oss-security - Re: CVE request: kernel: 'kill sig -1' must only apply to caller's PID namespace

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <49E844A1.5020208@redhat.com>
Date: Fri, 17 Apr 2009 16:58:09 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: 'kill sig -1' must only apply
 to caller's PID namespace

Eugene Teo wrote:
> I came across this while reviewing some older upstream patches.
> 
> Apparently, it was possible to run kill <sig> -1 to kill processes in
> all PID namespaces, and break the isolation of namespaces. The expected
> behaviour for this is to only kill processes in its own hierarchy. The
> fix uses task_pid_vnr() to check if the process is outside of the
> caller's namespace before killing.

I am still able to reproduce the problem even after applying this
upstream patch (commit d25141a8). I'm still figuring out what other
patches are needed. If you know which ones, do let us know.

The expected behaviour for this is:
# ps -e
  PID TTY          TIME CMD
    1 pts/0    00:00:00 bash <-- this namespace's "init"
   10 pts/0    00:00:00 ps
# /bin/kill -s SIGKILL -1
kill -1: No such process

Take note that you need to be privileged in order to create a new PID
namespace, but to be able to kill other invisible processes outside of
the namespace is a bypass of the intended namespaces isolation.

Thanks, Eugene
-- 
Eugene Teo / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.