oss-sec mailing list archives
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC)
From: Andrew Morton <akpm () linux-foundation org>
Date: Tue, 28 Jun 2011 15:53:19 -0700
On Sun, 26 Jun 2011 19:57:23 -0700 Linus Torvalds <torvalds () linux-foundation org> wrote:
On Fri, Jun 24, 2011 at 5:34 AM, Vasiliy Kulikov <segoon () openwall com> wrote:I think it needs 2 CVE, one for /proc/PID/io and another for taskstats.Hmm. Should we just round them down to 1kB boundaries or something? People *do* want to know about IO accounting, but I agree that giving things at a byte granularity ends up giving way too much information. When you can see how many bytes something read off a tty, that's a problem. Returning accounting information at a 1k granularity should make it impractical to use that to guess keys etc. It still gives *some* information (and enough for rough statistics), but it doesn't give the level of detail required for any simple attack. Sometimes excessive precision isn't a good thing. Andrew - the IO_ACCT stuff went through you (back in 2006), the taskstats did too, methinks. Comments?
Random thoughts: a) I haven't thought very hard about it, but isn't it the case that fuzzifying the byte counts in this manner will still permit the length of these things to be determined, albeit with a larger data set? b) Where does the problem lie? Is it with the kernel, which exposes accurate accounting? Or is it with userspace, which accidentally exposes sensitive information by failing to account for the kernel's exposure of accurate accounting information? - Assumes that userspace can be changed to obscure this information. Erroneously, I think ;) c) Should this information be world-readable? Perhaps we should add more rational privileges here. Back-compatibility issues. If rounding the counts to a 1k granularity will indeed defeat the attack (I'm unsure) then I'd suggest that a fix would be to perform that fuzzification if the receiving process doesn't have suitable permissions. So if the user is reading his own stats or is root, he still gets byte-resolution results. This keeps the stats as useful as we can make them and reduces the back-compatibility damage. What might be the extent of the back-compatibility damage? It's hard to believe that anyone would care about a 1k error in bulk IO stats. But if there's someone out there who uses these interfaces to detect whether the monitored task is doing *anything* then we'll break them. eg, "did my data logging task just receive a packet from my scintillator experiment".
Current thread:
- taskstats authorized_keys presence infoleak PoC Vasiliy Kulikov (Jun 21)
- Re: taskstats authorized_keys presence infoleak PoC Josh Bressers (Jun 21)
- Re: taskstats authorized_keys presence infoleak PoC Vasiliy Kulikov (Jun 21)
- CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 24)
- Re: CVE request: kernel: taskstats/procfs io infoleak Vasiliy Kulikov (Jun 25)
- Re: CVE request: kernel: taskstats/procfs io infoleak Eugene Teo (Jun 26)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 26)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Andrew Morton (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: taskstats authorized_keys presence infoleak PoC Josh Bressers (Jun 21)
- Re: CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Josh Bressers (Jun 28)