oss-sec mailing list archives
CVE-2020-10732 kernel: uninitialized kernel data leak in userspace coredumps
From: Wade Mealing <wmealing () redhat com>
Date: Wed, 6 May 2020 15:12:12 +1000
Gday, A potential info leak of kernel private memory to userspace was found in the kernel's implementation of core dumping userspace processes. An area of memory was allocated from free memory without being correctly initialized, this memory contents could contain kernel private information from previous executions and leak it to kernel space for any (probably local) user that is able to read the core dump. This seems like it would allow leaking of possible registers that are not stored/initialized in the core dump itself. The amount leaked will depend on the register state at the time of the crash, it could also leak nothing. This was introduced in 4206d3aa1978e44f58bfa4e1c9d8d35cbf19c187 Possible mitigation would be to disable core dumps system-wide by setting: * hard core 0 In the /etc/security/limits.conf file and restarting applications/services/processes which users may have access to or simply reboot the system. This disables core dumps which may not be a suitable workaround in your environment. Relevant links: ------------------- Not upstream but a patch: https://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a Where I found out about it: https://twitter.com/grsecurity/status/1252558055629299712 Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1831399 Thank you. Wade Mealing Product Security - Kernel Red Hat wmealing () redhat com
Current thread:
- CVE-2020-10732 kernel: uninitialized kernel data leak in userspace coredumps Wade Mealing (May 05)