oss-security - CVE request - kernel: race in ptrace

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 09 Feb 2010 14:34:30 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request - kernel: race in ptrace

Discovered by Tavis Ormandy. "The race involves interaction between a 
tracer, a tracee and an antagonist. The tracer is tracing the tracee 
with PTRACE_SYSCALL and waits on the tracee. In the mean time, an 
antagonist blasts the tracee with SIGCONTs.

The observed issue is that sometimes when the tracer attempts to 
continue the tracee with PTRACE_SYSCALL, it gets a return value of 
-ESRCH, indicating that the tracee is already running (or not being 
traced).  It turns out that a SIGCONT wakes up the tracee in kernel 
mode, and for a moment the tracee's state is TASK_RUNNING then in 
ptrace_stop we hit the condition where the tracee is found to be running 
(and thus not traced).  If the syscall is repeated, the
second time it usually succeeds (because by that time, the tracee has 
been put into TASK_TRACED)."

http://lkml.org/lkml/2010/2/8/327
https://bugzilla.redhat.com/show_bug.cgi?id=563073

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.