oss-security - Re: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20120422093444.GA1484@suse.de>
Date: Sun, 22 Apr 2012 11:34:44 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Cc: Eugene Teo <eugeneteo@...nel.sg>, security@...nel.org,
	jeffm@...e.com, Sukadev Bhattiprolu <sukadev@...ibm.com>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Pavel Emelyanov <xemul@...nvz.org>
Subject: Re: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1

On Fri, Apr 20, 2012 at 12:14:14AM -0700, Eric W. Biederman wrote:
> Eugene Teo <eugeneteo@...nel.sg> writes:
> 
> >> So we know what is holding the pid namespace reference.
> >>
> >> Additional thoughts.
> >>
> >> Does echo 3 > /proc/sys/vm/drop_caches clear up the issue?
> >
> > No.
> >
> >> Is there a corresponding task_struct leak?
> >
> > Yes.
> 
> Hmm.  The zombies are reaped? 
> 
> I am scratching my head perhaps because I am looking at the current code
> but I don't seem to see how a task that pins a pid can get past
> release_task (the zombie reaper) and in particular past in release
> __exit_signal() which calls unhash_process().
> 
> The simple test to see if we have made it past unhash_process is to see
> if you can see the zombie processes.
> 
> > I'm helping to provide more information.
> 
> You are.  Thank you for looking to see what the symptoms are.

Jeff Mahoney did locate the introducer and the fix yesterday night ...



Introduced in 423e0ab086ad8b33626e45fa94ac7613146b7ffa (in Linux 3.1 timeframe)

Date:   Tue Jul 19 09:32:38 2011 -0700

    VFS : mount lock scalability for internal mounts

And the fixed in Linux 3.2:

commit 905ad269c55fc62bee3da29f7b1d1efeba8aa1e1
Author: Al Viro <viro@...iv.linux.org.uk>
Date:   Thu Dec 8 23:20:45 2011 -0500

    procfs: fix a vfsmount longterm reference leak

    kern_mount() doesn't pair with plain mntput()...


We (SUSE) did backport the buggy patch to our SLE11 SP2 Linux 3.0 kernel, which made
it also show up there.

So mainline kernels affected: "Linux Kernel 3.1"

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.