Race condition in Linux kernel 2.6 allows local users to read the environment variables of another process that is still spawning via /proc/.../cmdline.

The original update lacked recompiled ALSA modules against the new  kernel ABI. Furthermore, kernel-latest-2.4-sparc now correctly  depends on the updated packages. For completeness we're providing the  original problem description :

  Several local and remote vulnerabilities have been discovered in the   Linux kernel that may lead to a denial of service or the execution   of arbitrary code. The Common Vulnerabilities and Exposures project   identifies the following problems :

    - CVE-2004-0887       Martin Schwidefsky discovered that the privileged       instruction SACF (Set Address Space Control Fast) on       the S/390 platform is not handled properly, allowing       for a local user to gain root privileges.

    - CVE-2004-1058       A race condition allows for a local user to read the       environment variables of another process that is still       spawning through /proc/.../cmdline.

    - CVE-2004-2607       A numeric casting discrepancy in sdla_xfer allows       local users to read portions of kernel memory via a       large len argument which is received as an int but       cast to a short, preventing read loop from filling a       buffer.

    - CVE-2005-0449       An error in the skb_checksum_help() function from the       netfilter framework has been discovered that allows       the bypass of packet filter rules or a denial of       service attack.

    - CVE-2005-1761       A vulnerability in the ptrace subsystem of the IA-64       architecture can allow local attackers to overwrite       kernel memory and crash the kernel.

    - CVE-2005-2457       Tim Yamin discovered that insufficient input       validation in the compressed ISO file system (zisofs)       allows a denial of service attack through maliciously       crafted ISO images.

    - CVE-2005-2555       Herbert Xu discovered that the setsockopt() function       was not restricted to users/processes with the       CAP_NET_ADMIN capability. This allows attackers to       manipulate IPSEC policies or initiate a denial of       service attack.

    - CVE-2005-2709       Al Viro discovered a race condition in the /proc       handling of network devices. A (local) attacker could       exploit the stale reference after interface shutdown       to cause a denial of service or possibly execute code       in kernel mode.

    - CVE-2005-2973       Tetsuo Handa discovered that the udp_v6_get_port()       function from the IPv6 code can be forced into an       endless loop, which allows a denial of service attack.

    - CVE-2005-3257       Rudolf Polzer discovered that the kernel improperly       restricts access to the KDSKBSENT ioctl, which can       possibly lead to privilege escalation.

    - CVE-2005-3783       The ptrace code using CLONE_THREAD didn't use the       thread group ID to determine whether the caller is       attaching to itself, which allows a denial of service       attack.

    - CVE-2005-3806       Yen Zheng discovered that the IPv6 flow label code       modified an incorrect variable, which could lead to       memory corruption and denial of service.

    - CVE-2005-3848       Ollie Wild discovered a memory leak in the       icmp_push_reply() function, which allows denial of       service through memory consumption.

    - CVE-2005-3857       Chris Wright discovered that excessive allocation of       broken file lock leases in the VFS layer can exhaust       memory and fill up the system logging, which allows       denial of service.

    - CVE-2005-3858       Patrick McHardy discovered a memory leak in the       ip6_input_finish() function from the IPv6 code, which       allows denial of service.

    - CVE-2005-4618       Yi Ying discovered that sysctl does not properly       enforce the size of a buffer, which allows a denial of       service attack.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

The following security issues were fixed :

The Vicam USB driver did not use the copy_from_user function to access userspace, crossing security boundaries. (CVE-2004-0075)

The ext3 and jfs code did not properly initialize journal descriptor blocks. A privileged local user could read portions of kernel memory.
(CVE-2004-0177)

The terminal layer did not properly lock line discipline changes or pending IO. An unprivileged local user could read portions of kernel memory, or cause a denial of service (system crash). (CVE-2004-0814)

A race condition was discovered. Local users could use this flaw to read the environment variables of another process that is still spawning via /proc/.../cmdline. (CVE-2004-1058)

A flaw in the execve() syscall handling was discovered, allowing a local user to read setuid ELF binaries that should otherwise be protected by standard permissions. (CVE-2004-1073). Red Hat originally reported this as being fixed by RHSA-2004:549, but the associated fix was missing from that update.

