[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110625174359.GA3439@albatros>
Date: Sat, 25 Jun 2011 21:44:22 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: security@...nel.org
Subject: Re: CVE request: kernel: taskstats/procfs io infoleak
On Fri, Jun 24, 2011 at 16:34 +0400, Vasiliy Kulikov wrote:
> It can be used to learn ssh and ftp password length. If privsep is
> enabled in openssh and vsftpd, the unprivileged process' activity very
> precisely shows password information.
>
> For vsftpd read characters count is strlen("USER username\r\n") +
> strlen("PASSWD pass\r\n") + 1, where 1 is one byte read from a pipe
> related to a privileged parent. If measure statistics between user and
> passwords commands, actual password length and username length can be
> gathered.
>
> For ssh, vice versa, networking activity is constant in packets length,
> but interprocess communications, specifically passwords, depend on
> user input.
>
> For ssh pass_len = wchars - CONST, for vsftpd pass_len = rchars - CONST.
>
> Another daemons with more or less constant io activity might be
> vulnerable too. PAM greatly complicates precise measurements.
Based on the code review, OpenVZ containers limit the threat of
information gathering to a single container. E.g. a process in CT 101
cannot gather any io information of a process in CT 102. Some other
restricting policies might limit the information too, e.g. grsecurity
chroot protection denies sending taskstats commands (if the socket is
already opened and TASKSTATS_CMD_ATTR_REGISTER_CPUMASK is handled before
chroot(2), it doesn't help).
BTW, I'd appreciate if somebody points me how information stored in
sched, schedstats, stat, and status files can be exploited. I suspect
it can be used similar way.
Other thoughts:
Files mountinfo, mounts store information related to the process' fs
namespace. I feel this information can be somewhat private, e.g. mount
points can reveal private file pathes in case of separate namespaces
where this information cannot be learned by reading /proc/self/mountinfo.
Files limits and status store process related restrictions. I dunno
whether this can be considered as a private information in some
situations.
Thanks,
--
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
