oss-sec mailing list archives
Re: CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace
From: Eugene Teo <eugene () redhat com>
Date: Fri, 17 Apr 2009 16:58:09 +0800
Eugene Teo wrote:
I came across this while reviewing some older upstream patches. Apparently, it was possible to run kill <sig> -1 to kill processes in all PID namespaces, and break the isolation of namespaces. The expected behaviour for this is to only kill processes in its own hierarchy. The fix uses task_pid_vnr() to check if the process is outside of the caller's namespace before killing.
I am still able to reproduce the problem even after applying this upstream patch (commit d25141a8). I'm still figuring out what other patches are needed. If you know which ones, do let us know. The expected behaviour for this is: # ps -e PID TTY TIME CMD 1 pts/0 00:00:00 bash <-- this namespace's "init" 10 pts/0 00:00:00 ps # /bin/kill -s SIGKILL -1 kill -1: No such process Take note that you need to be privileged in order to create a new PID namespace, but to be able to kill other invisible processes outside of the namespace is a bypass of the intended namespaces isolation. Thanks, Eugene -- Eugene Teo / Red Hat Security Response Team
Current thread:
- CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace Eugene Teo (Apr 16)
- Re: CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace Eugene Teo (Apr 17)
- Re: CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace Eugene Teo (Apr 20)
- Re: CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace Steven M. Christey (Apr 17)
- Re: CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace Eugene Teo (Apr 17)