oss-security - Re: CVE request - kernel: race in ptrace

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Feb 2010 21:02:05 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: race in ptrace

On 02/09/2010 02:34 PM, Eugene Teo wrote:
> Discovered by Tavis Ormandy. "The race involves interaction between a
> tracer, a tracee and an antagonist. The tracer is tracing the tracee
> with PTRACE_SYSCALL and waits on the tracee. In the mean time, an
> antagonist blasts the tracee with SIGCONTs.
>
> The observed issue is that sometimes when the tracer attempts to
> continue the tracee with PTRACE_SYSCALL, it gets a return value of
> -ESRCH, indicating that the tracee is already running (or not being
> traced). It turns out that a SIGCONT wakes up the tracee in kernel mode,
> and for a moment the tracee's state is TASK_RUNNING then in ptrace_stop
> we hit the condition where the tracee is found to be running (and thus
> not traced). If the syscall is repeated, the
> second time it usually succeeds (because by that time, the tracee has
> been put into TASK_TRACED)."
>
> http://lkml.org/lkml/2010/2/8/327
> https://bugzilla.redhat.com/show_bug.cgi?id=563073

Hold on with assigning a CVE name for this. We are still investigating 
this issue.

Thanks, Eugene
-- 
Eugene Teo / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.