Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 59905 - sys-kernel/*: Potential security issue in /proc/cmdline
Summary: sys-kernel/*: Potential security issue in /proc/cmdline
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
Whiteboard: A4 [kernel]
: 74463 (view as bug list)
Depends on:
Reported: 2004-08-09 15:14 UTC by Marc Ballarin
Modified: 2011-10-30 22:42 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---
plasmaroo: Assigned_To? (plasmaroo)

2.6 patch devised by Roger Luethi (already included in -mm kernels) (proc-race.patch,281 bytes, patch)
2004-08-09 15:16 UTC, Marc Ballarin
no flags Details | Diff
2.4 Patch (cmdlineLeak-2.4.patch,388 bytes, patch)
2004-08-09 15:32 UTC, Tim Yamin (RETIRED)
no flags Details | Diff
2.6: Full patch from the -mm tree (proc_pid_cmdline-race-fix.patch,693 bytes, patch)
2004-08-09 15:40 UTC, Greg Kroah-Hartman (RETIRED)
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Ballarin 2004-08-09 15:14:48 UTC
There is another race condition in the proc filesystem.
When reading /proc/<pid>/cmdline of a process that is just being created, it is possible to get the contents of /proc/<pid>/environ, too.
Since environ has stricter permissions than cmdline this is by definition a privilege escalation.
Fortunately, it is not very critical, since environ mostly doesn't contain sensitive data and the race is very hard to trigger, even if you own the process. (Actually I don't know how this can really be used on foreign processes.)

However, this issue might also cause unreproducable and undebuggable bugs in shell scripts that parse the output of "ps x". This is much more likely than a malicious exploit, and has probably been observed by at least one user while installing HelixPlayer.

Probably all kernels 2.6 and 2.4 are affected (I only checked 2.6.7 & 2.6.5).

Reproducible: Always
Steps to Reproduce:
1. Run a script like the following:
while [ 1 ];do
        ps ax | grep huioip >> TEST
2. While the script is running, do "watch -n 30 grep -c \= TEST"
3. Let the script run until grep finds a matching line. This may easily need more than 10,000 iterations.

Actual Results:  
If you check the file TEST, you will see at least one line in which the 
expected output is followed by environment variables. The amount of leaked 
data may vary.
Comment 1 Marc Ballarin 2004-08-09 15:16:27 UTC
Created attachment 37124 [details, diff]
2.6 patch devised by Roger Luethi (already included in -mm kernels)
Comment 2 Tim Yamin (RETIRED) gentoo-dev 2004-08-09 15:32:27 UTC
Created attachment 37125 [details, diff]
2.4 Patch
Comment 3 Greg Kroah-Hartman (RETIRED) gentoo-dev 2004-08-09 15:40:19 UTC
Created attachment 37126 [details, diff]
2.6: Full patch from the -mm tree
Comment 4 Greg Kroah-Hartman (RETIRED) gentoo-dev 2004-08-09 16:10:57 UTC
gentoo-dev-sources-2.6.7-r13 has this fix in it.
Comment 5 Guy Martin (RETIRED) gentoo-dev 2004-08-09 16:34:29 UTC
I just applied it on hppa. (yay I'm the fastest one this time :)
Comment 6 Andrea Luzzardi 2004-08-09 17:13:18 UTC
Fixed on hardened-sources-2.4.26-r6 (x86)
Fixed on hardened-sources-2.4.27-r1 (~x86)
Comment 7 solar (RETIRED) gentoo-dev 2004-08-09 19:33:55 UTC
grsec-sources- patched and tested on behalf of the 2.4.x users. All works as expected.
Comment 8 Tim Yamin (RETIRED) gentoo-dev 2004-08-09 19:56:17 UTC
All done, the following are left to their relevant maintainers:

hardened-dev-sources: Adding hardened herd.
mips-sources: Adding Kumba to the CC list.
openmosix-sources: Adding cluster herd.
{pegasos(-dev), ppc}-sources: Adding dholm.
rsbac-(dev-)sources: Adding kang.
selinux-sources: Adding pebenito.
sparc-sources: Adding Joker and the Gentoo/SPARC team.
Comment 9 Brandon Hale (RETIRED) gentoo-dev 2004-08-09 20:23:00 UTC
hardened-dev-sources patched, removing hardened herd
Comment 10 Konstantin Arkhipov (RETIRED) gentoo-dev 2004-08-10 00:11:18 UTC
done for openmosix-sources
Comment 11 Guillaume Destuynder (RETIRED) gentoo-dev 2004-08-10 03:02:30 UTC
all done for rsbac-(dev-)sources
Comment 12 Joshua Kinard gentoo-dev 2004-08-11 02:49:08 UTC
mips-sources all patched up.
Comment 13 David Holm (RETIRED) gentoo-dev 2004-08-13 03:17:15 UTC
after struggling with some odd patch errors for a couple of days pegasos-dev-sources is finally done.. {pegasos,ppc}-sources are no longer available
Comment 14 Chris PeBenito (RETIRED) gentoo-dev 2004-08-13 20:12:08 UTC
selinux-src fixed
Comment 15 Christian Birchinger (RETIRED) gentoo-dev 2004-08-13 20:38:09 UTC
sparc-sources 2.4.27-r1 are fixed.
Comment 16 Tim Yamin (RETIRED) gentoo-dev 2004-08-26 04:50:09 UTC
GLSA 200408-24.
Comment 17 Daniel Drake (RETIRED) gentoo-dev 2004-10-11 16:05:03 UTC
FYI this patch is present in 2.6.9-rc4
Comment 18 Tim Yamin (RETIRED) gentoo-dev 2004-12-18 17:26:50 UTC
*** Bug 74463 has been marked as a duplicate of this bug. ***