Keith Owens reported a flaw in the Itanium unw_unwind_to_user() function. A local user could use this flaw to cause a denial of service (system crash) on the Itanium architecture. (CVE-2005-0135)

A missing Itanium syscall table entry could allow an unprivileged local user to cause a denial of service (system crash) on the Itanium architecture. (CVE-2005-0137)

A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T architectures was discovered. A local user could use this flaw to access privileged IO ports. (CVE-2005-0204)

A flaw was discovered in the Linux PPP driver. On systems allowing remote users to connect to a server using ppp, a remote client could cause a denial of service (system crash). (CVE-2005-0384)

A flaw in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 was discovered that left a pointer to a freed tty structure. A local user could potentially use this flaw to cause a denial of service (system crash) or possibly gain read or write access to ttys that should normally be prevented. (CVE-2005-0403)

A flaw in fragment queuing was discovered affecting the netfilter subsystem. On systems configured to filter or process network packets (for example those configured to do firewalling), a remote attacker could send a carefully crafted set of fragmented packets to a machine and cause a denial of service (system crash). In order to sucessfully exploit this flaw, the attacker would need to know (or guess) some aspects of the firewall ruleset in place on the target system to be able to craft the right fragmented packets. (CVE-2005-0449)

Missing validation of an epoll_wait() system call parameter could allow a local user to cause a denial of service (system crash) on the IBM S/390 and zSeries architectures. (CVE-2005-0736)

A flaw when freeing a pointer in load_elf_library was discovered. A local user could potentially use this flaw to cause a denial of service (system crash). (CVE-2005-0749)

A flaw was discovered in the bluetooth driver system. On system where the bluetooth modules are loaded, a local user could use this flaw to gain elevated (root) privileges. (CVE-2005-0750)

In addition to the security issues listed above, there was an important fix made to the handling of the msync() system call for a particular case in which the call could return without queuing modified mmap()'ed data for file system update. (BZ 147969)

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures/configurations

Please note that the fix for CVE-2005-0449 required changing the external symbol linkages (kernel module ABI) for the ip_defrag() and ip_ct_gather_frags() functions. Any third-party module using either of these would also need to be fixed.

Updated kernel packages that fix a number of security issues as well as other bugs are now available for Red Hat Enterprise Linux 2.1 (32 bit architectures)

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

  - a flaw in network IGMP processing that a allowed a     remote user on the local network to cause a denial of     service (disabling of multicast reports) if the system     is running multicast applications (CVE-2002-2185,     moderate)

  - a race condition that allowed local users to read the     environment variables of another process (CVE-2004-1058,     low)

  - a flaw in the open_exec function of execve that allowed     a local user to read setuid ELF binaries that should     otherwise be protected by standard permissions.
    (CVE-2004-1073, moderate). Red Hat originally reported     this flaw as being fixed by RHSA-2004:504, but a patch     for this issue was missing from that update.

  - a flaw in the coda module that allowed a local user to     cause a denial of service (crash) or possibly gain     privileges (CVE-2005-0124, moderate)

  - a potential leak of kernel data from ext2 file system     handling (CVE-2005-0400, low)

  - flaws in ISO-9660 file system handling that allowed the     mounting of an invalid image on a CD-ROM to cause a     denial of service (crash) or potentially execute     arbitrary code (CVE-2005-0815, moderate)

  - a flaw in gzip/zlib handling internal to the kernel that     may allow a local user to cause a denial of service     (crash) (CVE-2005-2458, low)

  - a flaw in procfs handling during unloading of modules     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2709, moderate)

  - a flaw in IPv6 network UDP port hash table lookups that     allowed a local user to cause a denial of service (hang)     (CVE-2005-2973, important)

  - a network buffer info leak using the orinoco driver that     allowed a remote user to possibly view uninitialized     data (CVE-2005-3180, important)

  - a flaw in IPv4 network TCP and UDP netfilter handling     that allowed a local user to cause a denial of service     (crash) (CVE-2005-3275, important)

  - a flaw in the IPv6 flowlabel code that allowed a local     user to cause a denial of service (crash)     (CVE-2005-3806, important)

The following bugs were also addressed :

  - Handle set_brk() errors in binfmt_elf/aout

  - Correct error handling in shmem_ioctl

  - Correct scsi error return

  - Fix netdump time keeping bug

  - Fix netdump link-down freeze

  - Fix FAT fs deadlock

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

CAN-2004-0814 :

Vitaly V. Bursov discovered a Denial of Service vulnerability in the 'serio' code; opening the same tty device twice and doing some particular operations on it caused a kernel panic and/or a system lockup. 

