oss-sec mailing list archives
Re: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1
From: Marcus Meissner <meissner () suse de>
Date: Sun, 22 Apr 2012 11:34:44 +0200
On Fri, Apr 20, 2012 at 12:14:14AM -0700, Eric W. Biederman wrote:
Eugene Teo <eugeneteo () kernel sg> writes:So we know what is holding the pid namespace reference. Additional thoughts. Does echo 3 > /proc/sys/vm/drop_caches clear up the issue?No.Is there a corresponding task_struct leak?Yes.Hmm. The zombies are reaped? I am scratching my head perhaps because I am looking at the current code but I don't seem to see how a task that pins a pid can get past release_task (the zombie reaper) and in particular past in release __exit_signal() which calls unhash_process(). The simple test to see if we have made it past unhash_process is to see if you can see the zombie processes.I'm helping to provide more information.You are. Thank you for looking to see what the symptoms are.
Jeff Mahoney did locate the introducer and the fix yesterday night ... Introduced in 423e0ab086ad8b33626e45fa94ac7613146b7ffa (in Linux 3.1 timeframe) Date: Tue Jul 19 09:32:38 2011 -0700 VFS : mount lock scalability for internal mounts And the fixed in Linux 3.2: commit 905ad269c55fc62bee3da29f7b1d1efeba8aa1e1 Author: Al Viro <viro () zeniv linux org uk> Date: Thu Dec 8 23:20:45 2011 -0500 procfs: fix a vfsmount longterm reference leak kern_mount() doesn't pair with plain mntput()... We (SUSE) did backport the buggy patch to our SLE11 SP2 Linux 3.0 kernel, which made it also show up there. So mainline kernels affected: "Linux Kernel 3.1" Ciao, Marcus
Current thread:
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1, (continued)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Eric W. Biederman (Apr 19)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Eugene Teo (Apr 19)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Pavel Emelyanov (Apr 19)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Eric W. Biederman (Apr 20)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Pavel Emelyanov (Apr 20)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Eric W. Biederman (Apr 20)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Eric W. Biederman (Apr 19)
- Re: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Marcus Meissner (Apr 20)
- Re: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Eric W. Biederman (Apr 20)
- Re: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Marcus Meissner (Apr 20)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Eric W. Biederman (Apr 20)
- Re: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Marcus Meissner (Apr 22)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Marcus Meissner (Apr 20)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Kurt Seifried (Apr 20)
- Re: CVE request: pid namespace leak in kernel 3.0 and 3.1 Eric W. Biederman (Apr 19)