[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CALJHwhRpmRTpqWe74KBk1QBQ7b8tuHXuOJAu2UHtq6foYRj7Zg@mail.gmail.com>
Date: Wed, 6 May 2020 15:12:12 +1000
From: Wade Mealing <wmealing@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2020-10732 kernel: uninitialized kernel data leak in userspace coredumps
Gday,
A potential info leak of kernel private memory to userspace was found in
the kernel's implementation of core dumping userspace processes. An area
of memory was allocated from free memory without being correctly
initialized, this memory contents could contain kernel private information
from previous executions and leak it to kernel space for any (probably
local) user that is able to read the core dump.
This seems like it would allow leaking of possible registers that are not
stored/initialized in the core dump itself. The amount leaked will depend
on the register state at the time of the crash, it could also leak nothing.
This was introduced in 4206d3aa1978e44f58bfa4e1c9d8d35cbf19c187
Possible mitigation would be to disable core dumps system-wide by setting:
* hard core 0
In the /etc/security/limits.conf file and restarting
applications/services/processes which users may have access to or simply
reboot the system. This disables core dumps which may not be a suitable
workaround in your environment.
Relevant links:
-------------------
Not upstream but a patch:
https://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a
Where I found out about it:
https://twitter.com/grsecurity/status/1252558055629299712
Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1831399
Thank you.
Wade Mealing
Product Security - Kernel
Red Hat
wmealing@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
