Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not properly check the DMA lock, which could allow remote attackers or local users to cause a denial of service (X Server crash) and possibly modify the video output.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the sixth regular update.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the sixth regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - diskdump support on HP Smart Array devices -     netconsole/netdump support over bonded interfaces - new     chipset and device support via PCI table updates -     support for new 'oom-kill' and 'kscand_work_percent'     sysctls - support for dual core processors and ACPI     Power Management timers on AMD64 and Intel EM64T systems

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 3.

There were numerous driver updates and security fixes (elaborated below). Other key areas affected by fixes in this update include kswapd, inode handling, the SATA subsystem, diskdump handling, ptrace() syscall support, and signal handling.

The following device drivers have been upgraded to new versions :

3w-9xxx ---- 2.24.03.008RH cciss ------ 2.4.58.RH1 e100 ------- 3.4.8-k2 e1000 ------ 6.0.54-k2 emulex ----- 7.3.2 fusion ----- 2.06.16i.01 iscsi ------ 3.6.2.1 ipmi ------- 35.4 lpfcdfc ---- 1.2.1 qlogic ----- 7.05.00-RH1 tg3 -------- 3.27RH

The following security bugs were fixed in this update :

  - a flaw in syscall argument checking on Itanium systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-0136)

  - a flaw in stack expansion that allowed a local user of     mlockall() to cause a denial of service (memory     exhaustion) (CVE-2005-0179)

  - a small memory leak in network packet defragmenting that     allowed a remote user to cause a denial of service     (memory exhaustion) on systems using netfilter     (CVE-2005-0210)

  - flaws in ptrace() syscall handling on AMD64 and Intel     EM64T systems that allowed a local user to cause a     denial of service (crash) (CVE-2005-0756, CVE-2005-1762,     CVE-2005-2553)

  - flaws in ISO-9660 file system handling that allowed the     mounting of an invalid image on a CD-ROM to cause a     denial of service (crash) or potentially execute     arbitrary code (CVE-2005-0815)

  - a flaw in ptrace() syscall handling on Itanium systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-1761)

  - a flaw in the alternate stack switching on AMD64 and     Intel EM64T systems that allowed a local user to cause a     denial of service (crash) (CVE-2005-1767)

  - race conditions in the ia32-compat support for exec()     syscalls on AMD64, Intel EM64T, and Itanium systems that     could allow a local user to cause a denial of service     (crash) (CVE-2005-1768)

  - flaws in IPSEC network handling that allowed a local     user to cause a denial of service or potentially gain     privileges (CVE-2005-2456, CVE-2005-2555)

  - a flaw in sendmsg() syscall handling on 64-bit systems     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2490)

  - flaws in unsupported modules that allowed     denial-of-service attacks (crashes) or local privilege     escalations on systems using the drm, coda, or moxa     modules (CVE-2004-1056, CVE-2005-0124, CVE-2005-0504)

  - potential leaks of kernel data from jfs and ext2 file     system handling (CVE-2004-0181, CVE-2005-0400)

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

CAN-2004-0814 :

Vitaly V. Bursov discovered a Denial of Service vulnerability in the 'serio' code; opening the same tty device twice and doing some particular operations on it caused a kernel panic and/or a system lockup. 

Fixing this vulnerability required a change in the Application Binary Interface (ABI) of the kernel. This means that third-party user installed modules might not work any more with the new kernel, so this fixed kernel got a new ABI version number. You have to recompile and reinstall all third-party modules.

CAN-2004-1016 :

Paul Starzetz discovered a buffer overflow vulnerability in the '__scm_send' function which handles the sending of UDP network packets. A wrong validity check of the cmsghdr structure allowed a local attacker to modify kernel memory, thus causing an endless loop (Denial of Service) or possibly even root privilege escalation.

CAN-2004-1056 :

Thomas Hellstrom discovered a Denial of Service vulnerability in the Direct Rendering Manager (DRM) drivers. Due to an insufficient DMA lock checking, any authorized client could send arbitrary values to the video card, which could cause an X server crash or modification of the video output.

