oss-security - CVE Request: kernel info leak in tkill/tgkill

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130602175608.GA14002@suse.de>
Date: Sun, 2 Jun 2013 19:56:09 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: kernel info leak in tkill/tgkill

Hi,

This small Linux kernel info leaks still needs a CVE I think.

b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
Author: Emese Revfy <re.emese@...il.com>
Date:   Wed Apr 17 15:58:36 2013 -0700

    kernel/signal.c: stop info leak via the tkill and the tgkill syscalls

    This fixes a kernel memory contents leak via the tkill and tgkill syscalls
    for compat processes.

    This is visible in the siginfo_t->_sifields._rt.si_sigval.sival_ptr field
    when handling signals delivered from tkill.

    The place of the infoleak:

    int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
    {
            ...
            put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr);
            ...
    }

    Signed-off-by: Emese Revfy <re.emese@...il.com>
    Reviewed-by: PaX Team <pageexec@...email.hu>
    Signed-off-by: Kees Cook <keescook@...omium.org>
    Cc: Al Viro <viro@...iv.linux.org.uk>
    Cc: Oleg Nesterov <oleg@...hat.com>
    Cc: "Eric W. Biederman" <ebiederm@...ssion.com>
    Cc: Serge Hallyn <serge.hallyn@...onical.com>
    Cc: <stable@...r.kernel.org>
    Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.