Fixing this vulnerability required a change in the Application Binary Interface (ABI) of the kernel. This means that third-party user installed modules might not work any more with the new kernel, so this fixed kernel got a new ABI version number. You have to recompile and reinstall all third-party modules.

CAN-2004-1016 :

Paul Starzetz discovered a buffer overflow vulnerability in the '__scm_send' function which handles the sending of UDP network packets. A wrong validity check of the cmsghdr structure allowed a local attacker to modify kernel memory, thus causing an endless loop (Denial of Service) or possibly even root privilege escalation.

CAN-2004-1056 :

Thomas Hellstrom discovered a Denial of Service vulnerability in the Direct Rendering Manager (DRM) drivers. Due to an insufficient DMA lock checking, any authorized client could send arbitrary values to the video card, which could cause an X server crash or modification of the video output.

CAN-2004-1058 :

Rob Landley discovered a race condition in the handling of /proc/.../cmdline. Under very rare circumstances an user could read the environment variables of another process that was still spawning.
Environment variables are often used to pass passwords and other private information to other processes.

CAN-2004-1068 :

A race condition was discovered in the handling of AF_UNIX network packets. This reportedly allowed local users to modify arbitrary kernel memory, facilitating privilege escalation, or possibly allowing code execution in the context of the kernel.

CAN-2004-1069 :

Ross Kendall Axe discovered a possible kernel panic (causing a Denial of Service) while sending AF_UNIX network packages if the kernel options CONFIG_SECURITY_NETWORK and CONFIG_SECURITY_SELINUX are enabled. This is not the case in the kernel packages shipped in Warty Warthog; however, if you recompiled the kernel using SELinux, you are affected by this flaw.

CAN-2004-1137 :

Paul Starzetz discovered several flaws in the IGMP handling code. This allowed users to provoke a Denial of Service, read kernel memory, and execute arbitrary code with root privileges. This flaw is also exploitable remotely if an application has bound a multicast socket.

CAN-2004-1151 :

Jeremy Fitzhardinge discovered two buffer overflows in the sys32_ni_syscall() and sys32_vm86_warning() functions. This could possibly be exploited to overwrite kernel memory with attacker-supplied code and cause root privilege escalation. 

This vulnerability only affects the amd64 architecture.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A number of vulnerabilities are fixed in the 2.4 and 2.6 kernels with this advisory :

  - Multiple race conditions in the terminal layer of 2.4     and 2.6 kernels (prior to 2.6.9) can allow a local     attacker to obtain portions of kernel data or allow     remote attackers to cause a kernel panic by switching     from console to PPP line discipline, then quickly     sending data that is received during the switch     (CVE-2004-0814)

  - Richard Hart found an integer underflow problem in the     iptables firewall logging rules that can allow a remote     attacker to crash the machine by using a specially     crafted IP packet. This is only possible, however, if     firewalling is enabled. The problem only affects 2.6     kernels and was fixed upstream in 2.6.8 (CVE-2004-0816)

  - Stefan Esser found several remote DoS confitions in the     smbfs file system. This could be exploited by a hostile     SMB server (or an attacker injecting packets into the     network) to crash the client systems (CVE-2004-0883 and     CVE-2004-0949)

  - Paul Starzetz and Georgi Guninski reported,     independently, that bad argument handling and bad     integer arithmetics in the IPv4 sendmsg handling of     control messages could lead to a local attacker crashing     the machine. The fixes were done by Herbert Xu     (CVE-2004-1016)

  - Rob Landley discovered a race condition in the handling     of /proc/.../cmdline where, under rare circumstances, a     user could read the environment variables of another     process that was still spawning leading to the potential     disclosure of sensitive information such as passwords     (CVE-2004-1058)

  - Paul Starzetz reported that the missing serialization in     unix_dgram_recvmsg() which was added to kernel 2.4.28     can be used by a local attacker to gain elevated (root)     privileges (CVE-2004-1068)

