oss-security - CVE request: kernel: multiple flaws allowing to sniff keystrokes timings

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 8 Nov 2011 16:14:12 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: multiple flaws allowing to sniff keystrokes
 timings

Hi,

I don't know whether these need several CVEs, but they allow to do
roughly the same thing: monitor the time when users push keys on the
keyboard/ttys and get at least password length or with a more
sophisticated technique learn the precise input characters sequence by
matching the timings against the statistical information.

1) https://lkml.org/lkml/2011/11/7/340 

"/proc/interrupts contains the number of emitted interrupts, which
should not be world readable.  The information about keyboard
interrupts number may be used to learn the precise number of characters
in users' passwords by simply watching the changes of number of emitted
interrupts during the life of gksu-like programs."

PoC: http://www.openwall.com/lists/oss-security/2011/11/07/9

Vulnerable: all Linux versions, all distros with procfs mounted.

(The patch misses the same infoleak via /proc/stat, which must be
closed too.)

2) https://lkml.org/lkml/2011/11/7/355

The same as (1), but via tty devices' atime and mtime.

"You can still figure it out by watching the files in /dev/pts/ and
/dev/tty* for changes in last-modify time."

Vulnerable: all Linux versions, all distros with world readable
directories containing tty and pts device files.

3) https://lkml.org/lkml/2011/11/8/136

"/proc/$PID/{sched,schedstat} contain debugging scheduler counters, which
should not be world readable.  They may be used to gather private information
about processes' activity.  E.g. it can be used to count the number of
characters typed in gksu dialog."

PoC: http://www.openwall.com/lists/oss-security/2011/11/05/3

Vulnerable: all Linux >= 2.6.9, all distros with procfs mounted.

These are not fixed yet, the solution might be introducing revoke() with
permission restrictions, see the first link in (1) with the discussion.

Also, security@...nel.org is unavailable, is there any substitution of
this email?

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.