Vigil@nce - Linux kernel: memory disclosure via coredump
October 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
A local attacker can read the coredump a privileged processes, in
order to obtain sensitive information.
Impacted products: Linux.
Severity: 1/4.
Creation date: 30/09/2015.
DESCRIPTION OF THE VULNERABILITY
When an error occurs on a process with RLIMIT_CORE different from
zero, a coredump occurs, containing an image of its memory.
However, the do_coredump() function of the fs/coredump.c file
accepts to store the dump in a pre-existing file (its path can be
changed via a link). So, if the attacker has a read access to this
file, he can then read the content of this process memory.
A local attacker can therefore read the coredump a privileged
processes, in order to obtain sensitive information.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Linux-kernel-memory-disclosure-via-coredump-17998