Bug 729808 - (CVE-2011-2905) CVE-2011-2905 kernel: perf tools: may parse user-controlled configuration file
CVE-2011-2905 kernel: perf tools: may parse user-controlled configuration file
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 729809 730203 730204 730205 761360
Blocks: 729837
  Show dependency treegraph
Reported: 2011-08-10 17:43 EDT by Vincent Danen
Modified: 2015-08-19 05:12 EDT (History)
17 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-05-04 02:53:18 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2011-08-10 17:43:21 EDT
It was reported [1] that perf would look for configuration files in /etc/perfconfig, ~/.perfconfig, and ./config.  If ./config is not a perf configuration file, perf could fail or possibly do unexpected things.  If a privileged user was tricked into running perf in a directory containing a malicious ./config file, it could possibly lead to the execution of arbitrary commands.

A patch is available [2].

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632923
[2] http://marc.info/?l=linux-kernel&m=131256355026183
Comment 1 Vincent Danen 2011-08-10 17:47:38 EDT
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 729809]
Comment 5 Eugene Teo (Security Response) 2011-08-12 03:05:06 EDT

This issue did not affect Red Hat Enterprise Linux 4 and 5 as they did not include support for perf. This did not affect Red Hat Enterprise MRG as it uses the perf package from Red Hat Enterprise Linux 6. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-1465.html.
Comment 6 Eugene Teo (Security Response) 2011-10-02 23:01:52 EDT
Upstream commit: http://git.kernel.org/linus/aba8d056078e47350d85b06a9cabd5afcc4b72ea
Comment 7 errata-xmlrpc 2011-11-22 11:49:57 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1465 https://rhn.redhat.com/errata/RHSA-2011-1465.html

Note You need to log in before you can comment on or make changes to this bug.