CAN-2004-1058 :

Rob Landley discovered a race condition in the handling of /proc/.../cmdline. Under very rare circumstances an user could read the environment variables of another process that was still spawning.
Environment variables are often used to pass passwords and other private information to other processes.

CAN-2004-1068 :

A race condition was discovered in the handling of AF_UNIX network packets. This reportedly allowed local users to modify arbitrary kernel memory, facilitating privilege escalation, or possibly allowing code execution in the context of the kernel.

CAN-2004-1069 :

Ross Kendall Axe discovered a possible kernel panic (causing a Denial of Service) while sending AF_UNIX network packages if the kernel options CONFIG_SECURITY_NETWORK and CONFIG_SECURITY_SELINUX are enabled. This is not the case in the kernel packages shipped in Warty Warthog; however, if you recompiled the kernel using SELinux, you are affected by this flaw.

CAN-2004-1137 :

Paul Starzetz discovered several flaws in the IGMP handling code. This allowed users to provoke a Denial of Service, read kernel memory, and execute arbitrary code with root privileges. This flaw is also exploitable remotely if an application has bound a multicast socket.

CAN-2004-1151 :

Jeremy Fitzhardinge discovered two buffer overflows in the sys32_ni_syscall() and sys32_vm86_warning() functions. This could possibly be exploited to overwrite kernel memory with attacker-supplied code and cause root privilege escalation. 

This vulnerability only affects the amd64 architecture.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix a number of security issues as well as other bugs are now available for Red Hat Enterprise Linux 2.1 (32 bit architectures)

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is a kernel maintenance update to Red Hat Enterprise Linux 2.1.

The following security issues were corrected :

A flaw between execve() syscall handling and core dumping of ELF-format executables allowed local unprivileged users to cause a denial of service (system crash) or possibly gain privileges. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-1263 to this issue.

A flaw when freeing a pointer in load_elf_library was discovered. A local user could potentially use this flaw to cause a denial of service (crash). (CVE-2005-0749)

The Direct Rendering Manager (DRM) driver did not properly check the DMA lock, which could allow remote attackers or local users to cause a denial of service (X Server crash) or possibly modify the video output. (CVE-2004-1056)

A flaw in the moxa serial driver could allow a local user to perform privileged operations such as replacing the firmware. (CVE-2005-0504)

The following bug fixes were also made :

  - Fix a race condition that can cause a panic in
    __get_lease() - Fix a race condition that can cause a     panic when reading /proc/mdstat - Fix incorrect ide     accounting - Prevent non-root users from reloading moxa     driver firmware - Fix a NULL pointer dereference bug in     rpciod - Fix legacy-usb handoff for certain IBM     platforms - Fix a bug that caused busy inodes after     unmount - Provide an additional fix for a memory leak in     scsi_scan_single. - Fix a potential kswapd/dquot     deadlock. - Fix a potential local DoS in shmemfs. - Fix     a random poolsize vulnerability.

Red Hat Enterprise Linux 2.1 users are advised to upgrade their kernels to the packages associated with their machine configurations as listed in this erratum.

Multiple vulnerabilities in the Linux kernel have been discovered and fixed in this update. The following CVE names have been fixed in the LE2005 kernel :

Colin Percival discovered a vulnerability in Intel's Hyper-Threading technology could allow a local user to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys via a timing attack on memory cache misses. This has been corrected by disabling HT support in all kernels (CVE-2005-0109).

An information leak in the ext2 filesystem code in kernels prior to 2.6.11.6 was found where when a new directory is created, the ext2 block written to disk is not initialized (CVE-2005-0400).

A flaw when freeing a pointer in load_elf_library was found in kernels prior to 2.6.11.6 that could be abused by a local user to potentially crash the machine causing a Denial of Service (CVE-2005-0749).

A problem with the Bluetooth kernel stack in kernels 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 could be used by a local attacker to gain root access or crash the machine (CVE-2005-0750).

