It was reported [1] that perf would look for configuration files in /etc/perfconfig, ~/.perfconfig, and ./config. If ./config is not a perf configuration file, perf could fail or possibly do unexpected things. If a privileged user was tricked into running perf in a directory containing a malicious ./config file, it could possibly lead to the execution of arbitrary commands.
A patch is available [2].
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632923
[2] http://marc.info/?l=linux-kernel&m=131256355026183
Created kernel tracking bugs for this issue
Affects: fedora-all [bug 729809]
Comment 5Eugene Teo (Security Response)
2011-08-12 07:05:06 UTC
Statement:
This issue did not affect Red Hat Enterprise Linux 4 and 5 as they did not include support for perf. This did not affect Red Hat Enterprise MRG as it uses the perf package from Red Hat Enterprise Linux 6. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-1465.html.
Comment 6Eugene Teo (Security Response)
2011-10-03 03:01:52 UTC