oss-sec mailing list archives
CVE request - kernel: race in ptrace
From: Eugene Teo <eugeneteo () kernel sg>
Date: Tue, 09 Feb 2010 14:34:30 +0800
Discovered by Tavis Ormandy. "The race involves interaction between a tracer, a tracee and an antagonist. The tracer is tracing the tracee with PTRACE_SYSCALL and waits on the tracee. In the mean time, an antagonist blasts the tracee with SIGCONTs.
The observed issue is that sometimes when the tracer attempts to continue the tracee with PTRACE_SYSCALL, it gets a return value of -ESRCH, indicating that the tracee is already running (or not being traced). It turns out that a SIGCONT wakes up the tracee in kernel mode, and for a moment the tracee's state is TASK_RUNNING then in ptrace_stop we hit the condition where the tracee is found to be running (and thus not traced). If the syscall is repeated, the second time it usually succeeds (because by that time, the tracee has been put into TASK_TRACED)."
http://lkml.org/lkml/2010/2/8/327 https://bugzilla.redhat.com/show_bug.cgi?id=563073 Thanks, Eugene
Current thread:
- CVE request - kernel: race in ptrace Eugene Teo (Feb 08)
- Re: CVE request - kernel: race in ptrace Eugene Teo (Feb 10)
- Re: CVE request - kernel: race in ptrace Eugene Teo (Feb 14)
- Re: CVE request - kernel: race in ptrace Eugene Teo (Feb 10)