[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALCETrU32d4ukoN6SNAQ1wBTd_BVFtgqUM1ZXitpFMDhuBwf2Q@mail.gmail.com>
Date: Fri, 4 Jul 2014 14:05:08 -0700
From: Andy Lutomirski <luto@...capital.net>
To: oss-security@...ts.openwall.com
Subject: CVE-2014-4699: Linux ptrace bug
Hi everyone-
Upstream commit b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a fixes a
ptrace bug. The exact scope of the bug is somewhat unclear right now.
I see no reason why the bug should not be present as far back as Linux
2.6.17, but it seems to be difficult to reproduce on old kernels.
There is some ongoing discussion on linux-distros about the impact and
applicability of this bug.
More details and a PoC to follow some time next week.
I'm being intentionally vague here: this bug has existed for a long
time, but exploiting it at all is tricky enough (and possibly
kernel-version dependent enough) that it's gone unnoticed. I would
currently prefer to give the distros and users a bit of a headstart
before publicly disclosing the complete details of how to test/exploit
the bug. It is likely to have a high enough impact, at least on new
enough kernels, that it should be patched ASAP.
--Andy
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
