Bug 729808 (CVE-2011-2905)

Summary:	CVE-2011-2905 kernel: perf tools: may parse user-controlled configuration file
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anton, aquini, arozansk, davej, fhrbata, gansalmon, itamar, jbenc, jolsa, jonathan, kernel-maint, kernel-mgr, kmcmartin, lwang, madhu.chinakonda, sforsber, tcallawa
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-05-04 06:53:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	729809, 730203, 730204, 730205, 761360
Bug Blocks:	729837

Description Vincent Danen 2011-08-10 21:43:21 UTC

It was reported [1] that perf would look for configuration files in /etc/perfconfig, ~/.perfconfig, and ./config.  If ./config is not a perf configuration file, perf could fail or possibly do unexpected things.  If a privileged user was tricked into running perf in a directory containing a malicious ./config file, it could possibly lead to the execution of arbitrary commands.

A patch is available [2].

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632923
[2] http://marc.info/?l=linux-kernel&m=131256355026183

Comment 1 Vincent Danen 2011-08-10 21:47:38 UTC

Created kernel tracking bugs for this issue

Affects: fedora-all [bug 729809]

Comment 5 Eugene Teo (Security Response) 2011-08-12 07:05:06 UTC

Statement:

This issue did not affect Red Hat Enterprise Linux 4 and 5 as they did not include support for perf. This did not affect Red Hat Enterprise MRG as it uses the perf package from Red Hat Enterprise Linux 6. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-1465.html.

Comment 6 Eugene Teo (Security Response) 2011-10-03 03:01:52 UTC

Upstream commit: http://git.kernel.org/linus/aba8d056078e47350d85b06a9cabd5afcc4b72ea

Comment 7 errata-xmlrpc 2011-11-22 16:49:57 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1465 https://rhn.redhat.com/errata/RHSA-2011-1465.html