Bug 716825 - (CVE-2011-2495) CVE-2011-2495 kernel: /proc/PID/io infoleak
CVE-2011-2495 kernel: /proc/PID/io infoleak
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
public=20110621,reported=20110621,sou...
: Security
Depends On: 716827 716828 716829 716830 716831 723095 748666 753003
Blocks: 716823
  Show dependency treegraph
 
Reported: 2011-06-27 04:26 EDT by Eugene Teo (Security Response)
Modified: 2015-07-31 02:41 EDT (History)
17 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-05-04 03:06:24 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Eugene Teo (Security Response) 2011-06-27 04:26:44 EDT
/proc/PID/io may be used for gathering private information.  E.g. for openssh and vsftpd daemons wchars/rchars may be used to learn the precise password length.

[0/2] restrict statistics information to user
https://lkml.org/lkml/2011/6/24/88
[1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495)
https://patchwork.kernel.org/patch/916032/
[2/2] taskstats: restrict access to user (CVE-2011-2494)
https://patchwork.kernel.org/patch/916042/

taskstats authorized_keys presence infoleak PoC
http://seclists.org/oss-sec/2011/q2/659

Acknowledgements:

Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Comment 3 Eugene Teo (Security Response) 2011-06-27 04:40:20 EDT
http://article.gmane.org/gmane.comp.security.oss.general/5337
Linus suggested returning accounting information at a 1k granularity instead.
Comment 4 Eugene Teo (Security Response) 2011-06-27 05:22:18 EDT
Statement:

This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1212.html, https://rhn.redhat.com/errata/RHSA-2011-1189.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.
Comment 5 Eugene Teo (Security Response) 2011-06-29 02:09:59 EDT
(In reply to comment #0)
[...]
> [1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495)
> https://patchwork.kernel.org/patch/916032/

Upstream commits:
http://git.kernel.org/linus/1d1221f375c94ef961ba8574ac4f85c8870ddd51
http://git.kernel.org/linus/293eb1e7772b25a93647c798c7b89bf26c2da2e0
Comment 8 errata-xmlrpc 2011-08-23 10:42:51 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1189 https://rhn.redhat.com/errata/RHSA-2011-1189.html
Comment 9 errata-xmlrpc 2011-09-12 15:46:17 EDT
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2011:1253 https://rhn.redhat.com/errata/RHSA-2011-1253.html
Comment 10 errata-xmlrpc 2011-09-13 11:44:23 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1212 https://rhn.redhat.com/errata/RHSA-2011-1212.html
Comment 11 Eugene Teo (Security Response) 2011-10-24 23:27:07 EDT
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 748666]
Comment 13 errata-xmlrpc 2011-12-13 16:29:09 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5.6.Z - Server Only

Via RHSA-2011:1813 https://rhn.redhat.com/errata/RHSA-2011-1813.html

Note You need to log in before you can comment on or make changes to this bug.