oss-security - CVE request: kernel: ptrace_attach: fix the usage of ->cred_exec

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <49FE6F86.3040007@redhat.com>
Date: Mon, 04 May 2009 12:31:02 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: ptrace_attach: fix the usage of ->cred_exec_mutex

This vulnerability was introduced in commit d84f4f99 ("CRED: Inaugurate
COW credentials"), and was fixed in commit cad81bc2 ("ptrace:
ptrace_attach: fix the usage of ->cred_exec_mutex").

It affects kernel 2.6.29.

The patch ensured that both ptrace_attach() and the tracee are
serialised by the tracee's cred_exec_mutex. If not, the race can be
exploited by calling ptrace(PTRACE_ATTACH) to the task in the middle of
exec(setuid_application). This could result in a local privilege escalation.

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.