Linux Kernel 'ptrace_attach()' Local Privilege Escalation Vulnerability

Bugtraq ID:	34799
Class:	Race Condition Error
CVE:	CVE-2009-1527
Remote:	No
Local:	Yes
Published:	May 04 2009 12:00AM
Updated:	May 27 2009 11:10PM
Credit:	Eugene Teo
Vulnerable:	rPath rPath Linux 2 rPath Appliance Platform Linux Service 2 rPath Appliance Platform Linux Service 1 Linux kernel 2.6.29
Not Vulnerable:

Linux Kernel 'ptrace_attach()' Local Privilege Escalation Vulnerability

The Linux kernel is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to execute arbitrary code with superuser privileges, resulting in a complete compromise of the affected computer.

This issue affects Linux kernel 2.6.29; other versions may also be affected.

Linux Kernel 'ptrace_attach()' Local Privilege Escalation Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/34799.c
• /data/vulnerabilities/exploits/shoryuken.c

Linux Kernel 'ptrace_attach()' Local Privilege Escalation Vulnerability

Solution:
A fix is available in the GIT repository. Please see the references for more information.

Linux Kernel 'ptrace_attach()' Local Privilege Escalation Vulnerability

References:

• CRED: Inaugurate COW credentials (Linux)
  
• CVE request: kernel: ptrace_attach: fix the usage of ->cred_exec_mutex (Linux)
  
• Linux kernel Homepage (kernel.org)
  
• Linux kernel PTrace Race Condition (xorl)
  
• ptrace: ptrace_attach: fix the usage of ->cred_exec_mutex (Linux)