Messages in this thread | | | Date | Mon, 3 Oct 2011 15:31:58 +0300 | From | Adrian Bunk <> | Subject | Re: taskstats root only breaking iotop |
| |
On Sun, Oct 02, 2011 at 02:54:57PM +0400, Vasiliy Kulikov wrote: > (cc'ed kernel-hardening) > > On Sun, Oct 02, 2011 at 12:22 +0200, Guillaume Chazarain wrote: > > On Sun, Oct 2, 2011 at 2:20 AM, Linus Torvalds > > <torvalds@linux-foundation.org> wrote: > > > So I don't see why you ask for it. What could possibly be a valid use-case? > > > > Right, kbyte granularity is enough. > > It is not enough. In some border cases an attacker may still learn > private information given the counters with _arbitrary_ granularity: > > http://www.openwall.com/lists/oss-security/2011/06/29/9
If you request a CVE for that, shouldn't there also be a CVE for /proc/<pid>/cmdline being readable by all users?
I'd expect "ps -ef" to be more likely to give private information to an attacker than counters with kbyte granularity, or am I wrong on that?
>... > Thanks,
cu Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out of the darkness. There had been need of rain for many days. "Only a promise," Lao Er said. Pearl S. Buck - Dragon Seed
| |