oss-sec mailing list archives
Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871)
From: Solar Designer <solar () openwall com>
Date: Wed, 20 Feb 2013 01:01:25 +0400
On Tue, Feb 19, 2013 at 12:40:50PM -0800, Julien Tinnes wrote:
On Sat, Feb 16, 2013 at 2:49 AM, Solar Designer <solar () openwall com> wrote:I haven't looked into this closely yet, but at first glance it looks like the worst Linux kernel vulnerability in a few years.The good news is that the race is not trivial to win in an exploit. It also requires access to ptrace() (but unfortunately most distros don't limit ptrace()).
Yeah. To clarify why the vulnerability looks so bad to me: for our kernel builds and usage, it appears to be the worst since CVE-2010-3081 (compat_alloc_user_space() missing sanity checks), although it is probably trickier to exploit in the wild (due to the race). There were other local vulnerabilities in the Linux kernel discovered in those ~2.5 years, but they were in more obscure subsystems (which we generally don't expose) or/and they required that the local attacker would execute a SUID/SGID program. This one, however, is in an (almost) core kernel component and is self-contained (no dependency on the userland being non-perfect), which makes it almost as bad as CVE-2010-3081, except that it's a race. On the other hand, CVE-2010-3081 did not affect 32-bit only kernel builds, whereas this new vulnerability probably does.
Are all architectures affected? The ptrace code in the kernel is naturally somewhat arch-specific, so _maybe_ not all are affected.We don't know of any other architecture other that x86 affected, but again, I don't think anyone spent time trying to figure this out. It's possible that the same mistake was made on another architecture.
Have you looked into whether 32-bit x86 kernel builds are affected to the same extent? Thanks, Alexander
Current thread:
- Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Julien Tinnes (Feb 15)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Solar Designer (Feb 16)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Julien Tinnes (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Solar Designer (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Solar Designer (Mar 15)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Greg KH (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Greg KH (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Julien Tinnes (Feb 19)
- Re: Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871) Solar Designer (Feb 16)