oss-sec mailing list archives
Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871)
From: Solar Designer <solar () openwall com>
Date: Sat, 16 Feb 2013 14:49:22 +0400
On Fri, Feb 15, 2013 at 12:24:18PM -0800, Julien Tinnes wrote:
Linux kernel stack corruption due to race condition with PTRACE_SETREGS
I haven't looked into this closely yet, but at first glance it looks like the worst Linux kernel vulnerability in a few years. For distro vendor kernels (rather than mainline, which was patched almost a month ago), this is a 0-day. We need to figure out a few things: What's the oldest affected kernel version? Which "stable" and distro vendor kernels are affected? This does not appear to be e.g. on Red Hat's Bugzilla yet ... but it's already on HN: https://news.ycombinator.com/item?id=5230262 (perhaps the weekend plays a role in the delay of vendor response). Are all architectures affected? The ptrace code in the kernel is naturally somewhat arch-specific, so _maybe_ not all are affected. The mainline commits from January are by Oleg Nesterov of Red Hat. Why wasn't(?) the issue handled with due severity within Red Hat, then - such that Red Hat would at the very least have a statement on whether and which of their kernels are affected by now. My guess is that the full severity of the issue might not have been understood by Oleg at the time, but it's only a guess. Alexander
Current thread:
- Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Julien Tinnes (Feb 15)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Solar Designer (Feb 16)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Julien Tinnes (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Solar Designer (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Solar Designer (Mar 15)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Greg KH (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Greg KH (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Julien Tinnes (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Solar Designer (Feb 16)