Bug 133113
| Summary: | CAN-2004-1058 /proc/<PID>/cmdline information disclosure | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 3 | Reporter: | Josh Bressers <bressers> |
| Component: | kernel | Assignee: | Dave Anderson <anderson> |
| Status: | CLOSED ERRATA | QA Contact: | Brian Brock <bbrock> |
| Severity: | low | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.0 | CC: | jbaron, mjc, petrides, redhat-bugzilla, riel |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | impact=low,public=20040730 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2005-04-22 20:17:32 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Might be 2.6 only fixed in 2.6.9 http://linux.bkbits.net:8080/linux-2.6/cset@412a4baaEebwtKg-X7sS2r5Mua6uGw It's a very small window of opportunity where the arg_start can be initialized but the arg_end still not be, so it's hard to make this happen easily. But if I manually modify arg_end to be zero in an existing task's mm_struct, I can reproduce the problem. Here I'm in a crash session, where I've got a "doit" process just sleeping. Escaping to a shell, and doing a "ps -ax" shows it as pid 557: crash> !ps -ax | grep doit 557 pts/10 S 0:00 ./doit 577 pts/10 S 0:00 sh -c ps -ax | grep doit 579 pts/10 S 0:00 grep doit crash> If I then determine where pid 557's mm_struct's arg_end is located, (in this example I've determined it to be at address df66dce4), and them write a 0 there, a subsequent ps shows this: crash> wr df66dce4 0 crash> !ps -ax | grep doit 557 pts/10 S 0:00 ./doit HOSTNAME=crash.boston.redhat.com PVM_RSH=/usr/bin/rsh HOST=crash TERM=xterm SHELL=/bin/bas 599 pts/10 S 0:00 sh -c ps -ax | grep doit 601 pts/10 S 0:00 grep doit crash> I'll apply an applicable 2.4 patch and verify that it handles it properly. A fix for this problem has just been committed to the RHEL3 U5 patch pool this evening (in kernel version 2.4.21-27.3.EL). A fix for this problem has also been committed to the RHEL3 E5 patch pool this evening (in kernel version 2.4.21-27.0.3.EL). An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-293.html An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-294.html |
There's a race in the kernel, and considering the permissions on /proc/PID/{cmdline,environ} a security bug as well: If you win the race with a starting process, you can read its environment. http://lkml.org/lkml/2004/7/29/332