Re: Ptrace hole / Linux 2.2.25

mlafon
2003-03-19T11:17:59Z

[-- Attachment #1: Type: text/plain, Size: 602 bytes --]

Alan Cox wrote:
> Vulnerability: CAN-2003-0127

> The Linux 2.2 and Linux 2.4 kernels have a flaw in ptrace. This hole allows
> local users to obtain full privileges. Remote exploitation of this hole is
> not possible. Linux 2.5 is not believed to be vulnerable.

The patch breaks /proc/<pid>/cmdline and /proc/<pid>/environ for 'non dumpable'
processes, even for root.

We need to access theses proc files for processes monitoring.

Included is a patch to restore this functionnality for root.

Any comments ?
(See attached file: cmdline_environ_fix.diff)
--
Mathieu Lafon - Arkoon Network Security

[-- Attachment #2: cmdline_environ_fix.diff --]
[-- Type: application/octet-stream, Size: 398 bytes --]

diff -u -r1.3.24.1 ptrace.c
--- linux-2.4/kernel/ptrace.c 2003/03/19 10:50:57 1.3.24.1
+++ linux-2.4/kernel/ptrace.c 2003/03/19 10:54:45
@@ -140,7 +140,7 @@
/* Worry about races with exit() */
task_lock(tsk);
mm = tsk->mm;
- if (!is_dumpable(tsk) || (&init_mm == mm))
+ if ((!is_dumpable(tsk) || (&init_mm == mm)) && (current->uid != 0))
mm = NULL;
if (mm)
atomic_inc(&mm->mm_users);