oss-security - Re: CVE request: pid namespace leak in kernel 3.0 and 3.1

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGyNYUMEA8W8PaP=h6Rj+f_puz7OqVzFYtqru1UaR1e7qp2x5Q@mail.gmail.com>
Date: Fri, 20 Apr 2012 08:59:03 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: Marcus Meissner <meissner@...e.de>
Cc: OSS Security List <oss-security@...ts.openwall.com>, security@...nel.org, 
	Sukadev Bhattiprolu <sukadev@...ibm.com>, Serge Hallyn <serge.hallyn@...onical.com>, 
	"Eric W. Biederman" <ebiederm@...ssion.com>, Pavel Emelyanov <xemul@...nvz.org>
Subject: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1

On Fri, Apr 20, 2012 at 5:48 AM, Marcus Meissner <meissner@...e.de> wrote:
> we had a user, Vadim Ponomarev (ccrssaa at karelia.ru),  report a pid
> namespace leak caused by vsftpd.
>
> https://bugzilla.novell.com/show_bug.cgi?id=757783
>
> He provided a simple reproducer:
[...]
>
> and checking "cat /proc/slabinfo|grep pid_namespace"
> gives 10000 more active slots after running it on 3.0.13 (+SUSE patches) and 3.1.10 (+SUSE patches).
>
> Running this on 3.2.0 (+SUSE Patches) did not result in more slots, so it was probably
> fixed between 3.1 and 3.2 (but someone else cross check perhaps).
>
> Any idea welcome on which patch fixed this, I tried 1b26c9b334044cff6d1d2698f2be41bc7d9a0864
> but it seems not helping.

I tested this with 3.0.25-rt44.57.el6rt.x86_64 yesterday, and I was
able to trigger the issue. The process needs to be privileged with
CAP_SYS_ADMIN.

Eric, besides struct pid_namespace, there is a corresponding struct pid_2 leak.

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.