Bug 716825 (CVE-2011-2495) - CVE-2011-2495 kernel: /proc/PID/io infoleak
Summary: CVE-2011-2495 kernel: /proc/PID/io infoleak
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-2495
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 716827 716828 716829 716830 716831 723095 748666 753003
Blocks: 716823
TreeView+ depends on / blocked
 
Reported: 2011-06-27 08:26 UTC by Eugene Teo (Security Response)
Modified: 2023-05-11 17:53 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-05-04 07:06:24 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1189 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2011-08-23 14:41:43 UTC
Red Hat Product Errata RHSA-2011:1212 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2011-09-06 21:41:35 UTC
Red Hat Product Errata RHSA-2011:1253 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2011-09-12 19:43:48 UTC
Red Hat Product Errata RHSA-2011:1813 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2011-12-14 02:28:38 UTC

Description Eugene Teo (Security Response) 2011-06-27 08:26:44 UTC
/proc/PID/io may be used for gathering private information.  E.g. for openssh and vsftpd daemons wchars/rchars may be used to learn the precise password length.

[0/2] restrict statistics information to user
https://lkml.org/lkml/2011/6/24/88
[1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495)
https://patchwork.kernel.org/patch/916032/
[2/2] taskstats: restrict access to user (CVE-2011-2494)
https://patchwork.kernel.org/patch/916042/

taskstats authorized_keys presence infoleak PoC
http://seclists.org/oss-sec/2011/q2/659

Acknowledgements:

Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.

Comment 3 Eugene Teo (Security Response) 2011-06-27 08:40:20 UTC
http://article.gmane.org/gmane.comp.security.oss.general/5337
Linus suggested returning accounting information at a 1k granularity instead.

Comment 4 Eugene Teo (Security Response) 2011-06-27 09:22:18 UTC
Statement:

This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1212.html, https://rhn.redhat.com/errata/RHSA-2011-1189.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Comment 5 Eugene Teo (Security Response) 2011-06-29 06:09:59 UTC
(In reply to comment #0)
[...]
> [1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495)
> https://patchwork.kernel.org/patch/916032/

Upstream commits:
http://git.kernel.org/linus/1d1221f375c94ef961ba8574ac4f85c8870ddd51
http://git.kernel.org/linus/293eb1e7772b25a93647c798c7b89bf26c2da2e0

Comment 8 errata-xmlrpc 2011-08-23 14:42:51 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1189 https://rhn.redhat.com/errata/RHSA-2011-1189.html

Comment 9 errata-xmlrpc 2011-09-12 19:46:17 UTC
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2011:1253 https://rhn.redhat.com/errata/RHSA-2011-1253.html

Comment 10 errata-xmlrpc 2011-09-13 15:44:23 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1212 https://rhn.redhat.com/errata/RHSA-2011-1212.html

Comment 11 Eugene Teo (Security Response) 2011-10-25 03:27:07 UTC
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 748666]

Comment 13 errata-xmlrpc 2011-12-13 21:29:09 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5.6.Z - Server Only

Via RHSA-2011:1813 https://rhn.redhat.com/errata/RHSA-2011-1813.html


Note You need to log in before you can comment on or make changes to this bug.