+++ This bug was initially created as a clone of Bug #499541 +++ Description of problem: By using the same test as is used for /proc/pid/maps and /proc/pid/smaps, only allow processes that can ptrace() a given process to see information that might be used to bypass address space layout randomization (ASLR). These include eip, esp, wchan, and start_stack in /proc/pid/stat as well as the non-symbolic output from /proc/pid/wchan. ASLR can be bypassed by sampling eip as shown by the proof-of-concept code at http://code.google.com/p/fuzzyaslr/ As part of a presentation (http://www.cr0.org/paper/to-jt-linux-alsr-leak.pdf) esp and wchan were also noted as possibly usable information leaks as well. The start_stack address also leaks potentially useful information. Upstream commit: http://git.kernel.org/linus/f83ce3e6b02d5e48b3a43b001390e2b58820389d --- Additional comment from eteo on 2009-05-07 02:09:48 EDT --- Created an attachment (id=342773) Upstream patch
Wang Cong, remember to change the status after posting the patch to rhkl. Thanks.
Committed in 89.2.EL
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2011-0263.html