Bug 59905 – sys-kernel/*: Potential security issue in /proc/cmdline

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Marc Ballarin 2004-08-09 15:14:48 UTC]

There is another race condition in the proc filesystem.
When reading /proc/<pid>/cmdline of a process that is just being created, it is possible to get the contents of /proc/<pid>/environ, too.
Since environ has stricter permissions than cmdline this is by definition a privilege escalation.
Fortunately, it is not very critical, since environ mostly doesn't contain sensitive data and the race is very hard to trigger, even if you own the process. (Actually I don't know how this can really be used on foreign processes.)

However, this issue might also cause unreproducable and undebuggable bugs in shell scripts that parse the output of "ps x". This is much more likely than a malicious exploit, and has probably been observed by at least one user while installing HelixPlayer.

Probably all kernels 2.6 and 2.4 are affected (I only checked 2.6.7 & 2.6.5).

Reproducible: Always
Steps to Reproduce:
1. Run a script like the following:
while [ 1 ];do
        ps ax | grep huioip >> TEST
done
2. While the script is running, do "watch -n 30 grep -c \= TEST"
3. Let the script run until grep finds a matching line. This may easily need more than 10,000 iterations.

Actual Results:  
If you check the file TEST, you will see at least one line in which the 
expected output is followed by environment variables. The amount of leaked 
data may vary.

[Comment 1 Marc Ballarin 2004-08-09 15:16:27 UTC]

Created attachment 37124 [details, diff]
2.6 patch devised by Roger Luethi (already included in -mm kernels)

[Comment 2 Tim Yamin (RETIRED) 2004-08-09 15:32:27 UTC]

Created attachment 37125 [details, diff]
2.4 Patch

[Comment 3 Greg Kroah-Hartman (RETIRED) 2004-08-09 15:40:19 UTC]

Created attachment 37126 [details, diff]
2.6: Full patch from the -mm tree

[Comment 4 Greg Kroah-Hartman (RETIRED) 2004-08-09 16:10:57 UTC]

gentoo-dev-sources-2.6.7-r13 has this fix in it.

[Comment 5 Guy Martin (RETIRED) 2004-08-09 16:34:29 UTC]

I just applied it on hppa. (yay I'm the fastest one this time :)

[Comment 6 Andrea Luzzardi 2004-08-09 17:13:18 UTC]

Fixed on hardened-sources-2.4.26-r6 (x86)
Fixed on hardened-sources-2.4.27-r1 (~x86)

[Comment 7 solar (RETIRED) 2004-08-09 19:33:55 UTC]

grsec-sources-2.4.27.2.0.1-r1.ebuild patched and tested on behalf of the 2.4.x users. All works as expected.

[Comment 8 Tim Yamin (RETIRED) 2004-08-09 19:56:17 UTC]

All done, the following are left to their relevant maintainers:

hardened-dev-sources: Adding hardened herd.
mips-sources: Adding Kumba to the CC list.
openmosix-sources: Adding cluster herd.
{pegasos(-dev), ppc}-sources: Adding dholm.
rsbac-(dev-)sources: Adding kang.
selinux-sources: Adding pebenito.
sparc-sources: Adding Joker and the Gentoo/SPARC team.

[Comment 9 Brandon Hale (RETIRED) 2004-08-09 20:23:00 UTC]

hardened-dev-sources patched, removing hardened herd

[Comment 10 Konstantin Arkhipov (RETIRED) 2004-08-10 00:11:18 UTC]

done for openmosix-sources

[Comment 11 Guillaume Destuynder (RETIRED) 2004-08-10 03:02:30 UTC]

all done for rsbac-(dev-)sources

[Comment 12 Joshua Kinard 2004-08-11 02:49:08 UTC]

mips-sources all patched up.

[Comment 13 David Holm (RETIRED) 2004-08-13 03:17:15 UTC]

after struggling with some odd patch errors for a couple of days pegasos-dev-sources is finally done.. {pegasos,ppc}-sources are no longer available

[Comment 14 Chris PeBenito (RETIRED) 2004-08-13 20:12:08 UTC]

selinux-src fixed

[Comment 15 Christian Birchinger (RETIRED) 2004-08-13 20:38:09 UTC]

sparc-sources 2.4.27-r1 are fixed.

[Comment 16 Tim Yamin (RETIRED) 2004-08-26 04:50:09 UTC]

GLSA 200408-24.

[Comment 17 Daniel Drake (RETIRED) 2004-10-11 16:05:03 UTC]

FYI this patch is present in 2.6.9-rc4

[Comment 18 Tim Yamin (RETIRED) 2004-12-18 17:26:50 UTC]

*** Bug 74463 has been marked as a duplicate of this bug. ***