2019/q2/9
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=79c9ce57eb2d5f1497546a3946b4ae21b6fdc438
- https://access.redhat.com/errata/RHSA-2020:1016
- https://access.redhat.com/errata/RHSA-2020:1070
- https://access.redhat.com/security/cve/cve-2019-3901
- https://access.redhat.com/errata/RHSA-2020:2522
- https://access.redhat.com/errata/RHSA-2020:2851
- https://bugzilla.redhat.com/show_bug.cgi?id=1701245
- https://www.cve.org/CVERecord?id=CVE-2019-3901 https://nvd.nist.gov/vuln/detail/CVE-2019-3901
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2019-3901?
CVE-2019-3901 is considered a high severity vulnerability due to its potential for local attackers to leak sensitive data from setuid programs.
How do I fix CVE-2019-3901?
To fix CVE-2019-3901, update your kernel to a version that is patched against this vulnerability, such as kernel-rt 3.10.0-1127.rt56.1093.el7 or kernel 3.10.0-1127.el7.
Which software is affected by CVE-2019-3901?
CVE-2019-3901 affects Red Hat kernels, including kernel-rt and various versions of IBM Data Risk Manager.
What type of attack does CVE-2019-3901 allow?
CVE-2019-3901 allows local attackers to leak sensitive data through a race condition when accessing setuid programs.
Is there a public exploit for CVE-2019-3901?
As of now, there are no known public exploits specifically targeting CVE-2019-3901.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-3901
- agent/severity
- agent/references
- agent/weakness
- agent/remedy
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- vendor/ibm
- canonical/ibm data risk manager
- version/ibm data risk manager/2.0.6
- vendor/linux
- canonical/linux kernel
- vendor/debian
- canonical/debian
- version/debian/8.0
- vendor/netapp
- canonical/netapp active iq unified manager
- version/netapp active iq unified manager/9.5
- canonical/netapp solidfire & hci management node
- canonical/netapp snapprotect
- canonical/netapp solidfire & hci storage node
- canonical/netapp storage replication adapter
- version/netapp storage replication adapter/7.2
- canonical/netapp vasa provider
- version/netapp vasa provider/7.2
- canonical/netapp virtual storage console
- version/netapp virtual storage console/7.2
- canonical/netapp cn1610
- canonical/netapp cn1610 firmware