  - Ross Kendall Axe discovered a possible kernel panic     (DoS) while sending AF_UNIX network packets if certain     SELinux-related kernel options were enabled. By default     the CONFIG_SECURITY_NETWORK and CONFIG_SECURITY_SELINUX     options are not enabled (CVE-2004-1069)

  - Paul Starzetz of isec.pl discovered several issues with     the error handling of the ELF loader routines in the     kernel. The fixes were provided by Chris Wright     (CVE-2004-1070, CVE-2004-1071, CVE-2004-1072,     CVE-2004-1073)

  - It was discovered that hand-crafted a.out binaries could     be used to trigger a local DoS condition in both the 2.4     and 2.6 kernels. The fixes were done by Chris Wright     (CVE-2004-1074)

  - Paul Starzetz found bad handling in the IGMP code which     could lead to a local attacker being able to crash the     machine. The fix was done by Chris Wright     (CVE-2004-1137)

  - Jeremy Fitzhardinge discovered two buffer overflows in     the sys32_ni_syscall() and sys32_vm86_warning()     functions that could be used to overwrite kernel memory     with attacker-supplied code resulting in privilege     escalation (CVE-2004-1151)

  - Paul Starzetz found locally exploitable flaws in the     binary format loader's uselib() function that could be     abused to allow a local user to obtain root privileges     (CVE-2004-1235)

  - Paul Starzetz found an exploitable flaw in the page     fault handler when running on SMP machines     (CVE-2005-0001)

  - A vulnerability in insert_vm_struct could allow a locla     user to trigger BUG() when the user created a large vma     that overlapped with arg pages during exec     (CVE-2005-0003)

  - Paul Starzetz also found a number of vulnerabilities in     the kernel binfmt_elf loader that could lead a local     user to obtain elevated (root) privileges     (isec-0017-binfmt_elf)

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandrakesoft.com/security/kernelupdate

PLEASE NOTE: Mandrakelinux 10.0 users will need to upgrade to the latest module-init-tools package prior to upgrading their kernel.
Likewise, MNF8.2 users will need to upgrade to the latest modutils package prior to upgrading their kernel.

The remote host is affected by the vulnerability described in GLSA-200408-24 (Linux Kernel: Multiple information leaks)

    The Linux kernel allows a local attacker to obtain sensitive kernel     information by gaining access to kernel memory via several leaks in the     /proc interfaces. These vulnerabilities exist in various drivers which     make up a working Linux kernel, some of which are present across all     architectures and configurations.
    CAN-2004-0415 deals with addressing invalid 32 to 64 bit conversions in     the kernel, as well as insecure direct access to file offset pointers     in kernel code which can be modified by the open(...), lseek(...) and     other core system I/O functions by an attacker.
    CAN-2004-0685 deals with certain USB drivers using uninitialized     structures and then using the copy_to_user(...) kernel call to copy     these structures. This may leak uninitialized kernel memory, which can     contain sensitive information from user applications.
    Finally, a race condition with the /proc/.../cmdline node was found,     allowing environment variables to be read while the process was still     spawning. If the race is won, environment variables of the process,     which might not be owned by the attacker, can be read.
  Impact :

    These vulnerabilities allow a local unprivileged attacker to access     segments of kernel memory or environment variables which may contain     sensitive information. Kernel memory may contain passwords, data     transferred between processes and any memory which applications did not     clear upon exiting as well as the kernel cache and kernel buffers.
    This information may be used to read sensitive data, open other attack     vectors for further exploitation or cause a Denial of Service if the     attacker can gain superuser access via the leaked information.
  Workaround :

    There is no temporary workaround for any of these information leaks     other than totally disabling /proc support - otherwise, a kernel     upgrade is required. A list of unaffected kernels is provided along     with this announcement.

