Real time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-0427     A local denial of service vulnerability in do_fork() has     been found.

  - CVE-2005-0489     A local denial of service vulnerability in proc memory     handling has been found.

  - CVE-2004-0394     A buffer overflow in the panic handling code has been     found.

  - CVE-2004-0447     A local denial of service vulnerability through a NULL     pointer dereference in the IA64 process handling code     has been found.

  - CVE-2004-0554     A local denial of service vulnerability through an     infinite loop in the signal handler code has been found.

  - CVE-2004-0565     An information leak in the context switch code has been     found on the IA64 architecture.

  - CVE-2004-0685     Unsafe use of copy_to_user in USB drivers may disclose     sensitive information.

  - CVE-2005-0001     A race condition in the i386 page fault handler may     allow privilege escalation.

  - CVE-2004-0883     Multiple vulnerabilities in the SMB filesystem code may     allow denial of service or information disclosure.

  - CVE-2004-0949     An information leak discovered in the SMB filesystem     code.

  - CVE-2004-1016     A local denial of service vulnerability has been found     in the SCM layer.

  - CVE-2004-1333     An integer overflow in the terminal code may allow a     local denial of service vulnerability.

  - CVE-2004-0997     A local privilege escalation in the MIPS assembly code     has been found.

  - CVE-2004-1335     A memory leak in the ip_options_get() function may lead     to denial of service.

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2003-0984     Inproper initialization of the RTC may disclose     information.

  - CVE-2004-1070     Insufficient input sanitising in the load_elf_binary()     function may lead to privilege escalation.

  - CVE-2004-1071     Incorrect error handling in the binfmt_elf loader may     lead to privilege escalation.

  - CVE-2004-1072     A buffer overflow in the binfmt_elf loader may lead to     privilege escalation or denial of service.

  - CVE-2004-1073     The open_exec function may disclose information.

  - CVE-2004-1074     The binfmt code is vulnerable to denial of service     through malformed a.out binaries.

  - CVE-2004-0138     A denial of service vulnerability in the ELF loader has     been found.

  - CVE-2004-1068     A programming error in the unix_dgram_recvmsg() function     may lead to privilege escalation.

  - CVE-2004-1234     The ELF loader is vulnerable to denial of service     through malformed binaries.

  - CVE-2005-0003     Crafted ELF binaries may lead to privilege escalation,     due to insufficient checking of overlapping memory     regions.

  - CVE-2004-1235     A race condition in the load_elf_library() and     binfmt_aout() functions may allow privilege escalation.

  - CVE-2005-0504     An integer overflow in the Moxa driver may lead to     privilege escalation.

  - CVE-2005-0384     A remote denial of service vulnerability has been found     in the PPP driver.

  - CVE-2005-0135     An IA64 specific local denial of service vulnerability     has been found in the unw_unwind_to_user() function.

The following matrix explains which kernel version for which architecture fixes the problems mentioned above :

                                Debian 3.1 (sarge)              Source                        2.4.17-1woody4                  HP Precision architecture     32.5                            Intel IA-64 architecture      011226.18                       IBM S/390 architecture/image  2.4.17-2.woody.5                IBM S/390 architecture/patch  0.0.20020816-0.woody.4          PowerPC architecture (apus)   2.4.17-6                        MIPS architecture             2.4.17-0.020226.2.woody7

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-0427     A local denial of service vulnerability in do_fork() has     been found.

  - CVE-2005-0489     A local denial of service vulnerability in proc memory     handling has been found.

  - CVE-2004-0394     A buffer overflow in the panic handling code has been     found.

  - CVE-2004-0447     A local denial of service vulnerability through a NULL     pointer dereference in the IA64 process handling code     has been found.

  - CVE-2004-0554     A local denial of service vulnerability through an     infinite loop in the signal handler code has been found.

  - CVE-2004-0565     An information leak in the context switch code has been     found on the IA64 architecture.

  - CVE-2004-0685     Unsafe use of copy_to_user in USB drivers may disclose     sensitive information.

  - CVE-2005-0001     A race condition in the i386 page fault handler may     allow privilege escalation.

  - CVE-2004-0883     Multiple vulnerabilities in the SMB filesystem code may     allow denial of service or information disclosure.

  - CVE-2004-0949     An information leak discovered in the SMB filesystem     code.

  - CVE-2004-1016     A local denial of service vulnerability has been found     in the SCM layer.

  - CVE-2004-1333     An integer overflow in the terminal code may allow a     local denial of service vulnerability.

  - CVE-2004-0997     A local privilege escalation in the MIPS assembly code     has been found.

