CVE-2019-11190: Race Condition

A flaw in the loadelfbinary() function in the Linux kernel allows a local attacker to leak the base address of .text and stack sections for setuid binaries and thus to bypass ASLR because installexeccreds() is called too late in this function.

References:

https://seclists.org/oss-sec/2019/q2/9

https://www.openwall.com/lists/oss-security/2019/04/03/4

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9f834ec18defc369d73ccf9e87a2790bfa05bf46

— Red Hat

Linux Kernel could allow a local attacker to bypass security restrictions, caused by a race condition when reading /proc/pid/stat. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass ASLR on setuid programs.

— IBM

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because installexeccreds() is called too late in loadelfbinary() in fs/binfmtelf.c, and thus the ptracemayaccess() check has a race condition when reading /proc/pid/stat.