Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 Jun 2014 23:37:39 -0400
From: Steve Grubb <sgrubb@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Andy Lutomirski <luto@...capital.net>,
        Linux Audit <linux-audit@...hat.com>
Subject: Re: CVE request: Another Linux syscall auditing bug

Hi,

Reminder again...please report bugs to linux-audit mail list.

On Thursday, June 19, 2014 06:26:38 PM Andy Lutomirski wrote:
> On a 32-bit x86 kernel with syscall auditing enabled, syscall(1000)
> will cause an OOPS.  This problem goes at least as far back as Linux
> 3.11 and appears to be present in Linux 3.15 as well.  I suspect that
> this bug is very old.
> 
> In order to see this bug, you'll need syscall auditing on (auditctl -e
> 1 will do that) and you'll need 'sep' in flags in /proc/cpuinfo.  That
> means that qemu -cpu qemu64 will not be exposed to this bug, but qemu
> -cpu host will on any recent CPU.
> 
> Mitigations include:
>  - Running under ptrace or strace.
>  - Using any seccomp filter at all (phew!)
>  - Turning off SEP (which is a big slowdown on all syscalls)
>  - auditctl -a task,never
> 
> I'd be rather surprised if this can be used for anything other than
> DoS, although the same underlying bug could potentially have more
> serious consequences.
> 
> This bug was found (inadvertently, I presume) by Toralf Förster.  The
> patch here:
> 
> http://lkml.kernel.org/g/CALCETrW7U4AHG-a9oPbOt31z3wgzhjSu8b+yGpdM4+vNinKgsA
> @mail.gmail.com
> 
> is reported to fix the bug, but it should not be considered to be
> well-tested.
> 
> --Andy

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.