Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 24 Feb 2011 15:57:06 -0800
From: Kees Cook <>
Subject: CVE request: kernel: /proc/$pid/ leaks contents across setuid exec


I'd like to get a CVE assigned for this information leak issue:

Pre-opened file descriptors in /proc/$pid/ can bypass DAC allowing
visibility into setuid process state, especially leaking ASLR offset.



Kees Cook
Ubuntu Security Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