oss-sec mailing list archives
CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC)
From: Vasiliy Kulikov <segoon () openwall com>
Date: Fri, 24 Jun 2011 16:34:06 +0400
Hi, On Tue, Jun 21, 2011 at 15:24 -0400, Josh Bressers wrote:
/* * This program tries to learn whether ~user/.ssh/authorized_keys exists * and is nonempty for any user on local machine. It uses world-readable * taskstats' nature to get somewhat private io statistics information. If * implant taskstats or /proc//io polling into ssh client, it would be * possible to learn precise authorized_keys' size (and estimate private * key's(s') size).Are you considering this a flaw, or just an interesting security exercise? Nothing currently comes to mind, but it's possible there could be other data where knowing it exists and the size would be useful.
It can be used to learn ssh and ftp password length. If privsep is enabled in openssh and vsftpd, the unprivileged process' activity very precisely shows password information. For vsftpd read characters count is strlen("USER username\r\n") + strlen("PASSWD pass\r\n") + 1, where 1 is one byte read from a pipe related to a privileged parent. If measure statistics between user and passwords commands, actual password length and username length can be gathered. For ssh, vice versa, networking activity is constant in packets length, but interprocess communications, specifically passwords, depend on user input. For ssh pass_len = wchars - CONST, for vsftpd pass_len = rchars - CONST. Another daemons with more or less constant io activity might be vulnerable too. PAM greatly complicates precise measurements. I think it needs 2 CVE, one for /proc/PID/io and another for taskstats. https://lkml.org/lkml/2011/6/24/88 Thanks, -- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments
Current thread:
- taskstats authorized_keys presence infoleak PoC Vasiliy Kulikov (Jun 21)
- Re: taskstats authorized_keys presence infoleak PoC Josh Bressers (Jun 21)
- Re: taskstats authorized_keys presence infoleak PoC Vasiliy Kulikov (Jun 21)
- CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 24)
- Re: CVE request: kernel: taskstats/procfs io infoleak Vasiliy Kulikov (Jun 25)
- Re: CVE request: kernel: taskstats/procfs io infoleak Eugene Teo (Jun 26)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 26)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Andrew Morton (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 29)
- Re: taskstats authorized_keys presence infoleak PoC Josh Bressers (Jun 21)