Bug 716825 (CVE-2011-2495)

Summary:	CVE-2011-2495 kernel: /proc/PID/io infoleak
Product:	[Other] Security Response	Reporter:	Eugene Teo (Security Response) <eteo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anton, arozansk, bhu, davej, dhoward, fhrbata, jkacur, kernel-mgr, kmcmartin, lgoncalv, lwang, plougher, rt-maint, sforsber, tcallawa, vgoyal, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-05-04 07:06:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	716827, 716828, 716829, 716830, 716831, 723095, 748666, 753003
Bug Blocks:	716823

Description Eugene Teo (Security Response) 2011-06-27 08:26:44 UTC

/proc/PID/io may be used for gathering private information.  E.g. for openssh and vsftpd daemons wchars/rchars may be used to learn the precise password length.

[0/2] restrict statistics information to user
https://lkml.org/lkml/2011/6/24/88
[1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495)
https://patchwork.kernel.org/patch/916032/
[2/2] taskstats: restrict access to user (CVE-2011-2494)
https://patchwork.kernel.org/patch/916042/

taskstats authorized_keys presence infoleak PoC
http://seclists.org/oss-sec/2011/q2/659

Acknowledgements:

Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.

Comment 3 Eugene Teo (Security Response) 2011-06-27 08:40:20 UTC

http://article.gmane.org/gmane.comp.security.oss.general/5337
Linus suggested returning accounting information at a 1k granularity instead.

Comment 4 Eugene Teo (Security Response) 2011-06-27 09:22:18 UTC

Statement:

This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1212.html, https://rhn.redhat.com/errata/RHSA-2011-1189.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Comment 5 Eugene Teo (Security Response) 2011-06-29 06:09:59 UTC

(In reply to comment #0)
[...]
> [1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495)
> https://patchwork.kernel.org/patch/916032/

Upstream commits:
http://git.kernel.org/linus/1d1221f375c94ef961ba8574ac4f85c8870ddd51
http://git.kernel.org/linus/293eb1e7772b25a93647c798c7b89bf26c2da2e0

Comment 8 errata-xmlrpc 2011-08-23 14:42:51 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1189 https://rhn.redhat.com/errata/RHSA-2011-1189.html

Comment 9 errata-xmlrpc 2011-09-12 19:46:17 UTC

This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2011:1253 https://rhn.redhat.com/errata/RHSA-2011-1253.html

Comment 10 errata-xmlrpc 2011-09-13 15:44:23 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1212 https://rhn.redhat.com/errata/RHSA-2011-1212.html

Comment 11 Eugene Teo (Security Response) 2011-10-25 03:27:07 UTC

Created kernel tracking bugs for this issue

Affects: fedora-all [bug 748666]

Comment 13 errata-xmlrpc 2011-12-13 21:29:09 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5.6.Z - Server Only

Via RHSA-2011:1813 https://rhn.redhat.com/errata/RHSA-2011-1813.html