The JFS file system code in Linux 2.4.x has an information leak in which in-memory data is written to the device for the JFS file system, which allows local users to obtain sensitive information by reading the raw device.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the sixth regular update.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the sixth regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - diskdump support on HP Smart Array devices -     netconsole/netdump support over bonded interfaces - new     chipset and device support via PCI table updates -     support for new 'oom-kill' and 'kscand_work_percent'     sysctls - support for dual core processors and ACPI     Power Management timers on AMD64 and Intel EM64T systems

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 3.

There were numerous driver updates and security fixes (elaborated below). Other key areas affected by fixes in this update include kswapd, inode handling, the SATA subsystem, diskdump handling, ptrace() syscall support, and signal handling.

The following device drivers have been upgraded to new versions :

3w-9xxx ---- 2.24.03.008RH cciss ------ 2.4.58.RH1 e100 ------- 3.4.8-k2 e1000 ------ 6.0.54-k2 emulex ----- 7.3.2 fusion ----- 2.06.16i.01 iscsi ------ 3.6.2.1 ipmi ------- 35.4 lpfcdfc ---- 1.2.1 qlogic ----- 7.05.00-RH1 tg3 -------- 3.27RH

The following security bugs were fixed in this update :

  - a flaw in syscall argument checking on Itanium systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-0136)

  - a flaw in stack expansion that allowed a local user of     mlockall() to cause a denial of service (memory     exhaustion) (CVE-2005-0179)

  - a small memory leak in network packet defragmenting that     allowed a remote user to cause a denial of service     (memory exhaustion) on systems using netfilter     (CVE-2005-0210)

  - flaws in ptrace() syscall handling on AMD64 and Intel     EM64T systems that allowed a local user to cause a     denial of service (crash) (CVE-2005-0756, CVE-2005-1762,     CVE-2005-2553)

  - flaws in ISO-9660 file system handling that allowed the     mounting of an invalid image on a CD-ROM to cause a     denial of service (crash) or potentially execute     arbitrary code (CVE-2005-0815)

  - a flaw in ptrace() syscall handling on Itanium systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-1761)

  - a flaw in the alternate stack switching on AMD64 and     Intel EM64T systems that allowed a local user to cause a     denial of service (crash) (CVE-2005-1767)

  - race conditions in the ia32-compat support for exec()     syscalls on AMD64, Intel EM64T, and Itanium systems that     could allow a local user to cause a denial of service     (crash) (CVE-2005-1768)

  - flaws in IPSEC network handling that allowed a local     user to cause a denial of service or potentially gain     privileges (CVE-2005-2456, CVE-2005-2555)

  - a flaw in sendmsg() syscall handling on 64-bit systems     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2490)

  - flaws in unsupported modules that allowed     denial-of-service attacks (crashes) or local privilege     escalations on systems using the drm, coda, or moxa     modules (CVE-2004-1056, CVE-2005-0124, CVE-2005-0504)

  - potential leaks of kernel data from jfs and ext2 file     system handling (CVE-2004-0181, CVE-2005-0400)

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

The remote host is affected by the vulnerability described in GLSA-200407-02 (Linux Kernel: Multiple vulnerabilities)

