There's a race in the kernel, and considering the permissions on /proc/PID/{cmdline,environ} a security bug as well: If you win the race with a starting process, you can read its environment. http://lkml.org/lkml/2004/7/29/332
Might be 2.6 only fixed in 2.6.9 http://linux.bkbits.net:8080/linux-2.6/cset@412a4baaEebwtKg-X7sS2r5Mua6uGw
It's a very small window of opportunity where the arg_start can be initialized but the arg_end still not be, so it's hard to make this happen easily. But if I manually modify arg_end to be zero in an existing task's mm_struct, I can reproduce the problem. Here I'm in a crash session, where I've got a "doit" process just sleeping. Escaping to a shell, and doing a "ps -ax" shows it as pid 557: crash> !ps -ax | grep doit 557 pts/10 S 0:00 ./doit 577 pts/10 S 0:00 sh -c ps -ax | grep doit 579 pts/10 S 0:00 grep doit crash> If I then determine where pid 557's mm_struct's arg_end is located, (in this example I've determined it to be at address df66dce4), and them write a 0 there, a subsequent ps shows this: crash> wr df66dce4 0 crash> !ps -ax | grep doit 557 pts/10 S 0:00 ./doit HOSTNAME=crash.boston.redhat.com PVM_RSH=/usr/bin/rsh HOST=crash TERM=xterm SHELL=/bin/bas 599 pts/10 S 0:00 sh -c ps -ax | grep doit 601 pts/10 S 0:00 grep doit crash> I'll apply an applicable 2.4 patch and verify that it handles it properly.
A fix for this problem has just been committed to the RHEL3 U5 patch pool this evening (in kernel version 2.4.21-27.3.EL).
A fix for this problem has also been committed to the RHEL3 E5 patch pool this evening (in kernel version 2.4.21-27.0.3.EL).
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-293.html
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-294.html