oss-sec mailing list archives
Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation
From: Solar Designer <solar () openwall com>
Date: Sat, 21 May 2022 17:47:59 +0200
Norbert, On Fri, May 20, 2022 at 10:14:36PM +0200, Norbert Slusarek wrote:
this is an announcement for a recently reported vulnerability (CVE-2022-1729) in the perf subsystem of the Linux kernel. The issue is a race condition which was proven to allow for a local privilege escalation to root on current kernel version >= 5.4.193, but the bug seems to exist since kernel version 4.0-rc1 (patch fixes the commit to this version). Fortunately, major Linux distributions often restrict the use of perf for unprivileged users by setting the sysctl variable kernel.perf_event_paranoid >= 3, effectively rendering the vulnerability harmless. The patch can be found at https://lkml.kernel.org/r/20220520183806.GV2578 () worktop programming kicks-ass net Details ------- The following syscall order triggers the bug:
Thank you for bringing this to oss-security and for including the detail on triggering and exploiting the issue. Since you shared actual exploit code on linux-distros, you're supposed to also post that to oss-security within 7 days of your first posting above, so by or on May 27. Do you intend to? I realize this is one of the aspects that not everyone is happy about. It helps against linux-distros and its subscribers' mailboxes becoming stockpiles of unpublished exploits, and it lets those in the larger community also test their fixes, general mitigations, and/or detection tools in the same ways that linux-distros members could and without extra effort to recreate exploits. However, it also makes it easier to exploit the vulnerabilities on unpatched systems in the wild, and it could go against wishes of specific exploit authors or policies of their employers. Alexander
Current thread:
- CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Norbert Slusarek (May 20)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Solar Designer (May 21)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Norbert Slusarek (May 24)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Solar Designer (May 24)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Norbert Slusarek (May 26)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Jeremy Stanley (May 26)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Solar Designer (May 26)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Solar Designer (Jun 30)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Norbert Slusarek (Jun 30)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Norbert Slusarek (May 24)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Solar Designer (May 21)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Philip Pettersson (May 26)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Mike O'Connor (May 27)
- Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation Solar Designer (May 28)