    Multiple flaws have been discovered in the Linux kernel. This advisory     corrects the following issues:
    CAN-2004-0109: This vulnerability allows privilege escalation using     ISO9660 file systems through a buffer overflow via a malformed file     system containing a long symbolic link entry. This can allow arbitrary     code execution at kernel level.
    CAN-2004-0133: The XFS file system in 2.4 series kernels has an     information leak by which data in the memory can be written to the     device hosting the file system, allowing users to obtain portions of     kernel memory by reading the raw block device.
    CAN-2004-0177: The ext3 file system in 2.4 series kernels does not     properly initialize journal descriptor blocks, causing an information     leak by which data in the memory can be written to the device hosting     the file system, allowing users to obtain portions of kernel memory by     reading the raw device.
    CAN-2004-0181: The JFS file system in 2.4 series kernels has an     information leak by which data in the memory can be written to the     device hosting the file system, allowing users to obtain portions of     kernel memory by reading the raw device.
    CAN-2004-0178: The OSS Sound Blaster [R] Driver has a Denial of Service     vulnerability since it does not handle certain sample sizes properly.
    This allows local users to hang the kernel.
    CAN-2004-0228: Due to an integer signedness error in the CPUFreq /proc     handler code in 2.6 series Linux kernels, local users can escalate     their privileges.
    CAN-2004-0229: The framebuffer driver in 2.6 series kernel drivers does     not use the fb_copy_cmap method of copying structures. The impact of     this issue is unknown, however.
    CAN-2004-0394: A buffer overflow in the panic() function of 2.4 series     Linux kernels exists, but it may not be exploitable under normal     circumstances due to its functionality.
    CAN-2004-0427: The do_fork() function in both 2.4 and 2.6 series Linux     kernels does not properly decrement the mm_count counter when an error     occurs, triggering a memory leak that allows local users to cause a     Denial of Service by exhausting other applications of memory; causing     the kernel to panic or to kill services.
    CAN-2004-0495: Multiple vulnerabilities found by the Sparse source     checker in the kernel allow local users to escalate their privileges or     gain access to kernel memory.
    CAN-2004-0535: The e1000 NIC driver does not properly initialize memory     structures before using them, allowing users to read kernel memory.
    CAN-2004-0554: 2.4 and 2.6 series kernels running on an x86 or an AMD64     architecture allow local users to cause a Denial of Service by a total     system hang, due to an infinite loop that triggers a signal handler     with a certain sequence of fsave and frstor instructions.
    Local DoS in PaX: If ASLR is enabled as a GRSecurity PaX feature, a     Denial of Service can be achieved by putting the kernel into an     infinite loop. Only 2.6 series GRSecurity kernels are affected by this     issue.
    RSBAC 1.2.3 JAIL issues: A flaw in the RSBAC JAIL implementation allows     suid/sgid files to be created inside the jail since the relevant module     does not check the corresponding mode values. This can allow privilege     escalation inside the jail. Only rsbac-(dev-)sources are affected by     this issue.
  Impact :

    Arbitrary code with normal non-super-user privileges may be able to     exploit any of these vulnerabilities; gaining kernel level access to     memory structures and hardware devices. This may be used for further     exploitation of the system, to leak sensitive data or to cause a Denial     of Service on the affected kernel.
  Workaround :

    Although users may not be affected by certain vulnerabilities, all     kernels are affected by the CAN-2004-0394, CAN-2004-0427 and     CAN-2004-0554 issues which have no workaround. As a result, all users     are urged to upgrade their kernels to patched versions.

A vulnerability was found in the R128 DRI driver by Alan Cox. This could allow local privilege escalation. The previous fix, in MDKSA-2004:015 only partially corrected the problem; the full fix is included (CVE-2004-0003).

A local root vulnerability was discovered in the isofs component of the Linux kernel by iDefense. This vulnerability can be triggered by performing a directory listing on a maliciously constructed ISO filesystem, or attempting to access a file via a malformed symlink on such a filesystem (CVE-2004-0109).

An information leak was discovered in the ext3 filesystem code by Solar Designer. It was discovered that when creating or writing to an ext3 filesystem, some amount of other in-memory data gets written to the device. The data is not the file's contents, not something on the same filesystem, or even anything that was previously in a file at all. To obtain this data, a user needs to read the raw device (CVE-2004-0177).

The same vulnerability was also found in the XFS filesystem code (CVE-2004-0133) and the JFS filesystem code (CVE-2004-0181).

Finally, a vulnerability in the OSS code for SoundBlaster 16 devices was discovered by Andreas Kies. It is possible for local users with access to the sound system to crash the machine (CVE-2004-0178).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandrakesecure.net/en/kernelupdate.php

The remote host is missing the patch for the advisory SuSE-SA:2004:009 (Linux Kernel).


iDEFENSE Inc. informed us about a buffer overflow in the linux 2.4 kernel code which handles ISO9660 filesystems. The original code is not able to handle very long symlink names.
The vulnerability can be triggered locally by mounting removable media that contains a malformed filesystem or by using the loopback device.
Exploiting this buffer overflow results in kernel-level access to the system.

Another vulnerability allows the retrieval of private informations from JFS filesystems due to the lack of cleaning up (writing zeros) used sectors on the harddrive. This bug needs root privilges to be exploited.

