Code: static void ptrace_siblings(pid_t pid, pid_t main_tid, std::set<pid_t>& tids) {
  char task_path[64];
//// Attach to a thread, and verify that it's still a member of the given process
 
  snprintf(task_path, sizeof(task_path), "/proc/%d/task", pid);
 
   std::unique_ptr<DIR, int (*)(DIR*)> d(opendir(task_path), closedir);
 
 if (!d) {
    ALOGE("debuggerd: failed to open /proc/%d/task: %s", pid, strerror(errno));
 return;
 }

 struct dirent* de;
 while ((de = readdir(d.get())) != NULL) {
 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, "..")) {
 continue;
 }

 char* end;
 pid_t tid = strtoul(de->d_name, &end, 10);
 if (*end) {
 continue;
 }

 if (tid == main_tid) {

       continue;
     }
 
    if (ptrace(PTRACE_ATTACH, tid, 0, 0) < 0) {
       ALOGE("debuggerd: ptrace attach to %d failed: %s", tid, strerror(errno));
       continue;
     }

    tids.insert(tid);
 }
}

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: debuggerd/debuggerd.cpp in Debuggerd in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles the interaction between PTRACE_ATTACH operations and thread exits, which allows attackers to gain privileges via a crafted application, aka internal bug 29555636.
Commit Message: debuggerd: verify that traced threads belong to the right process.

Fix two races in debuggerd's PTRACE_ATTACH logic:
  1. The target thread in a crash dump request could exit between the
     /proc/<pid>/task/<tid> check and the PTRACE_ATTACH.
  2. Sibling threads could exit between listing /proc/<pid>/task and the
     PTRACE_ATTACH.

Bug: http://b/29555636
Change-Id: I4dfe1ea30e2c211d2389321bd66e3684dd757591
