CVE-2019-3901: Race Condition
A race condition in perfeventopen() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the credguardmutex) are held during the ptracemayaccess() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perfeventalloc() actually attaches to it, allowing an attacker to bypass the ptracemayaccess() check and the perfeventexittask(current) call that is performed in installexeccreds() during privileged execve() calls.
Other sources
Linux Kernel could allow a local attacker to obtain sensitive information, caused by a race condition in the perfeventopen function. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information from setuid programs.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-3901?
CVE-2019-3901 is considered a high severity vulnerability due to its potential for local attackers to leak sensitive data from setuid programs.
How do I fix CVE-2019-3901?
To fix CVE-2019-3901, update your kernel to a version that is patched against this vulnerability, such as kernel-rt 3.10.0-1127.rt56.1093.el7 or kernel 3.10.0-1127.el7.
Which software is affected by CVE-2019-3901?
CVE-2019-3901 affects Red Hat kernels, including kernel-rt and various versions of IBM Data Risk Manager.
What type of attack does CVE-2019-3901 allow?
CVE-2019-3901 allows local attackers to leak sensitive data through a race condition when accessing setuid programs.
Is there a public exploit for CVE-2019-3901?
As of now, there are no known public exploits specifically targeting CVE-2019-3901.