A memory leak was fixed in an error path in the do_fork() routine.
This was unlikely to have caused problems in real world situations.

The information leak fixed in the previous errata was also found to affect XFS and JFS. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the names CVE-2004-0133 and CVE-2004-0181 respectively.

A vulnerability in the OSS code for SoundBlaster 16 devices was discovered by Andreas Kies. It is possible for local users with access to the sound system to crash the machine (CVE-2004-0178).

An automated checked from http://www.coverity.com highlighted a range checking bug in the i810 DRM driver. This was fixed by Andrea Arcangeli and Chris Wright.

Arjan van de Ven discovered the framebuffer code was doing direct userspace accesses instead of using correct interfaces to write to userspace.

Brad Spengler found a signedness issue in the cpufreq proc handler which could lead to users being able to read arbitary regions of kernel memory. This was fixed by Dominik Brodowski.

Shaun Colley found a potential buffer overrun in the panic() function.
As this function does not ever return, it is unlikely that this is exploitable, but has been fixed nonetheless. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2004-0394 to this issue.

Paul Starzetz and Wojciech Purczynski found a lack of bounds checking in the MCAST_MSFILTER socket option which allows user code to write into kernel space, potentially giving the attacker full root priveledges. There has already been proof of concept code published exploiting this hole in a local denial-of-service manner.
http://www.isec.pl/vulnerabilities/isec-0015-msfilter.txt has more information. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2004-0424 to this issue.

The previous security errata actually missed fixes for several important problems. This has been corrected in this update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A memory leak was fixed in an error path in the do_fork() routine.
This was unlikely to have caused problems in real world situations.

The information leak fixed in the previous errata was also found to
affect XFS and JFS. The Common Vulnerabilities and Exposures project
(cve.mitre.org) assigned the names CVE-2004-0133 and CVE-2004-0181
respectively.

A vulnerability in the OSS code for SoundBlaster 16 devices was
discovered by Andreas Kies. It is possible for local users with access
to the sound system to crash the machine (CVE-2004-0178).

An automated checked from http://www.coverity.com highlighted a range
checking bug in the i810 DRM driver. This was fixed by Andrea
Arcangeli and Chris Wright.

Arjan van de Ven discovered the framebuffer code was doing direct
userspace accesses instead of using correct interfaces to write to
userspace.

Brad Spengler found a signedness issue in the cpufreq proc handler
which could lead to users being able to read arbitary regions of
kernel memory. This was fixed by Dominik Brodowski.

Shaun Colley found a potential buffer overrun in the panic() function.
As this function does not ever return, it is unlikely that this is
exploitable, but has been fixed nonetheless. The Common
Vulnerabilities and Exposures project (cve.mitre.org) assigned the
name CVE-2004-0394 to this issue.

Paul Starzetz and Wojciech Purczynski found a lack of bounds checking
in the MCAST_MSFILTER socket option which allows user code to write
into kernel space, potentially giving the attacker full root
priveledges. There has already been proof of concept code published
exploiting this hole in a local denial-of-service manner.
http://www.isec.pl/vulnerabilities/isec-0015-msfilter.txt has more
information. The Common Vulnerabilities and Exposures project
(cve.mitre.org) assigned the name CVE-2004-0424 to this issue.

The previous security errata actually missed fixes for several
important problems. This has been corrected in this update.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2005-663.

ID	Name	Product	Family	Severity
21849	CentOS 3 : kernel (CESA-2005:663)	Nessus	CentOS Local Security Checks	medium
19832	RHEL 3 : kernel (RHSA-2005:663)	Nessus	Red Hat Local Security Checks	medium
14535	GLSA-200407-02 : Linux Kernel: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
14128	Mandrake Linux Security Advisory : kernel (MDKSA-2004:029)	Nessus	Mandriva Local Security Checks	medium
13827	SuSE-SA:2004:009: Linux Kernel	Nessus	SuSE Local Security Checks	medium
13692	Fedora Core 1 : kernel-2.4.22-1.2188.nptl (2004-111)	Nessus	Fedora Local Security Checks	high
801550	Fedora 2004-111 Security Check	Log Correlation Engine	Generic	high
801410	CentOS RHSA-2005-663 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2004-0181

medium

Tenable Plugins

medium

medium

high

medium

medium

high

high

high