Updated kernel packages that fix several security issues in the Red
Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security
impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

The following security issues were fixed :

The Vicam USB driver did not use the copy_from_user function to access
userspace, crossing security boundaries. (CVE-2004-0075)

The ext3 and jfs code did not properly initialize journal descriptor
blocks. A privileged local user could read portions of kernel memory.
(CVE-2004-0177)

The terminal layer did not properly lock line discipline changes or
pending IO. An unprivileged local user could read portions of kernel
memory, or cause a denial of service (system crash). (CVE-2004-0814)

A race condition was discovered. Local users could use this flaw to
read the environment variables of another process that is still
spawning via /proc/.../cmdline. (CVE-2004-1058)

A flaw in the execve() syscall handling was discovered, allowing a
local user to read setuid ELF binaries that should otherwise be
protected by standard permissions. (CVE-2004-1073). Red Hat originally
reported this as being fixed by RHSA-2004:549, but the associated fix
was missing from that update.

Keith Owens reported a flaw in the Itanium unw_unwind_to_user()
function. A local user could use this flaw to cause a denial of
service (system crash) on the Itanium architecture. (CVE-2005-0135)

A missing Itanium syscall table entry could allow an unprivileged
local user to cause a denial of service (system crash) on the Itanium
architecture. (CVE-2005-0137)

A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T
architectures was discovered. A local user could use this flaw to
access privileged IO ports. (CVE-2005-0204)

A flaw was discovered in the Linux PPP driver. On systems allowing
remote users to connect to a server using ppp, a remote client could
cause a denial of service (system crash). (CVE-2005-0384)

A flaw in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3
was discovered that left a pointer to a freed tty structure. A local
user could potentially use this flaw to cause a denial of service
(system crash) or possibly gain read or write access to ttys that
should normally be prevented. (CVE-2005-0403)

A flaw in fragment queuing was discovered affecting the netfilter
subsystem. On systems configured to filter or process network packets
(for example those configured to do firewalling), a remote attacker
could send a carefully crafted set of fragmented packets to a machine
and cause a denial of service (system crash). In order to sucessfully
exploit this flaw, the attacker would need to know (or guess) some
aspects of the firewall ruleset in place on the target system to be
able to craft the right fragmented packets. (CVE-2005-0449)

Missing validation of an epoll_wait() system call parameter could
allow a local user to cause a denial of service (system crash) on the
IBM S/390 and zSeries architectures. (CVE-2005-0736)

A flaw when freeing a pointer in load_elf_library was discovered. A
local user could potentially use this flaw to cause a denial of
service (system crash). (CVE-2005-0749)

A flaw was discovered in the bluetooth driver system. On system where
the bluetooth modules are loaded, a local user could use this flaw to
gain elevated (root) privileges. (CVE-2005-0750)

In addition to the security issues listed above, there was an
important fix made to the handling of the msync() system call for a
particular case in which the call could return without queuing
modified mmap()'ed data for file system update. (BZ 147969)

Note: The kernel-unsupported package contains various drivers and
modules that are unsupported and therefore might contain security
problems that have not been addressed.

Red Hat Enterprise Linux 3 users are advised to upgrade their kernels
to the packages associated with their machine
architectures/configurations

Please note that the fix for CVE-2005-0449 required changing the
external symbol linkages (kernel module ABI) for the ip_defrag() and
ip_ct_gather_frags() functions. Any third-party module using either of
these would also need to be fixed.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2005-293.

ID	Name	Product	Family	Severity
22560	Debian DSA-1018-2 : kernel-source-2.4.27 - several vulnerabilities	Nessus	Debian Local Security Checks	high
21923	CentOS 3 : kernel (CESA-2005:293)	Nessus	CentOS Local Security Checks	high
20855	RHEL 2.1 : kernel (RHSA-2006:0191)	Nessus	Red Hat Local Security Checks	medium
20654	Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-38-1)	Nessus	Ubuntu Local Security Checks	critical
18128	RHEL 3 : kernel (RHSA-2005:293)	Nessus	Red Hat Local Security Checks	high
16259	Mandrake Linux Security Advisory : kernel (MDKSA-2005:022)	Nessus	Mandriva Local Security Checks	critical
14580	GLSA-200408-24 : Linux Kernel: Multiple information leaks	Nessus	Gentoo Local Security Checks	medium
801608	Red Hat 2005-293 Security Check	Log Correlation Engine	Generic	high
801398	CentOS RHSA-2005-293 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2004-1058

medium

Tenable Plugins

high

high

medium

critical

high

critical

medium

high

high