[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130219210125.GA27485@openwall.com>
Date: Wed, 20 Feb 2013 01:01:25 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871)
On Tue, Feb 19, 2013 at 12:40:50PM -0800, Julien Tinnes wrote:
> On Sat, Feb 16, 2013 at 2:49 AM, Solar Designer <solar@...nwall.com> wrote:
> > I haven't looked into this closely yet, but at first glance it looks
> > like the worst Linux kernel vulnerability in a few years.
>
> The good news is that the race is not trivial to win in an exploit. It
> also requires access to ptrace() (but unfortunately most distros don't
> limit ptrace()).
Yeah. To clarify why the vulnerability looks so bad to me: for our
kernel builds and usage, it appears to be the worst since CVE-2010-3081
(compat_alloc_user_space() missing sanity checks), although it is
probably trickier to exploit in the wild (due to the race). There were
other local vulnerabilities in the Linux kernel discovered in those ~2.5
years, but they were in more obscure subsystems (which we generally
don't expose) or/and they required that the local attacker would execute
a SUID/SGID program. This one, however, is in an (almost) core kernel
component and is self-contained (no dependency on the userland being
non-perfect), which makes it almost as bad as CVE-2010-3081, except that
it's a race. On the other hand, CVE-2010-3081 did not affect 32-bit
only kernel builds, whereas this new vulnerability probably does.
> > Are all architectures affected? The ptrace code in the kernel is
> > naturally somewhat arch-specific, so _maybe_ not all are affected.
>
> We don't know of any other architecture other that x86 affected, but
> again, I don't think anyone spent time trying to figure this out. It's
> possible that the same mistake was made on another architecture.
Have you looked into whether 32-bit x86 kernel builds are affected to
the same extent?
Thanks,
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
