Date: Wed, 6 May 2020 15:12:12 +1000 From: Wade Mealing <wmealing@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2020-10732 kernel: uninitialized kernel data leak in userspace coredumps Gday, A potential info leak of kernel private memory to userspace was found in the kernel's implementation of core dumping userspace processes. An area of memory was allocated from free memory without being correctly initialized, this memory contents could contain kernel private information from previous executions and leak it to kernel space for any (probably local) user that is able to read the core dump. This seems like it would allow leaking of possible registers that are not stored/initialized in the core dump itself. The amount leaked will depend on the register state at the time of the crash, it could also leak nothing. This was introduced in 4206d3aa1978e44f58bfa4e1c9d8d35cbf19c187 Possible mitigation would be to disable core dumps system-wide by setting: * hard core 0 In the /etc/security/limits.conf file and restarting applications/services/processes which users may have access to or simply reboot the system. This disables core dumps which may not be a suitable workaround in your environment. Relevant links: ------------------- Not upstream but a patch: https://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a Where I found out about it: https://twitter.com/grsecurity/status/1252558055629299712 Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1831399 Thank you. Wade Mealing Product Security - Kernel Red Hat wmealing@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.