lkml.org 
[lkml]   [2011]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: taskstats root only breaking iotop
On Sun, Oct 02, 2011 at 02:54:57PM +0400, Vasiliy Kulikov wrote:
> (cc'ed kernel-hardening)
>
> On Sun, Oct 02, 2011 at 12:22 +0200, Guillaume Chazarain wrote:
> > On Sun, Oct 2, 2011 at 2:20 AM, Linus Torvalds
> > <torvalds@linux-foundation.org> wrote:
> > > So I don't see why you ask for it. What could possibly be a valid use-case?
> >
> > Right, kbyte granularity is enough.
>
> It is not enough. In some border cases an attacker may still learn
> private information given the counters with _arbitrary_ granularity:
>
> http://www.openwall.com/lists/oss-security/2011/06/29/9

If you request a CVE for that, shouldn't there also be a CVE for
/proc/<pid>/cmdline being readable by all users?

I'd expect "ps -ef" to be more likely to give private information to an
attacker than counters with kbyte granularity, or am I wrong on that?

>...
> Thanks,

cu
Adrian

--

"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed



\
 
 \ /
  Last update: 2011-10-03 14:35    [W:0.375 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site