Date: Wed, 20 Feb 2013 01:01:25 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) On Tue, Feb 19, 2013 at 12:40:50PM -0800, Julien Tinnes wrote: > On Sat, Feb 16, 2013 at 2:49 AM, Solar Designer <solar@...nwall.com> wrote: > > I haven't looked into this closely yet, but at first glance it looks > > like the worst Linux kernel vulnerability in a few years. > > The good news is that the race is not trivial to win in an exploit. It > also requires access to ptrace() (but unfortunately most distros don't > limit ptrace()). Yeah. To clarify why the vulnerability looks so bad to me: for our kernel builds and usage, it appears to be the worst since CVE-2010-3081 (compat_alloc_user_space() missing sanity checks), although it is probably trickier to exploit in the wild (due to the race). There were other local vulnerabilities in the Linux kernel discovered in those ~2.5 years, but they were in more obscure subsystems (which we generally don't expose) or/and they required that the local attacker would execute a SUID/SGID program. This one, however, is in an (almost) core kernel component and is self-contained (no dependency on the userland being non-perfect), which makes it almost as bad as CVE-2010-3081, except that it's a race. On the other hand, CVE-2010-3081 did not affect 32-bit only kernel builds, whereas this new vulnerability probably does. > > Are all architectures affected? The ptrace code in the kernel is > > naturally somewhat arch-specific, so _maybe_ not all are affected. > > We don't know of any other architecture other that x86 affected, but > again, I don't think anyone spent time trying to figure this out. It's > possible that the same mistake was made on another architecture. Have you looked into whether 32-bit x86 kernel builds are affected to the same extent? Thanks, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.