Re: CVE request: pid namespace leak in kernel 3.0 and 3.1

[Pavel Emelyanov <xemul () parallels com>]

On 04/20/2012 07:10 AM, Eugene Teo wrote:
> > So we know what is holding the pid namespace reference.
> >
> > Additional thoughts.
> >
> > Does echo 3 > /proc/sys/vm/drop_caches clear up the issue?
>
> No.
>
> > Is there a corresponding task_struct leak?
>
> Yes.
>
> > I don't have much of a clue or much concern as this seems fixed in later kernels but I am happy to suggest things to 
> > look for to help narrow this down.
>
> I'm helping to provide more information.

Is there also a vfsmount struct leak as well? The pidns creating implies
kern-mount-ing of a proc and it should be released when child reaper of
the namespace dies.

> Thanks, Eugene
> .