/proc/PID/io may be used for gathering private information. E.g. for openssh and vsftpd daemons wchars/rchars may be used to learn the precise password length. [0/2] restrict statistics information to user https://lkml.org/lkml/2011/6/24/88 [1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495) https://patchwork.kernel.org/patch/916032/ [2/2] taskstats: restrict access to user (CVE-2011-2494) https://patchwork.kernel.org/patch/916042/ taskstats authorized_keys presence infoleak PoC http://seclists.org/oss-sec/2011/q2/659 Acknowledgements: Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
http://article.gmane.org/gmane.comp.security.oss.general/5337 Linus suggested returning accounting information at a 1k granularity instead.
Statement: This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1212.html, https://rhn.redhat.com/errata/RHSA-2011-1189.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.
(In reply to comment #0) [...] > [1/2] proc: restrict access to /proc/PID/io (CVE-2011-2495) > https://patchwork.kernel.org/patch/916032/ Upstream commits: http://git.kernel.org/linus/1d1221f375c94ef961ba8574ac4f85c8870ddd51 http://git.kernel.org/linus/293eb1e7772b25a93647c798c7b89bf26c2da2e0
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:1189 https://rhn.redhat.com/errata/RHSA-2011-1189.html
This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2011:1253 https://rhn.redhat.com/errata/RHSA-2011-1253.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:1212 https://rhn.redhat.com/errata/RHSA-2011-1212.html
Created kernel tracking bugs for this issue Affects: fedora-all [bug 748666]
This issue has been addressed in following products: Red Hat Enterprise Linux 5.6.Z - Server Only Via RHSA-2011:1813 https://rhn.redhat.com/errata/RHSA-2011-1813.html