Bug 782642 (CVE-2012-0056)

Summary: CVE-2012-0056 kernel: proc: /proc/<pid>/mem mem_write insufficient permission checking
Product: [Other] Security Response Reporter: Eugene Teo (Security Response) <eteo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agordeev, bhu, bressers, dhoward, dwalsh, eparis, fche, gthreepwood, jkacur, jrieden, kernel-mgr, kzhang, lgoncalv, lwang, menthos, nobody, plougher, pmatouse, rt-maint, the.ridikulus.rat, vgoyal, williams, wnix
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20120118,reported=20120118,source=git,cvss2=7.2/AV:L/AC:L/Au:N/C:C/I:C/A:C,rhel-4/kernel=notaffected,rhel-5/kernel=affected,mrg-2/realtime-kernel=affected,rhel-6/kernel=affected,fedora-all/kernel=affected,cwe=CWE-863
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 782643, 782645, 782646, 782647, 782649, 782650, 782681    
Bug Blocks: 782636    
Attachments:
Description Flags
A reproducer that tests if we have commit 198214a7. none

Description Eugene Teo (Security Response) 2012-01-17 21:34:28 EST
From Linus' patch:
"Jüri Aedla reported that the /proc/<pid>/mem handling really isn't very robust, and it also doesn't match the permission checking of any of the other related files.

This changes it to do the permission checks at open time, and instead of tracking the process, it tracks the VM at the time of the open.  That simplifies the code a lot, but does mean that if you hold the file descriptor open over an execve(), you'll continue to read from the _old_ VM."

A local, unprivileged user could use this flaw to escalate their privileges.

Upstream commit:
http://git.kernel.org/linus/e268337dfe26dfc7efd422a804dbb27977a3cccc

Acknowledgements:

Red Hat would like to thank Jüri Aedla for reporting this issue.
Comment 7 Eugene Teo (Security Response) 2012-01-17 22:06:52 EST
Statement:

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as it did not backport the upstream commit 198214a7ee. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2012-0052.html and  https://rhn.redhat.com/errata/RHSA-2012-0061.html. For more information, please read https://access.redhat.com/kb/docs/DOC-69129.
Comment 11 Eugene Teo (Security Response) 2012-01-18 02:09:45 EST
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 782681]
Comment 14 Eugene Teo (Security Response) 2012-01-18 08:18:47 EST
Ensure that ASLR is enabled, see /proc/sys/kernel/randomize_va_space.
Comment 17 Eugene Teo (Security Response) 2012-01-20 02:16:14 EST
Created attachment 556461 [details]
A reproducer that tests if we have commit 198214a7.
Comment 18 Petr Matousek 2012-01-20 04:36:47 EST
To mitigate the issue:

1) On the host, save the following in a file with the ".stp" extension:

probe kernel.function("mem_write@fs/proc/base.c").call {
  $count = 0
}

2) Install the "systemtap" package and any required dependencies. Refer to
the "2. Using SystemTap" chapter in the Red Hat Enterprise Linux 6
"SystemTap Beginners Guide" document, available from docs.redhat.com, for
information on installing the required -debuginfo packages.

3) Run the "stap -g [filename-from-step-1].stp" command as root.

If the host is rebooted, the changes will be lost and the script must be
run again.
Comment 19 Murray McAllister 2012-01-20 09:44:28 EST
Knowledgebase article for this issue: https://access.redhat.com/kb/docs/DOC-69129
Comment 20 Eugene Teo (Security Response) 2012-01-22 20:07:26 EST
Linux Local Privilege Escalation via SUID /proc/pid/mem Write
http://blog.zx2c4.com/749
Comment 21 Eugene Teo (Security Response) 2012-01-23 09:44:00 EST
This was shared on oss-security list on Jan 18, http://seclists.org/oss-sec/2012/q1/178. All Linux distro representatives are (expected to be) subscribed to this list.
Comment 22 Eugene Teo (Security Response) 2012-01-23 09:45:45 EST
Kees wrote a blog post about this, http://www.outflux.net/blog/archives/2012/01/22/fixing-vulnerabilities-with-systemtap/.
Comment 24 Eugene Teo (Security Response) 2012-01-23 09:51:03 EST
Spender modified the reproducer to make it work on PaX, http://grsecurity.net/~spender/correct_proc_mem_reproducer.c
Comment 27 errata-xmlrpc 2012-01-23 15:20:38 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0052 https://rhn.redhat.com/errata/RHSA-2012-0052.html
Comment 32 Petr Matousek 2012-01-24 04:30:49 EST
Original report and exploit from Jüri Aedla:

http://kodu.ut.ee/~asd/exp-0-aedla/report.html
http://kodu.ut.ee/~asd/exp-0-aedla/exp-0-aedla.c
Comment 35 errata-xmlrpc 2012-01-24 16:37:25 EST
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2012:0061 https://rhn.redhat.com/errata/RHSA-2012-0061.html
Comment 40 Eugene Teo (Security Response) 2012-01-25 20:58:57 EST
LWN: A /proc/PID/mem vulnerability
https://lwn.net/Articles/476947/