oss-sec mailing list archives
Re: CVE Request -- kernel: futex: clear robust_list on execve
From: Petr Matousek <pmatouse () redhat com>
Date: Wed, 9 May 2012 21:30:55 +0200
On Tue, May 08, 2012 at 04:31:53AM +0400, Solar Designer wrote:
On Tue, May 08, 2012 at 04:08:17AM +0400, Solar Designer wrote:Indeed, execve() may make the new process relatively privileged (SUID, SGID, fscaps), and thus being able to write into its memory is a security issue. However, it appears that robust_list (and its compat counterpart) is only used for such writes when the process itself is exiting (with the aim being to notify other threads sharing the same mm). If so, the question is whether and how writes into an exiting process' memory may be exploited. We're already in do_exit() at this point, and it's just a few lines before we detach from and likely destroy the mm. Well, if that process itself is multi-threaded (and other threads are not exiting yet), it possibly can be exploited (through affecting those other threads).https://bugzilla.redhat.com/show_bug.cgi?id=771764#c4 describes that the bug was inadvertently triggered in normal usage of certain programs, and how it was rather difficult to figure out. My question is: was exit of a multi-threaded program involved and relevant? If not, then there must be something wrong with my reasoning, because I don't currently see how the bug may otherwise have visible consequences.
In this case single-threaded (privileged) Xorg was run with a stale robust list pointer that accidentally fell into MMIO area (see how ioperm() is implemnted on IA64). Because of the way ill-sized MMIO requests (exit_robust_list()) were handled in qemu-dm, the result was guest crash (all of this happened in Xen guest). -- Petr Matousek / Red Hat Security Response Team
Current thread:
- Re: CVE Request -- kernel: futex: clear robust_list on execve Solar Designer (May 07)
- Re: CVE Request -- kernel: futex: clear robust_list on execve Solar Designer (May 07)
- Re: CVE Request -- kernel: futex: clear robust_list on execve Petr Matousek (May 09)
- Re: CVE Request -- kernel: futex: clear robust_list on execve Solar Designer (May 09)
- Re: CVE Request -- kernel: futex: clear robust_list on execve Petr Matousek (May 09)
- Re: CVE Request -- kernel: futex: clear robust_list on execve Petr Matousek (May 09)
- Re: CVE Request -- kernel: futex: clear robust_list on execve Solar Designer (May 07)