Linux Kernel up to 4.7.x setuid Program perf_event_open race condition

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 4.7.x. This impacts the function perf_event_open of the component setuid Program. The manipulation leads to race condition. This vulnerability is uniquely identified as CVE-2019-3901. Local access is required to approach this attack. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 4.7.x (Operating System). This issue affects the function perf_event_open of the component setuid Program. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality. The summary by CVE is:

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.

The bug was discovered 04/22/2019. The weakness was disclosed 04/22/2019 as confirmed bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2019-3901 since 01/03/2019. Attacking locally is a requirement. The successful exploitation needs a simple authentication. Technical details of the vulnerability are known, but there is no available exploit.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 176950 (Debian Security Update for linux (DLA 1799-2)).

Upgrading to version 4.8.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 89937†). The entries VDB-122735 and VDB-134209 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion