Date: Fri, 4 Jul 2014 14:05:08 -0700 From: Andy Lutomirski <luto@...capital.net> To: oss-security@...ts.openwall.com Subject: CVE-2014-4699: Linux ptrace bug Hi everyone- Upstream commit b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a fixes a ptrace bug. The exact scope of the bug is somewhat unclear right now. I see no reason why the bug should not be present as far back as Linux 2.6.17, but it seems to be difficult to reproduce on old kernels. There is some ongoing discussion on linux-distros about the impact and applicability of this bug. More details and a PoC to follow some time next week. I'm being intentionally vague here: this bug has existed for a long time, but exploiting it at all is tricky enough (and possibly kernel-version dependent enough) that it's gone unnoticed. I would currently prefer to give the distros and users a bit of a headstart before publicly disclosing the complete details of how to test/exploit the bug. It is likely to have a high enough impact, at least on new enough kernels, that it should be patched ASAP. --Andy
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