Re: CVE-2014-4699: Linux ptrace bug

[Solar Designer <solar () openwall com>]

On Sat, Jul 05, 2014 at 10:25:47PM +0400, Solar Designer wrote:
> Red Hat's statement is:
>
> "This issue affects the versions of the Linux kernel as shipped with
> Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel
> updates for Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 may
> address this issue."
>
> but it appears to have been posted before my unsuccessful attempts to
> trigger the error condition on RHEL5'ish and RHEL6'ish kernels yesterday.
> I fully agree that we need to treat these kernels as likely vulnerable
> unless we can show otherwise, though - obviously, simply not being able
> to trigger the problem with a particular PoC doesn't mean much.

Red Hat's statement has since been edited to:

"This issue does not affect the versions of the Linux kernel as shipped
with Red Hat Enterprise Linux 5.

Future kernel updates for Red Hat Enterprise Linux 6, 7 and Red Hat
Enterprise MRG 2 will address this issue."

I was subscribed to this Bugzilla entry, yet I didn't receive an e-mail
notification when this edit was made.  I guess Bugzilla does not send
those for edits to past comments.  While I think I understand why Red
Hat does it this way, and it's fine, maybe a better practice would be to
also add new comments like "I've just edited our statement in comment #4
above because ..." - that way, some revision history will be preserved,
rationale for the change given, and e-mail notifications will be sent.

Anyway, let me ask: Red Hat, how do you know RHEL5 kernels are not
vulnerable, whereas RHEL6 are?  There must have been some analysis to
arrive at these conclusions.  This will be very helpful to know for
downstream projects (as it relates to your kernels), including OpenVZ
and Owl.

Since we're past the weekend and since some distros have already
released security updates, I think it's OK to start talking about
specific code paths triggering the problem publicly.  In fact, I think
it's best to make this info public before the next weekend approaches.

Meanwhile, I've attached the patch for RHEL5.10/OpenVZ that we're using
on Owl (lacking convincing rationale, let alone proof, why those kernels
are not vulnerable).

Thanks,

Alexander

Attachment: linux-2.6.18-371.9.1.el5.028stab114.2-CVE-2014-4699.diff
Description: