CVE-2013-0160

Published: 17 February 2013

The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.

From the Ubuntu Security Team

An information leak was discovered in the Linux kernel when inotify is used to monitor the /dev/ptmx device. A local user could exploit this flaw to discover keystroke timing and potentially discover sensitive information like password length.

Notes

the spender sidechannel patch above may not be generally applicable
but I include it for completeness.

commit b0de59b5733d18b0d1974a060860a8b5c1b36a2e is not sufficient to
fix the CVE because an application doesn't have to read atime/mtime
(as is the case for the PoC).  The 2 additional commits fix a
regression and mark the shared ptmx node as un-notifiable (which will
cause additional problems to backport them to Lucid, as it doesn't have
this feature)

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0160
• http://www.openwall.com/lists/oss-security/2013/01/07
• http://vladz.devzero.fr/013_ptmx-timing.php
• http://grsecurity.net/~spender/sidechannel.diff
• https://ubuntu.com/security/notices/USN-1878-1
• https://ubuntu.com/security/notices/USN-1879-1
• https://ubuntu.com/security/notices/USN-1880-1
• https://ubuntu.com/security/notices/USN-1881-1
• https://ubuntu.com/security/notices/USN-1882-1
• https://ubuntu.com/security/notices/USN-1883-1
• https://ubuntu.com/security/notices/USN-2128-1
• https://ubuntu.com/security/notices/USN-2129-1
• https://ubuntu.com/security/notices/USN-1916-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.novell.com/show_bug.cgi?id=797175
• https://bugzilla.redhat.com/show_bug.cgi?id=892983
• https://launchpad.net/bugs/1097680