Bug 729808 (CVE-2011-2905) - CVE-2011-2905 kernel: perf tools: may parse user-controlled configuration file
Summary: CVE-2011-2905 kernel: perf tools: may parse user-controlled configuration file
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-2905
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 729809 730203 730204 730205 761360
Blocks: 729837
TreeView+ depends on / blocked
 
Reported: 2011-08-10 21:43 UTC by Vincent Danen
Modified: 2021-02-24 14:56 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-05-04 06:53:18 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1465 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2011-11-22 21:45:37 UTC

Description Vincent Danen 2011-08-10 21:43:21 UTC 
It was reported [1] that perf would look for configuration files in /etc/perfconfig, ~/.perfconfig, and ./config.  If ./config is not a perf configuration file, perf could fail or possibly do unexpected things.  If a privileged user was tricked into running perf in a directory containing a malicious ./config file, it could possibly lead to the execution of arbitrary commands.

A patch is available [2].

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632923
[2] http://marc.info/?l=linux-kernel&m=131256355026183
Comment 1 Vincent Danen 2011-08-10 21:47:38 UTC 
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 729809]
Comment 5 Eugene Teo (Security Response) 2011-08-12 07:05:06 UTC 
Statement:

This issue did not affect Red Hat Enterprise Linux 4 and 5 as they did not include support for perf. This did not affect Red Hat Enterprise MRG as it uses the perf package from Red Hat Enterprise Linux 6. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-1465.html.
Comment 6 Eugene Teo (Security Response) 2011-10-03 03:01:52 UTC 
Upstream commit: http://git.kernel.org/linus/aba8d056078e47350d85b06a9cabd5afcc4b72ea
Comment 7 errata-xmlrpc 2011-11-22 16:49:57 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1465 https://rhn.redhat.com/errata/RHSA-2011-1465.html
Note You need to log in before you can comment on or make changes to this bug.