Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 4 Jul 2014 14:05:08 -0700
From: Andy Lutomirski <luto@...capital.net>
To: oss-security@...ts.openwall.com
Subject: CVE-2014-4699: Linux ptrace bug

Hi everyone-

Upstream commit b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a fixes a
ptrace bug.  The exact scope of the bug is somewhat unclear right now.
I see no reason why the bug should not be present as far back as Linux
2.6.17, but it seems to be difficult to reproduce on old kernels.

There is some ongoing discussion on linux-distros about the impact and
applicability of this bug.

More details and a PoC to follow some time next week.

I'm being intentionally vague here: this bug has existed for a long
time, but exploiting it at all is tricky enough (and possibly
kernel-version dependent enough) that it's gone unnoticed.  I would
currently prefer to give the distros and users a bit of a headstart
before publicly disclosing the complete details of how to test/exploit
the bug.  It is likely to have a high enough impact, at least on new
enough kernels, that it should be patched ASAP.

--Andy

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