CVE-2014-4699: Linux ptrace bug

[Andy Lutomirski <luto () amacapital net>]

Hi everyone-

Upstream commit b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a fixes a
ptrace bug.  The exact scope of the bug is somewhat unclear right now.
I see no reason why the bug should not be present as far back as Linux
2.6.17, but it seems to be difficult to reproduce on old kernels.

There is some ongoing discussion on linux-distros about the impact and
applicability of this bug.

More details and a PoC to follow some time next week.

I'm being intentionally vague here: this bug has existed for a long
time, but exploiting it at all is tricky enough (and possibly
kernel-version dependent enough) that it's gone unnoticed.  I would
currently prefer to give the distros and users a bit of a headstart
before publicly disclosing the complete details of how to test/exploit
the bug.  It is likely to have a high enough impact, at least on new
enough kernels, that it should be patched ASAP.

--Andy