Security: information leaks in /proc enable keystroke recovery

[David Wagner <daw@cs.berkeley.edu>]

At Usenix Security 2009, two researchers announced last week a new
security vulnerability in multi-user Linux systems.  They demonstrated
that one user can, in many cases, recover partial information about
the keystrokes that another user types into applications running on
that system.  For instance, they demonstrate how a malicious user can
recover partial information about SSH passwords typed by other users,
reducing the password search space by a factor of 250-2000x in
their experiments.  Thus, this could facilitate password recovery.

Question: Are there any plans to modify the Linux kernel to defend
against this kind of attack?

The paper is here:

http://www.usenix.org/events/sec09/tech/full_papers/zhang.pdf 

In a nutshell, they exploit the fact that many files in /proc are
world-readable yet contain sensitive information that can leak information
about inter-keystroke timings.  For instance, /proc/$PID/stat reveals the
ESP and EIP registers of the associated process, and is world-readable.
/proc/pid/status is also mentioned as revealing information that could
be exploited in these attacks.

Based on my understanding of their work, it sounds like some of
the information on those files should perhaps not be world-readable.
It's not clear to me that it's reasonable for the kernel to reveal ESP,
EIP, and other sensitive information about process behavior to everyone
on the same system.

Are folks already aware of these vulnerabilities?  Is there any work
underway to try to address the issues identified in the Usenix Security
paper?