Bug 782642 - (CVE-2012-0056) CVE-2012-0056 kernel: proc: /proc/<pid>/mem mem_write insufficient permission checking
CVE-2012-0056 kernel: proc: /proc/<pid>/mem mem_write insufficient permission...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20120118,repo...
: Security
Depends On: 782643 782645 782646 782647 782649 782650 782681
Blocks: 782636
  Show dependency treegraph
 
Reported: 2012-01-17 21:34 EST by Eugene Teo (Security Response)
Modified: 2015-08-02 20:03 EDT (History)
23 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
A reproducer that tests if we have commit 198214a7. (671 bytes, text/plain)
2012-01-20 02:16 EST, Eugene Teo (Security Response)
no flags Details

  None (edit)
Description Eugene Teo (Security Response) 2012-01-17 21:34:28 EST
From Linus' patch:
"Jüri Aedla reported that the /proc/<pid>/mem handling really isn't very robust, and it also doesn't match the permission checking of any of the other related files.

This changes it to do the permission checks at open time, and instead of tracking the process, it tracks the VM at the time of the open.  That simplifies the code a lot, but does mean that if you hold the file descriptor open over an execve(), you'll continue to read from the _old_ VM."

A local, unprivileged user could use this flaw to escalate their privileges.

Upstream commit:
http://git.kernel.org/linus/e268337dfe26dfc7efd422a804dbb27977a3cccc

Acknowledgements:

Red Hat would like to thank Jüri Aedla for reporting this issue.
Comment 7 Eugene Teo (Security Response) 2012-01-17 22:06:52 EST
Statement:

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as it did not backport the upstream commit 198214a7ee. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2012-0052.html and  https://rhn.redhat.com/errata/RHSA-2012-0061.html. For more information, please read https://access.redhat.com/kb/docs/DOC-69129.
Comment 11 Eugene Teo (Security Response) 2012-01-18 02:09:45 EST
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 782681]
Comment 14 Eugene Teo (Security Response) 2012-01-18 08:18:47 EST
Ensure that ASLR is enabled, see /proc/sys/kernel/randomize_va_space.
Comment 17 Eugene Teo (Security Response) 2012-01-20 02:16:14 EST
Created attachment 556461 [details]
A reproducer that tests if we have commit 198214a7.
Comment 18 Petr Matousek 2012-01-20 04:36:47 EST
To mitigate the issue:

1) On the host, save the following in a file with the ".stp" extension:

probe kernel.function("mem_write@fs/proc/base.c").call {
  $count = 0
}

2) Install the "systemtap" package and any required dependencies. Refer to
the "2. Using SystemTap" chapter in the Red Hat Enterprise Linux 6
"SystemTap Beginners Guide" document, available from docs.redhat.com, for
information on installing the required -debuginfo packages.

3) Run the "stap -g [filename-from-step-1].stp" command as root.

If the host is rebooted, the changes will be lost and the script must be
run again.
Comment 19 Murray McAllister 2012-01-20 09:44:28 EST
Knowledgebase article for this issue: https://access.redhat.com/kb/docs/DOC-69129
Comment 20 Eugene Teo (Security Response) 2012-01-22 20:07:26 EST
Linux Local Privilege Escalation via SUID /proc/pid/mem Write
http://blog.zx2c4.com/749
Comment 21 Eugene Teo (Security Response) 2012-01-23 09:44:00 EST
This was shared on oss-security list on Jan 18, http://seclists.org/oss-sec/2012/q1/178. All Linux distro representatives are (expected to be) subscribed to this list.
Comment 22 Eugene Teo (Security Response) 2012-01-23 09:45:45 EST
Kees wrote a blog post about this, http://www.outflux.net/blog/archives/2012/01/22/fixing-vulnerabilities-with-systemtap/.
Comment 24 Eugene Teo (Security Response) 2012-01-23 09:51:03 EST
Spender modified the reproducer to make it work on PaX, http://grsecurity.net/~spender/correct_proc_mem_reproducer.c
Comment 27 errata-xmlrpc 2012-01-23 15:20:38 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0052 https://rhn.redhat.com/errata/RHSA-2012-0052.html
Comment 32 Petr Matousek 2012-01-24 04:30:49 EST
Original report and exploit from Jüri Aedla:

http://kodu.ut.ee/~asd/exp-0-aedla/report.html
http://kodu.ut.ee/~asd/exp-0-aedla/exp-0-aedla.c
Comment 35 errata-xmlrpc 2012-01-24 16:37:25 EST
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2012:0061 https://rhn.redhat.com/errata/RHSA-2012-0061.html
Comment 40 Eugene Teo (Security Response) 2012-01-25 20:58:57 EST
LWN: A /proc/PID/mem vulnerability
https://lwn.net/Articles/476947/

Note You need to log in before you can comment on or make changes to this bug.