  - CVE-2004-1335     A memory leak in the ip_options_get() function may lead     to denial of service.

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2003-0984     Inproper initialization of the RTC may disclose     information.

  - CVE-2004-1070     Insufficient input sanitising in the load_elf_binary()     function may lead to privilege escalation.

  - CVE-2004-1071     Incorrect error handling in the binfmt_elf loader may     lead to privilege escalation.

  - CVE-2004-1072     A buffer overflow in the binfmt_elf loader may lead to     privilege escalation or denial of service.

  - CVE-2004-1073     The open_exec function may disclose information.

  - CVE-2004-1074     The binfmt code is vulnerable to denial of service     through malformed a.out binaries.

  - CVE-2004-0138     A denial of service vulnerability in the ELF loader has     been found.

  - CVE-2004-1068     A programming error in the unix_dgram_recvmsg() function     may lead to privilege escalation.

  - CVE-2004-1234     The ELF loader is vulnerable to denial of service     through malformed binaries.

  - CVE-2005-0003     Crafted ELF binaries may lead to privilege escalation,     due to insufficient checking of overlapping memory     regions.

  - CVE-2004-1235     A race condition in the load_elf_library() and     binfmt_aout() functions may allow privilege escalation.

  - CVE-2005-0504     An integer overflow in the Moxa driver may lead to     privilege escalation.

  - CVE-2005-0384     A remote denial of service vulnerability has been found     in the PPP driver.

  - CVE-2005-0135     An IA64 specific local denial of service vulnerability     has been found in the unw_unwind_to_user() function.

The following matrix explains which kernel version for which architecture fixes the problems mentioned above :

                                   Debian 3.0 (woody)                 Source                           2.4.19-4                           Sun Sparc architecture           26woody1                           Little endian MIPS architecture  0.020911.1.woody5

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-0427     A local denial of service vulnerability in do_fork() has     been found.

  - CVE-2005-0489     A local denial of service vulnerability in proc memory     handling has been found.

  - CVE-2004-0394     A buffer overflow in the panic handling code has been     found.

  - CVE-2004-0447     A local denial of service vulnerability through a NULL     pointer dereference in the IA64 process handling code     has been found.

  - CVE-2004-0554     A local denial of service vulnerability through an     infinite loop in the signal handler code has been found.

  - CVE-2004-0565     An information leak in the context switch code has been     found on the IA64 architecture.

  - CVE-2004-0685     Unsafe use of copy_to_user in USB drivers may disclose     sensitive information.

  - CVE-2005-0001     A race condition in the i386 page fault handler may     allow privilege escalation.

  - CVE-2004-0883     Multiple vulnerabilities in the SMB filesystem code may     allow denial of service or information disclosure.

  - CVE-2004-0949     An information leak discovered in the SMB filesystem     code.

  - CVE-2004-1016     A local denial of service vulnerability has been found     in the SCM layer.

  - CVE-2004-1333     An integer overflow in the terminal code may allow a     local denial of service vulnerability.

  - CVE-2004-0997     A local privilege escalation in the MIPS assembly code     has been found.

  - CVE-2004-1335     A memory leak in the ip_options_get() function may lead     to denial of service.

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2003-0984     Inproper initialization of the RTC may disclose     information.

  - CVE-2004-1070     Insufficient input sanitising in the load_elf_binary()     function may lead to privilege escalation.

  - CVE-2004-1071     Incorrect error handling in the binfmt_elf loader may     lead to privilege escalation.

  - CVE-2004-1072     A buffer overflow in the binfmt_elf loader may lead to     privilege escalation or denial of service.

  - CVE-2004-1073     The open_exec function may disclose information.

  - CVE-2004-1074     The binfmt code is vulnerable to denial of service     through malformed a.out binaries.

  - CVE-2004-0138     A denial of service vulnerability in the ELF loader has     been found.

  - CVE-2004-1068     A programming error in the unix_dgram_recvmsg() function     may lead to privilege escalation.

  - CVE-2004-1234     The ELF loader is vulnerable to denial of service     through malformed binaries.

  - CVE-2005-0003     Crafted ELF binaries may lead to privilege escalation,     due to insufficient checking of overlapping memory     regions.

  - CVE-2004-1235     A race condition in the load_elf_library() and     binfmt_aout() functions may allow privilege escalation.

  - CVE-2005-0504     An integer overflow in the Moxa driver may lead to     privilege escalation.

  - CVE-2005-0384     A remote denial of service vulnerability has been found     in the PPP driver.

