Bug 716842 (CVE-2011-2494)

taskstats information may be used for gathering private information.  E.g. for openssh and vsftpd daemons read_characters/write_characters may be used to learn the precise password length.  Restrict it to processes being able to ptrace the target process.  For TASKSTATS_CMD_ATTR_REGISTER_CPUMASK the fix is euid check instead of a ptrace check as the handler is processed in the context of the target process, not the listener process'.  When ptrace_task_may_access_current() is introduced, it should be used instead of euid check.  Currently there is a small race when a process temporarily changes its euid (e.g. to access user's files), until the process sets euid back user's processes may gather privileged process' statistics.

taskstats authorized_keys presence infoleak PoC
http://seclists.org/oss-sec/2011/q2/659

[0/2] restrict statistics information to user
https://lkml.org/lkml/2011/6/24/88
[1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495)
https://patchwork.kernel.org/patch/916032/
[2/2] taskstats: restrict access to user (CVE-2011-2494)
https://patchwork.kernel.org/patch/916042/

http://article.gmane.org/gmane.comp.security.oss.general/5337
Linus suggested returning accounting information at a 1k granularity instead.

Acknowledgements:

Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.