Paul Starzetz found an integer overflow in the ELF binary format loader's code dump function in kernels prior to and including 2.4.31-pre1 and 2.6.12-rc4. By creating and executing a specially crafted ELF executable, a local attacker could exploit this to execute arbitrary code with root and kernel privileges (CVE-2005-1263).

The drivers for raw devices used the wrong function to pass arguments to the underlying block device in 2.6.x kernels. This made the kernel address space accessible to user-space applications allowing any local user with at least read access to a device in /dev/raw/* (usually only root) to execute arbitrary code with kernel privileges (CVE-2005-1264).

The it87 and via686a hardware monitor drivers in kernels prior to 2.6.11.8 and 2.6.12 prior to 2.6.12-rc2 created a sysfs file named 'alarms' with write permissions although they are not designed to be writable. This allowed a local user to crash the kernel by attempting to write to these files (CVE-2005-1369).

In addition to the above-noted CVE-2005-0109, CVE-2005-0400, CVE-2005-0749, CVE-2005-0750, and CVE-2005-1369 fixes, the following CVE names have been fixed in the 10.1 kernel :

The POSIX Capability Linux Security Module (LSM) for 2.6 kernels up to and including 2.6.8.1 did not properly handle the credentials of a process that is launched before the module is loaded, which could be used by local attackers to gain elevated privileges (CVE-2004-1337).

A flaw in the Linux PPP driver in kernel 2.6.8.1 was found where on systems allowing remote users to connect to a server via PPP, a remote client could cause a crash, resulting in a Denial of Service (CVE-2005-0384).

George Guninski discovered a buffer overflow in the ATM driver in kernels 2.6.10 and 2.6.11 before 2.6.11-rc4 where the atm_get_addr() function does not validate its arguments sufficiently which could allow a local attacker to overwrite large portions of kernel memory by supplying a negative length argument. This could potentially lead to the execution of arbitrary code (CVE-2005-0531).

The reiserfs_copy_from_user_to_file_region function in reiserfs/file.c before kernel 2.6.11, when running on 64-bit architectures, could allow local users to trigger a buffer overflow as a result of casting discrepancies between size_t and int data types. This could allow an attacker to overwrite kernel memory, crash the machine, or potentially obtain root access (CVE-2005-0532).

A race condition in the Radeon DRI driver in kernel 2.6.8.1 allows a local user with DRI privileges to execute arbitrary code as root (CVE-2005-0767).

Access was not restricted to the N_MOUSE discipline for a TTY in kernels prior to 2.6.11. This could allow local attackers to obtain elevated privileges by injecting mouse or keyboard events into other user's sessions (CVE-2005-0839).

Some futex functions in futex.c in 2.6 kernels performed get_user calls while holding the mmap_sem semaphore, which could allow a local attacker to cause a deadlock condition in do_page_fault by triggering get_user faults while another thread is executing mmap or other functions (CVE-2005-0937).

In addition to the above-noted CVE-2004-1337, CVE-2005-0109, CVE-2005-0384, CVE-2005-0400, CVE-2005-0531, CVE-2005-0532, CVE-2005-0749, CVE-2005-0750, CVE-2005-0767, CVE-2005-0839, CVE-2005-0937, CVE-2005-1263, CVE-2005-1264, and CVE-2005-1369 fixes, the following CVE names have been fixed in the 10.0/ Corporate 3.0 kernels :

A race condition in the setsid function in kernels before 2.6.8.1 could allow a local attacker to cause a Denial of Service and possibly access portions of kernel memory related to TTY changes, locking, and semaphores (CVE-2005-0178).

When forwarding fragmented packets in kernel 2.6.8.1, a hardware assisted checksum could only be used once which could lead to a Denial of Service attack or crash by remote users (CVE-2005-0209).

A signedness error in the copy_from_read_buf function in n_tty.c before kernel 2.6.11 allows local users to read kernel memory via a negative argument (CVE-2005-0530).

A vulnerability in the fib_seq_start() function allowed a local user to crash the system by readiung /proc/net/route in a certain way, causing a Denial of Service (CVE-2005-1041).

