REDHAT-BUG-716842: Infoleak

First published: Mon Jun 27 2011(Updated: )

taskstats information may be used for gathering private information. E.g. for openssh and vsftpd daemons read_characters/write_characters may be used to learn the precise password length. Restrict it to processes being able to ptrace the target process. For TASKSTATS_CMD_ATTR_REGISTER_CPUMASK the fix is euid check instead of a ptrace check as the handler is processed in the context of the target process, not the listener process'. When ptrace_task_may_access_current() is introduced, it should be used instead of euid check. Currently there is a small race when a process temporarily changes its euid (e.g. to access user's files), until the process sets euid back user's processes may gather privileged process' statistics. taskstats authorized_keys presence infoleak PoC <a href="http://seclists.org/oss-sec/2011/q2/659">http://seclists.org/oss-sec/2011/q2/659</a> [0/2] restrict statistics information to user <a href="https://lkml.org/lkml/2011/6/24/88">https://lkml.org/lkml/2011/6/24/88</a> [1/2] proc: restrict access to /proc/PID/io (<a href="https://access.redhat.com/security/cve/CVE-2011-2495">CVE-2011-2495</a>) <a href="https://patchwork.kernel.org/patch/916032/">https://patchwork.kernel.org/patch/916032/</a> [2/2] taskstats: restrict access to user (<a href="https://access.redhat.com/security/cve/CVE-2011-2494">CVE-2011-2494</a>) <a href="https://patchwork.kernel.org/patch/916042/">https://patchwork.kernel.org/patch/916042/</a> <a href="http://article.gmane.org/gmane.comp.security.oss.general/5337">http://article.gmane.org/gmane.comp.security.oss.general/5337</a> Linus suggested returning accounting information at a 1k granularity instead. Acknowledgements: Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/first-publish-date
• agent/last-modified-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2011-2494
• agent/type
• agent/severity
• agent/references
• agent/weakness
• agent/description
• agent/event
• agent/source
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/openssh
• canonical/gsi openssh
• vendor/vsftpd
• canonical/vsftpd