Linux kernel does not properly convert 64-bit file offset pointers to 32 bits, which allows local users to access portions of kernel memory.

The remote host is affected by the vulnerability described in GLSA-200408-24 (Linux Kernel: Multiple information leaks)

    The Linux kernel allows a local attacker to obtain sensitive kernel     information by gaining access to kernel memory via several leaks in the     /proc interfaces. These vulnerabilities exist in various drivers which     make up a working Linux kernel, some of which are present across all     architectures and configurations.
    CAN-2004-0415 deals with addressing invalid 32 to 64 bit conversions in     the kernel, as well as insecure direct access to file offset pointers     in kernel code which can be modified by the open(...), lseek(...) and     other core system I/O functions by an attacker.
    CAN-2004-0685 deals with certain USB drivers using uninitialized     structures and then using the copy_to_user(...) kernel call to copy     these structures. This may leak uninitialized kernel memory, which can     contain sensitive information from user applications.
    Finally, a race condition with the /proc/.../cmdline node was found,     allowing environment variables to be read while the process was still     spawning. If the race is won, environment variables of the process,     which might not be owned by the attacker, can be read.
  Impact :

    These vulnerabilities allow a local unprivileged attacker to access     segments of kernel memory or environment variables which may contain     sensitive information. Kernel memory may contain passwords, data     transferred between processes and any memory which applications did not     clear upon exiting as well as the kernel cache and kernel buffers.
    This information may be used to read sensitive data, open other attack     vectors for further exploitation or cause a Denial of Service if the     attacker can gain superuser access via the leaked information.
  Workaround :

    There is no temporary workaround for any of these information leaks     other than totally disabling /proc support - otherwise, a kernel     upgrade is required. A list of unaffected kernels is provided along     with this announcement.

A race condition was discovered in the 64bit file offset handling by Paul Starzetz from iSEC. The file offset pointer (f_pos) is changed during reading, writing, and seeking through a file in order to point to the current position of a file. The value conversion between both the 32bit and 64bit API in the kernel, as well as access to the f_pos pointer, is defective. As a result, a local attacker can abuse this vulnerability to gain access to uninitialized kernel memory, mostly via entries in the /proc filesystem. This kernel memory can possibly contain information like the root password, and other sensitive data.

The updated kernel packages provided are patched to protect against this vulnerability, and all users are encouraged to upgrade immediately.

Paul Starzetz discovered flaws in the Linux kernel when handling file offset pointers. These consist of invalid conversions of 64 to 32-bit file offset pointers and possible race conditions. A local unprivileged user could make use of these flaws to access large portions of kernel memory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0415 to this issue.

These packages contain a patch written by Al Viro to correct these flaws. Red Hat would like to thank iSEC Security Research for disclosing this issue and a number of vendor-sec participants for reviewing and working on the patch to this issue.

Additionally, a number of issues were fixed in the USB serial code.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix potential information leaks and a incorrect driver permission for Red Hat Enterprise Linux 2.1 are now available.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered flaws in the Linux kernel when handling file offset pointers. These consist of invalid conversions of 64 to 32-bit file offset pointers and possible race conditions. A local unprivileged user could make use of these flaws to access large portions of kernel memory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0415 to this issue.

These packages contain a patch written by Al Viro to correct these flaws. Red Hat would like to thank iSEC Security Research for disclosing this issue and a number of vendor-sec participants for reviewing and working on the patch to this issue.

In addition, these packages correct two minor issues :

An bug in the e1000 network driver. This bug could be used by local users to leak small amounts of kernel memory (CVE-2004-0535).

Inappropriate permissions on /proc/scsi/qla2300/HbaApiNode (CVE-2004-0587).

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their kernels to these erratum packages which contain backported patches to correct these issues.

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered flaws in the Linux kernel when handling file offset pointers. These consist of invalid conversions of 64 to 32-bit file offset pointers and possible race conditions. A local unprivileged user could make use of these flaws to access large portions of kernel memory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0415 to this issue.

These packages contain a patch written by Al Viro to correct these flaws. Red Hat would like to thank iSEC Security Research for disclosing this issue and a number of vendor-sec participants for reviewing and working on the patch to this issue.

In addition, these packages correct a number of minor security issues :

An bug in the e1000 network driver. This bug could be used by local users to leak small amounts of kernel memory (CVE-2004-0535).

A bug in the SoundBlaster 16 code which does not properly handle certain sample sizes. This flaw could be used by local users to crash a system (CVE-2004-0178).

A possible NULL pointer dereference in the Linux kernel prior to 2.4.26 on the Itanium platform could allow a local user to crash a system (CVE-2004-0447).

Inappropriate permissions on /proc/scsi/qla2300/HbaApiNode (CVE-2004-0587).

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

The remote host is missing the patch for the advisory SUSE-SA:2004:024 (kernel).

This kernel is vulnerable to a race condition in the 64-bit file offset handling code.

The file offset pointer (f_pos) is changed during reading, writing, and seeking through a file to point to the current position in a file.
The Linux kernel offers a 32bit and a 64bit API. Unfortunately the value conversion between this two APIs as well as the access to the f_pos pointer is defective.

An attacker, exploiting this flaw, would need local access to the machine.  Upon successful exploitation, an attacker would be able to read potentially confidential kernel memory.

Additionally a bug in the implementation of chown(2) for updating inode times, and a denial-of-service condition that can occur while handling signals was fixed.

ID	Name	Product	Family	Severity
14580	GLSA-200408-24 : Linux Kernel: Multiple information leaks	Nessus	Gentoo Local Security Checks	medium
14387	Mandrake Linux Security Advisory : kernel (MDKSA-2004:087)	Nessus	Mandriva Local Security Checks	low
14252	Fedora Core 1 : kernel-2.4.22-1.2199.nptl (2004-251)	Nessus	Fedora Local Security Checks	low
14240	RHEL 2.1 : kernel (RHSA-2004:418)	Nessus	Red Hat Local Security Checks	low
14239	RHEL 3 : kernel (RHSA-2004:413)	Nessus	Red Hat Local Security Checks	high
14231	SUSE-SA:2004:024: kernel	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2004-0415

medium

Tenable Plugins

medium

low

low

low

high

low