diff options
| author | Ben Hutchings <ben@decadent.org.uk> | 2019-05-12 13:31:03 +0100 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-05-12 13:34:21 +0100 |
| commit | 6ca4706b66ac993585d9ed8d82e4037547476dca (patch) | |
| tree | 99527014466a8915b825dc13da2dce941597272c /retired/CVE-2017-5967 | |
| parent | a1dcc55d94aa8c6e2be797f32bb9ff7839315c31 (diff) | |
Retire inactive issues
Diffstat (limited to 'retired/CVE-2017-5967')
| -rw-r--r-- | retired/CVE-2017-5967 | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/retired/CVE-2017-5967 b/retired/CVE-2017-5967 new file mode 100644 index 00000000..88f17a22 --- /dev/null +++ b/retired/CVE-2017-5967 @@ -0,0 +1,22 @@ +Description: The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the __timer_stats_timer_set_start_info function in kernel/time/timer.c. +References: + https://bugzilla.kernel.org/show_bug.cgi?id=193921 +Notes: + bwh> The upstream "fix" for this is to remove the feature, as it is + bwh> redundant with tracing. I don't think that change is + bwh> acceptable for stable branches, other than possibly 4.9. We + bwh> could instead prevent processes outside the initial pid + bwh> namespace from opening the file. + bwh> Although MITRE's description only refers to /proc/timer_list, + bwh> /proc/timer_stats also exposes pids if CONFIG_TIMER_STATS is + bwh> enabled. +Bugs: +upstream: released (4.11-rc1) [dfb4357da6ddbdf57d583ba64361c9d792b0e0b1] +4.19-upstream-stable: N/A "Fixed before branch point" +4.9-upstream-stable: released (4.9.175) [c9257238740ee492574cf686313037be7470e7ec] +3.16-upstream-stable: released (3.16.67) [07efa228ff7bfadaf50f0daa63a228d055f232ce] +3.2-upstream-stable: ignored "EOL" +sid: released (4.9.13-1) [debian/time-mark-timer_stats-as-broken.patch] +4.9-stretch-security: N/A "Fixed before release" +3.16-jessie-security: released (3.16.64-1) [bugfix/all/timer-debug-change-proc-timer_stats-from-0644-to-0600.patch] +3.2-wheezy-security: ignored "EOL" |