A vulnerability in the Direct Rendering Manager (DRM) driver in the 2.6 kernel does not properly check the DMA lock, which could allow remote attackers or local users to cause a Denial of Service (X Server crash) and possibly modify the video output (CVE-2004-1056).

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:092 advisory.

    The Linux kernel handles the basic functions of the operating system.

    This advisory includes fixes for several security issues:

    iSEC Security Research discovered multiple vulnerabilities in the IGMP     functionality.  These flaws could allow a local user to cause a denial of     service (crash) or potentially gain privileges.  Where multicast     applications are being used on a system, these flaws may also allow remote     users to cause a denial of service.  The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1137 to     this issue.

    iSEC Security Research discovered a flaw in the page fault handler code     that could lead to local users gaining elevated (root) privileges on     multiprocessor machines.  (CAN-2005-0001)

    iSEC Security Research discovered a VMA handling flaw in the uselib(2)     system call of the Linux kernel.  A local user could make use of this     flaw to gain elevated (root) privileges.  (CAN-2004-1235)

    A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T     architecture was discovered.  A local user could use this flaw to write to     privileged IO ports.  (CAN-2005-0204)

    The Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not     properly check the DMA lock, which could allow remote attackers or local     users to cause a denial of service (X Server crash) or possibly modify the     video output. (CAN-2004-1056)

    OGAWA Hirofumi discovered incorrect tables sizes being used in the     filesystem Native Language Support ASCII translation table.  This could     lead to a denial of service (system crash).  (CAN-2005-0177)

    Michael Kerrisk discovered a flaw in the 2.6.9 kernel which allows users to     unlock arbitrary shared memory segments.  This flaw could lead to     applications not behaving as expected.  (CAN-2005-0176)

    Improvements in the POSIX signal and tty standards compliance exposed     a race condition.  This flaw can be triggered accidentally by threaded     applications or deliberately by a malicious user and can result in a     denial of service (crash) or in occasional cases give access to a small     random chunk of kernel memory.  (CAN-2005-0178)

    The PaX team discovered a flaw in mlockall introduced in the 2.6.9 kernel.
    An unprivileged user could use this flaw to cause a denial of service     (CPU and memory consumption or crash).  (CAN-2005-0179)

    Brad Spengler discovered multiple flaws in sg_scsi_ioctl in the 2.6 kernel.
    An unprivileged user may be able to use this flaw to cause a denial of     service (crash) or possibly other actions.  (CAN-2005-0180)

    Kirill Korotaev discovered a missing access check regression in the Red Hat     Enterprise Linux 4 kernel 4GB/4GB split patch.  On systems using the     hugemem kernel, a local unprivileged user could use this flaw to cause a     denial of service (crash).  (CAN-2005-0090)

    A flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch can     allow syscalls to read and write arbitrary kernel memory.  On systems using     the hugemem kernel, a local unprivileged user could use this flaw to gain     privileges.  (CAN-2005-0091)

    An additional flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split     patch was discovered. On x86 systems using the hugemem kernel, a local     unprivileged user may be able to use this flaw to cause a denial of service     (crash).  (CAN-2005-0092)

    All Red Hat Enterprise Linux 4 users are advised to upgrade their     kernels to the packages associated with their machine architectures     and configurations as listed in this erratum.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
21849	CentOS 3 : kernel (CESA-2005:663)	Nessus	CentOS Local Security Checks	medium
20654	Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-38-1)	Nessus	Ubuntu Local Security Checks	critical
19832	RHEL 3 : kernel (RHSA-2005:663)	Nessus	Red Hat Local Security Checks	medium
19543	RHEL 2.1 : kernel (RHSA-2005:529)	Nessus	Red Hat Local Security Checks	high
18598	Mandrake Linux Security Advisory : kernel (MDKSA-2005:110)	Nessus	Mandriva Local Security Checks	high
17183	RHEL 4 : kernel (RHSA-2005:092)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2004-1056

medium

Tenable Plugins

medium

critical

medium

high

high

high