// For flags

CVE-2019-3901

kernel: perf_event_open() and execve() race in setuid programs allows a data leak

Severity Score

4.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.

Una condición de carrera en la función perf_event_open() permite a los atacantes locales filtrar datos confidenciales desde los programas setuid. Como no se mantienen bloqueos relevantes (en particular, la función cred_guard_mutex) durante la llamada ptrace_may_access(), es posible que la tarea de destino especificada realice un syscall execve() con la ejecución setuid anterior a que perf_event_alloc() realmente se conecte, permitiendo que un atacante omita la comprobación ptrace_may_access() y la llamada perf_event_exit_task(current) que se realiza en install_exec_creds() durante las llamadas privilegiadas execve(). Este problema afecta a las versiones del kernel versión anterior a 4.8.

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-01-03 CVE Reserved
  • 2019-04-22 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-667: Improper Locking
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Netapp
Search vendor "Netapp"
Cn1610 Firmware
Search vendor "Netapp" for product "Cn1610 Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
Cn1610
Search vendor "Netapp" for product "Cn1610"
--
Safe
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 4.8
Search vendor "Linux" for product "Linux Kernel" and version " < 4.8"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
Netapp
Search vendor "Netapp"
Active Iq Unified Manager For Vmware Vsphere
Search vendor "Netapp" for product "Active Iq Unified Manager For Vmware Vsphere"
>= 9.5
Search vendor "Netapp" for product "Active Iq Unified Manager For Vmware Vsphere" and version " >= 9.5"
-
Affected
Netapp
Search vendor "Netapp"
Hci Management Node
Search vendor "Netapp" for product "Hci Management Node"
--
Affected
Netapp
Search vendor "Netapp"
Snapprotect
Search vendor "Netapp" for product "Snapprotect"
--
Affected
Netapp
Search vendor "Netapp"
Solidfire
Search vendor "Netapp" for product "Solidfire"
--
Affected
Netapp
Search vendor "Netapp"
Storage Replication Adapter For Clustered Data Ontap For Vmware Vsphere
Search vendor "Netapp" for product "Storage Replication Adapter For Clustered Data Ontap For Vmware Vsphere"
>= 7.2
Search vendor "Netapp" for product "Storage Replication Adapter For Clustered Data Ontap For Vmware Vsphere" and version " >= 7.2"
-
Affected
Netapp
Search vendor "Netapp"
Vasa Provider For Clustered Data Ontap
Search vendor "Netapp" for product "Vasa Provider For Clustered Data Ontap"
>= 7.2
Search vendor "Netapp" for product "Vasa Provider For Clustered Data Ontap" and version " >= 7.2"
-
Affected
Netapp
Search vendor "Netapp"
Virtual Storage Console For Vmware Vsphere
Search vendor "Netapp" for product "Virtual Storage Console For Vmware Vsphere"
>= 7.2
Search vendor "Netapp" for product "Virtual Storage Console For Vmware Vsphere" and version " >= 7.2"
-
Affected