  - CVE-2005-0135     An IA64 specific local denial of service vulnerability     has been found in the unw_unwind_to_user() function.

The following matrix explains which kernel version for which architecture fixes the problems mentioned above :

                                   Debian 3.0 (woody)                 Source                           2.4.18-14.4                        Alpha architecture               2.4.18-15woody1                    Intel IA-32 architecture         2.4.18-13.2                        HP Precision architecture        62.4                               PowerPC architecture             2.4.18-1woody6                     PowerPC architecture/XFS         20020329woody1                     PowerPC architecture/benh        20020304woody1                     Sun Sparc architecture           22woody1

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-0427     A local denial of service vulnerability in do_fork() has     been found.

  - CVE-2005-0489     A local denial of service vulnerability in proc memory     handling has been found.

  - CVE-2004-0394     A buffer overflow in the panic handling code has been     found.

  - CVE-2004-0447     A local denial of service vulnerability through a NULL     pointer dereference in the IA64 process handling code     has been found.

  - CVE-2004-0554     A local denial of service vulnerability through an     infinite loop in the signal handler code has been found.

  - CVE-2004-0565     An information leak in the context switch code has been     found on the IA64 architecture.

  - CVE-2004-0685     Unsafe use of copy_to_user in USB drivers may disclose     sensitive information.

  - CVE-2005-0001     A race condition in the i386 page fault handler may     allow privilege escalation.

  - CVE-2004-0883     Multiple vulnerabilities in the SMB filesystem code may     allow denial of service or information disclosure.

  - CVE-2004-0949     An information leak discovered in the SMB filesystem     code.

  - CVE-2004-1016     A local denial of service vulnerability has been found     in the SCM layer.

  - CVE-2004-1333     An integer overflow in the terminal code may allow a     local denial of service vulnerability.

  - CVE-2004-0997     A local privilege escalation in the MIPS assembly code     has been found.

  - CVE-2004-1335     A memory leak in the ip_options_get() function may lead     to denial of service.

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2003-0984     Inproper initialization of the RTC may disclose     information.

  - CVE-2004-1070     Insufficient input sanitising in the load_elf_binary()     function may lead to privilege escalation.

  - CVE-2004-1071     Incorrect error handling in the binfmt_elf loader may     lead to privilege escalation.

  - CVE-2004-1072     A buffer overflow in the binfmt_elf loader may lead to     privilege escalation or denial of service.

  - CVE-2004-1073     The open_exec function may disclose information.

  - CVE-2004-1074     The binfmt code is vulnerable to denial of service     through malformed a.out binaries.

  - CVE-2004-0138     A denial of service vulnerability in the ELF loader has     been found.

  - CVE-2004-1068     A programming error in the unix_dgram_recvmsg() function     may lead to privilege escalation.

  - CVE-2004-1234     The ELF loader is vulnerable to denial of service     through malformed binaries.

  - CVE-2005-0003     Crafted ELF binaries may lead to privilege escalation,     due to insufficient checking of overlapping memory     regions.

  - CVE-2004-1235     A race condition in the load_elf_library() and     binfmt_aout() functions may allow privilege escalation.

  - CVE-2005-0504     An integer overflow in the Moxa driver may lead to     privilege escalation.

  - CVE-2005-0384     A remote denial of service vulnerability has been found     in the PPP driver.

  - CVE-2005-0135     An IA64 specific local denial of service vulnerability     has been found in the unw_unwind_to_user() function.

The following matrix explains which kernel version for which architecture fixes the problems mentioned above :

                               Debian 3.0 (woody)             Source                       2.4.16-1woody2                 arm/lart                     20040419woody1                 arm/netwinder                20040419woody1                 arm/riscpc                   20040419woody1

A flaw in bounds checking in mremap() in the Linux kernel versions 2.4.23 and previous was discovered by Paul Starzetz. This flaw may be used to allow a local attacker to obtain root privilege.

Another minor information leak in the RTC (real time clock) routines was fixed as well.

All Mandrake Linux users are encouraged to upgrade to these packages immediately. To update your kernel, please follow the directions located at :

http://www.mandrakesecure.net/en/kernelupdate.php

Mandrake Linux 9.1 and 9.2 users should upgrade the initscripts (9.1) and bootloader-utils (9.2) packages prior to upgrading the kernel as they contain a fixed installkernel script that fixes instances where the loop module was not being loaded and would cause mkinitrd to fail.

Users requiring commercial NVIDIA drivers can find drivers for Mandrake Linux 9.2 at MandrakeClub.

Various RTC drivers had the potential to leak small amounts of kernel memory to userspace through IOCTL's. 

