Bug 1861851 (CVE-2011-2707)

Summary:	CVE-2011-2707 kernel: exposure of sensitive information via a crafted PTRACE_SETXTREGS request
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, ptalbert, qzhao, rkeshri, rt-maint, rvrbovsk, steved, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in ptrace_setxregs in arch/xtensa/kernel/ptrace.c on the Xtensa architecture, where there was an arbitrary kernel read problem seen without a pre-address validation. This flaw allows an attacker with local access and special user privileges (of CAP_SYS_PTRACE) to cause a confidentiality breach, resulting in a denial of service. The highest threat from this vulnerability is to confidentiality and system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-30 19:27:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1861852
Bug Blocks:	1861853

Description Guilherme de Almeida Suckevicz 2020-07-29 17:54:16 UTC

A flaw was found in ptrace_setxregs in arch/xtensa/kernel/ptrace.c on Xtensa architecture. There was an arbitrary kernel read problem seen with no pre address validation.  Here an attacker with a local access and a special user privilege (of CAP_SYS_PTRACE) can cause a confidentiality breach, this can even lead to a denial of service (DoS) problem.

This allows a local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request.

Reference:
http://www.openwall.com/lists/oss-security/2011/07/20/18

Upstream commit:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d0138ebe24b94065580bd2601f8bb7eb6152f56

Comment 1 Guilherme de Almeida Suckevicz 2020-07-29 17:56:49 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1861852]

Comment 2 Justin M. Forbes 2020-07-29 18:34:10 UTC

This is old enough to have not impacted any currently supported version of Fedora.

Comment 4 Product Security DevOps Team 2020-07-30 19:27:48 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2011-2707

Comment 8 Rohit Keshri 2020-07-31 10:10:53 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 9 RaTasha Tillery-Smith 2020-09-01 19:40:35 UTC

Statement:

There was no shipped kernel version seen affected by this problem.