Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 Jun 2011 23:51:28 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: taskstats authorized_keys presence infoleak PoC

Hi Josh,

On Tue, Jun 21, 2011 at 15:24 -0400, Josh Bressers wrote:
> ----- Original Message -----
> > /*
> > * This program tries to learn whether ~user/.ssh/authorized_keys exists
> > * and is nonempty for any user on local machine. It uses world-readable
> > * taskstats' nature to get somewhat private io statistics information.  If
> > * implant taskstats or /proc//io polling into ssh client, it would be
> > * possible to learn precise authorized_keys' size (and estimate private
> > * key's(s') size).
> 
> Are you considering this a flaw, or just an interesting security exercise?

The PoC itself is the latter, but i *suppose* procfs and taskstats may
be used to get much more private information (hey, this is just a PoC!)
and to carry out something like timing attack against specific programs,
but using this statistic information instead of time deltas.

However, I'm not familiar with timing attack carrying and cannot realize
whether it is generic or highly conditional flaw.  So, I'd not request
CVE or anything for it.


Thanks,

-- 
Vasiliy

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.