oss-security - Re: Logic bug in the Linux kernel's __ptrace_may

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87cxyxe76j.fsf@gentoo.org>
Date: Fri, 15 May 2026 03:29:56 +0100
From: Sam James <sam@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: Logic bug in the Linux kernel's
 __ptrace_may_access() function

Qualys Security Advisory <qsa@...lys.com> writes:

> Hi all,
>
> Today a vulnerability that we reported to security@...nel was fixed:
>
>   https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a
>
> [...]
>
> Today we also contacted the linux-distros@...nwall, but since exploits
> are already public we were told to send this to oss-security@...nwall
> instead, hence this post. We are not publishing our advisory yet, to
> give distributions and users a chance to patch.

Thank you. I'm sorry you've had your moment somewhat spoiled.

I include some notes for readers.

--

Please note that despite the commit title and contents, it is not
exclusive to ptrace, and ptrace restriction mechanisms will not help
here.

As for mitigations: I don't think there are any real ones.

Some ideas:
* Block pidfd_getfd. I don't think it's actually used that heavily and
  there's often fallbacks for older kernels when it is.

* You could remove the world-executable bit from ssh-keysign
  but this is *not* the only binary affected, and this is a very weak
  mitigation indeed __only for the PoC__.

The patch from Linus applies cleanly down to 6.6 or so. For 6.1 (IIRC),
there was a trivial conflict (attached for convenience).

For 5.10, a prerequisite commit is handy:
5bc78502322a5e4eef3f1b2a2813751dc6434143, then apply the 6.1 version.

thanks,
sam

View attachment "0001-ptrace-slightly-saner-get_dumpable-logic.patch" of type "text/x-patch" (4025 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (419 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.