Bug 27140

Summary:	ptrace bug is not fixed in kernel-2.2.17-14.i386.rpm
Product:	[Retired] Red Hat Linux	Reporter:	Nergal <nergal>
Component:	kernel	Assignee:	Michael K. Johnson <johnsonm>
Status:	CLOSED ERRATA	QA Contact:	Brock Organ <borgan>
Severity:	medium	Docs Contact:
Priority:	high
Version:	7.0	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2001-02-12 14:16:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Description Nergal 2001-02-12 13:57:10 UTC

only the flush_old_exec() function is protected. this is clearly not enough. In
particular, copy_from_user() may sleep, so during args/env copying a thread
can be blocked. Args/environment are copied after must_not_trace_exec()
(which checks if a binary is being traced), but before compute_creds() (which
sets new euid). At this moment, a binary can be attached with ptrace, even
in case of kernel-2.2.17-14.i386.rpm.
Contact nergal@avet.com.pl for a patch and additional info.

Comment 1 Arjan van de Ven 2001-04-17 07:55:55 UTC

Fixed by the errata 2.2.19 kernel