Date: Thu, 22 Dec 2011 18:06:47 +0100 From: Petr Matousek <pmatouse@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2011-4127 kernel: possible privilege escalation via SG_IO ioctl Paolo Bonzini of Red Hat found out that the host Linux system allows executing the SG_IO ioctl on a partition or even on an LVM volume, and will pass the command to the underlying block device. This could be further exploited in the in the context of virtualization, because virtio disks support a limited form of SCSI passthrough via the SG_IO ioctl. If virtio disk is hosted on a partition or LVM volume with format=raw, tools such as sg_dd can be used to read and write other data on the same disk --- even data that belongs to the host or to other guests. References: https://lkml.org/lkml/2004/8/12/218 https://lkml.org/lkml/2004/8/12/260 https://bugzilla.redhat.com/show_bug.cgi?id=752375 Thanks, -- Petr Matousek / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.