oss-sec mailing list archives
Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC)
From: Linus Torvalds <torvalds () linux-foundation org>
Date: Tue, 28 Jun 2011 17:12:13 -0700
On Tue, Jun 28, 2011 at 3:53 PM, Andrew Morton <akpm () linux-foundation org> wrote:
a) I haven't thought very hard about it, but isn't it the case that fuzzifying the byte counts in this manner will still permit the length of these things to be determined, albeit with a larger data set?
Well, if we're talking things like passwords read from /dev/tty, there really _isn't_ a larger data set to be had. Which is why I suspect that it would be fine to just mask the low bits and give 1kB resolution in general. It's not like I could imagine an app like "iotop" would ever care about individual bytes, so there's no reason to expose things at that granularity.
b) Where does the problem lie? Is it with the kernel, which exposes accurate accounting? Or is it with userspace, which accidentally exposes sensitive information by failing to account for the kernel's exposure of accurate accounting information?
Well, if you do a read of a password from a tty, there really isn't much you can do about the tty IO count showing up. If the rest of the IO is packetized some way, you can probably figure out the parts that are individual bytes.
c) Should this information be world-readable? Perhaps we should add more rational privileges here. Back-compatibility issues.
I already applied the /proc part. That seemed like a nobrainer. The taskstat part look slike it might break iotop to tighten the security, so there I'm thinking the granularity approach would be a sufficient workaround.
If rounding the counts to a 1k granularity will indeed defeat the attack (I'm unsure) then I'd suggest that a fix would be to perform that fuzzification if the receiving process doesn't have suitable permissions. So if the user is reading his own stats or is root, he still gets byte-resolution results. This keeps the stats as useful as we can make them and reduces the back-compatibility damage.
Sure. Linus
Current thread:
- taskstats authorized_keys presence infoleak PoC Vasiliy Kulikov (Jun 21)
- Re: taskstats authorized_keys presence infoleak PoC Josh Bressers (Jun 21)
- Re: taskstats authorized_keys presence infoleak PoC Vasiliy Kulikov (Jun 21)
- CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 24)
- Re: CVE request: kernel: taskstats/procfs io infoleak Vasiliy Kulikov (Jun 25)
- Re: CVE request: kernel: taskstats/procfs io infoleak Eugene Teo (Jun 26)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 26)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Andrew Morton (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 28)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Linus Torvalds (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Vasiliy Kulikov (Jun 29)
- Re: taskstats authorized_keys presence infoleak PoC Josh Bressers (Jun 21)
- Re: CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Josh Bressers (Jun 28)
- Re: CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC) Eugene Teo (Jun 28)