Date: Sat, 21 May 2022 17:47:59 +0200 From: Solar Designer <solar@...nwall.com> To: Norbert Slusarek <nslusarek@....net> Cc: oss-security@...ts.openwall.com, peterz@...radead.org Subject: Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Norbert, On Fri, May 20, 2022 at 10:14:36PM +0200, Norbert Slusarek wrote: > this is an announcement for a recently reported vulnerability (CVE-2022-1729) in the perf subsystem > of the Linux kernel. The issue is a race condition which was proven to allow for a local privilege > escalation to root on current kernel version >= 5.4.193, but the bug seems to exist since kernel > version 4.0-rc1 (patch fixes the commit to this version). > Fortunately, major Linux distributions often restrict the use of perf for unprivileged users by > setting the sysctl variable kernel.perf_event_paranoid >= 3, effectively rendering the > vulnerability harmless. > > The patch can be found at > https://lkml.kernel.org/r/20220520183806.GV2578@worktop.programming.kicks-ass.net > > Details > ------- > > The following syscall order triggers the bug: Thank you for bringing this to oss-security and for including the detail on triggering and exploiting the issue. Since you shared actual exploit code on linux-distros, you're supposed to also post that to oss-security within 7 days of your first posting above, so by or on May 27. Do you intend to? I realize this is one of the aspects that not everyone is happy about. It helps against linux-distros and its subscribers' mailboxes becoming stockpiles of unpublished exploits, and it lets those in the larger community also test their fixes, general mitigations, and/or detection tools in the same ways that linux-distros members could and without extra effort to recreate exploits. However, it also makes it easier to exploit the vulnerabilities on unpatched systems in the wild, and it could go against wishes of specific exploit authors or policies of their employers. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.