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0984 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paul Starzetz discovered a flaw in bounds checking in mremap() in the Linux kernel versions 2.4.23 and previous which may allow a local attacker to gain root privileges. No exploit is currently available;
however, it is believed that this issue is exploitable (although not trivially.) The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0985 to this issue.

All users are advised to upgrade to these errata packages, which contain a backported security patch that corrects this issue. 

Red Hat would like to thank Paul Starzetz from ISEC for disclosing this issue as well as Andrea Arcangeli and Solar Designer for working on the patch.

These packages also contain a fix for a minor information leak in the real time clock (rtc) routines. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0984 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the second regular update.

The Linux kernel handles the basic functions of the operating system.

This is the second regular kernel update to Red Hat Enterprise Linux version 3. It contains several minor security fixes, many bug fixes, device driver updates, new hardware support, and the introduction of Linux Syscall Auditing support.

There were bug fixes in many different parts of the kernel, the bulk of which addressed unusual situations such as error handling, race conditions, and resource starvation. The combined effect of the approximately 140 fixes is a strong improvement in the reliability and durability of Red Hat Enterprise Linux. Some of the key areas affected are disk drivers, network drivers, USB support, x86_64 and ppc64 platform support, ia64 32-bit emulation layer enablers, and the VM, NFS, IPv6, and SCSI subsystems.

A significant change in the SCSI subsystem (the disabling of the scsi-affine-queue patch) should significantly improve SCSI disk driver performance in many scenarios. There were 10 Bugzillas against SCSI performance problems addressed by this change.

The following drivers have been upgraded to new versions :

bonding ---- 2.4.1 cciss ------ 2.4.50.RH1 e1000 ------ 5.2.30.1-k1 fusion ----- 2.05.11.03 ipr -------- 1.0.3 ips -------- 6.11.07 megaraid2 -- 2.10.1.1 qla2x00 ---- 6.07.02-RH1 tg3 -------- 3.1 z90crypt --- 1.1.4

This update introduces support for the new Intel EM64T processor. A new 'ia32e' architecture has been created to support booting on platforms based on either the original AMD Opteron CPU or the new Intel EM64T CPU. The existing 'x86_64' architecture has remained optimized for Opteron systems. Kernels for both types of systems are built from the same x86_64-architecture sources and share a common kernel source RPM (kernel-source-2.4.21-15.EL.x86_64.rpm).

Other highlights in this update include a major upgrade to the SATA infrastructure, addition of IBM JS20 Power Blade support, and creation of an optional IBM eServer zSeries On-Demand Timer facility for reducing idle CPU overhead.

The following security issues were addressed in this update :

A minor flaw was found where /proc/tty/driver/serial reveals the exact character counts for serial links. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0461 to this issue.

The kernel strncpy() function in Linux 2.4 and 2.5 does not pad the target buffer with null bytes on architectures other than x86, as opposed to the expected libc behavior, which could lead to information leaks. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0465 to this issue.

A minor data leak was found in two real time clock drivers (for /dev/rtc). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0984 to this issue.

A flaw in the R128 Direct Render Infrastructure (dri) driver could allow local privilege escalation. This driver is part of the kernel-unsupported package. The Common Vulnera- bilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0003 to this issue.

A flaw in ncp_lookup() in ncpfs could allow local privilege escalation. The ncpfs module allows a system to mount volumes of NetWare servers or print to NetWare printers and is in the kernel-unsupported package. The Common Vulnera- bilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0010 to this issue.

(Note that the kernel-unsupported package contains drivers and other modules that are unsupported and therefore might contain security problems that have not been addressed.)

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

ID	Name	Product	Family	Type	Severity
22624	Debian DSA-1082-1 : kernel-source-2.4.17 - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
22612	Debian DSA-1070-1 : kernel-source-2.4.19 - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
22611	Debian DSA-1069-1 : kernel-source-2.4.18 - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
22609	Debian DSA-1067-1 : kernel-source-2.4.16 - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
14101	Mandrake Linux Security Advisory : kernel (MDKSA-2004:001)	Nessus	Mandriva Local Security Checks	Local	high
13670	Fedora Core 1 : kernel-2.4.22-1.2140.nptl (2003-047)	Nessus	Fedora Local Security Checks	Local	medium
13669	Fedora Core 1 : kernel-2.4.22-1.2138.nptl (2003-046)	Nessus	Fedora Local Security Checks	Local	high
12494	RHEL 3 : kernel (RHSA-2004:188)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2003-0984

medium

Tenable Plugins

critical

critical

critical

critical

high

medium

high

high