oss-sec mailing list archives
CVE request: Another Linux syscall auditing bug
From: Andy Lutomirski <luto () amacapital net>
Date: Thu, 19 Jun 2014 18:26:38 -0700
On a 32-bit x86 kernel with syscall auditing enabled, syscall(1000) will cause an OOPS. This problem goes at least as far back as Linux 3.11 and appears to be present in Linux 3.15 as well. I suspect that this bug is very old. In order to see this bug, you'll need syscall auditing on (auditctl -e 1 will do that) and you'll need 'sep' in flags in /proc/cpuinfo. That means that qemu -cpu qemu64 will not be exposed to this bug, but qemu -cpu host will on any recent CPU. Mitigations include: - Running under ptrace or strace. - Using any seccomp filter at all (phew!) - Turning off SEP (which is a big slowdown on all syscalls) - auditctl -a task,never I'd be rather surprised if this can be used for anything other than DoS, although the same underlying bug could potentially have more serious consequences. This bug was found (inadvertently, I presume) by Toralf Förster. The patch here: http://lkml.kernel.org/g/CALCETrW7U4AHG-a9oPbOt31z3wgzhjSu8b+yGpdM4+vNinKgsA () mail gmail com is reported to fix the bug, but it should not be considered to be well-tested. --Andy
Current thread:
- CVE request: Another Linux syscall auditing bug Andy Lutomirski (Jun 19)
- Re: CVE request: Another Linux syscall auditing bug Steve Grubb (Jun 19)
- Re: CVE request: Another Linux syscall auditing bug cve-assign (Jun 20)