Re: CVE request - kernel: race in ptrace

[Eugene Teo <eugene () redhat com>]

On 02/09/2010 02:34 PM, Eugene Teo wrote:
> Discovered by Tavis Ormandy. "The race involves interaction between a
> tracer, a tracee and an antagonist. The tracer is tracing the tracee
> with PTRACE_SYSCALL and waits on the tracee. In the mean time, an
> antagonist blasts the tracee with SIGCONTs.
>
> The observed issue is that sometimes when the tracer attempts to
> continue the tracee with PTRACE_SYSCALL, it gets a return value of
> -ESRCH, indicating that the tracee is already running (or not being
> traced). It turns out that a SIGCONT wakes up the tracee in kernel mode,
> and for a moment the tracee's state is TASK_RUNNING then in ptrace_stop
> we hit the condition where the tracee is found to be running (and thus
> not traced). If the syscall is repeated, the
> second time it usually succeeds (because by that time, the tracee has
> been put into TASK_TRACED)."
>
> http://lkml.org/lkml/2010/2/8/327
> https://bugzilla.redhat.com/show_bug.cgi?id=563073

Hold on with assigning a CVE name for this. We are still investigating 
this issue.

Thanks, Eugene
--
Eugene Teo / Red Hat Security Response Team