Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a denial of service or execute arbitrary code via (1) the ip_mc_source function, which decrements a counter to -1, or (2) the igmp_marksources function, which does not properly validate IGMP message parameters and performs an out-of-bounds read.

CAN-2004-0814 :

Vitaly V. Bursov discovered a Denial of Service vulnerability in the 'serio' code; opening the same tty device twice and doing some particular operations on it caused a kernel panic and/or a system lockup. 

Fixing this vulnerability required a change in the Application Binary Interface (ABI) of the kernel. This means that third-party user installed modules might not work any more with the new kernel, so this fixed kernel got a new ABI version number. You have to recompile and reinstall all third-party modules.

CAN-2004-1016 :

Paul Starzetz discovered a buffer overflow vulnerability in the '__scm_send' function which handles the sending of UDP network packets. A wrong validity check of the cmsghdr structure allowed a local attacker to modify kernel memory, thus causing an endless loop (Denial of Service) or possibly even root privilege escalation.

CAN-2004-1056 :

Thomas Hellstrom discovered a Denial of Service vulnerability in the Direct Rendering Manager (DRM) drivers. Due to an insufficient DMA lock checking, any authorized client could send arbitrary values to the video card, which could cause an X server crash or modification of the video output.

CAN-2004-1058 :

Rob Landley discovered a race condition in the handling of /proc/.../cmdline. Under very rare circumstances an user could read the environment variables of another process that was still spawning.
Environment variables are often used to pass passwords and other private information to other processes.

CAN-2004-1068 :

A race condition was discovered in the handling of AF_UNIX network packets. This reportedly allowed local users to modify arbitrary kernel memory, facilitating privilege escalation, or possibly allowing code execution in the context of the kernel.

CAN-2004-1069 :

Ross Kendall Axe discovered a possible kernel panic (causing a Denial of Service) while sending AF_UNIX network packages if the kernel options CONFIG_SECURITY_NETWORK and CONFIG_SECURITY_SELINUX are enabled. This is not the case in the kernel packages shipped in Warty Warthog; however, if you recompiled the kernel using SELinux, you are affected by this flaw.

CAN-2004-1137 :

Paul Starzetz discovered several flaws in the IGMP handling code. This allowed users to provoke a Denial of Service, read kernel memory, and execute arbitrary code with root privileges. This flaw is also exploitable remotely if an application has bound a multicast socket.

CAN-2004-1151 :

Jeremy Fitzhardinge discovered two buffer overflows in the sys32_ni_syscall() and sys32_vm86_warning() functions. This could possibly be exploited to overwrite kernel memory with attacker-supplied code and cause root privilege escalation. 

This vulnerability only affects the amd64 architecture.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:092 advisory.

    The Linux kernel handles the basic functions of the operating system.

    This advisory includes fixes for several security issues:

    iSEC Security Research discovered multiple vulnerabilities in the IGMP     functionality.  These flaws could allow a local user to cause a denial of     service (crash) or potentially gain privileges.  Where multicast     applications are being used on a system, these flaws may also allow remote     users to cause a denial of service.  The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1137 to     this issue.

    iSEC Security Research discovered a flaw in the page fault handler code     that could lead to local users gaining elevated (root) privileges on     multiprocessor machines.  (CAN-2005-0001)

    iSEC Security Research discovered a VMA handling flaw in the uselib(2)     system call of the Linux kernel.  A local user could make use of this     flaw to gain elevated (root) privileges.  (CAN-2004-1235)

    A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T     architecture was discovered.  A local user could use this flaw to write to     privileged IO ports.  (CAN-2005-0204)

    The Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not     properly check the DMA lock, which could allow remote attackers or local     users to cause a denial of service (X Server crash) or possibly modify the     video output. (CAN-2004-1056)

    OGAWA Hirofumi discovered incorrect tables sizes being used in the     filesystem Native Language Support ASCII translation table.  This could     lead to a denial of service (system crash).  (CAN-2005-0177)

    Michael Kerrisk discovered a flaw in the 2.6.9 kernel which allows users to     unlock arbitrary shared memory segments.  This flaw could lead to     applications not behaving as expected.  (CAN-2005-0176)

    Improvements in the POSIX signal and tty standards compliance exposed     a race condition.  This flaw can be triggered accidentally by threaded     applications or deliberately by a malicious user and can result in a     denial of service (crash) or in occasional cases give access to a small     random chunk of kernel memory.  (CAN-2005-0178)

    The PaX team discovered a flaw in mlockall introduced in the 2.6.9 kernel.
    An unprivileged user could use this flaw to cause a denial of service     (CPU and memory consumption or crash).  (CAN-2005-0179)

    Brad Spengler discovered multiple flaws in sg_scsi_ioctl in the 2.6 kernel.
    An unprivileged user may be able to use this flaw to cause a denial of     service (crash) or possibly other actions.  (CAN-2005-0180)

    Kirill Korotaev discovered a missing access check regression in the Red Hat     Enterprise Linux 4 kernel 4GB/4GB split patch.  On systems using the     hugemem kernel, a local unprivileged user could use this flaw to cause a     denial of service (crash).  (CAN-2005-0090)

    A flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch can     allow syscalls to read and write arbitrary kernel memory.  On systems using     the hugemem kernel, a local unprivileged user could use this flaw to gain     privileges.  (CAN-2005-0091)

    An additional flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split     patch was discovered. On x86 systems using the hugemem kernel, a local     unprivileged user may be able to use this flaw to cause a denial of service     (crash).  (CAN-2005-0092)

    All Red Hat Enterprise Linux 4 users are advised to upgrade their     kernels to the packages associated with their machine architectures     and configurations as listed in this erratum.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is missing the patch for the advisory SUSE-SA:2004:044 (kernel).


Several vulnerabilities have been found and fixed in the Linux kernel.

A number of vulnerabilities are fixed in the 2.4 and 2.6 kernels with this advisory :

  - Multiple race conditions in the terminal layer of 2.4     and 2.6 kernels (prior to 2.6.9) can allow a local     attacker to obtain portions of kernel data or allow     remote attackers to cause a kernel panic by switching     from console to PPP line discipline, then quickly     sending data that is received during the switch     (CVE-2004-0814)

  - Richard Hart found an integer underflow problem in the     iptables firewall logging rules that can allow a remote     attacker to crash the machine by using a specially     crafted IP packet. This is only possible, however, if     firewalling is enabled. The problem only affects 2.6     kernels and was fixed upstream in 2.6.8 (CVE-2004-0816)

  - Stefan Esser found several remote DoS confitions in the     smbfs file system. This could be exploited by a hostile     SMB server (or an attacker injecting packets into the     network) to crash the client systems (CVE-2004-0883 and     CVE-2004-0949)

  - Paul Starzetz and Georgi Guninski reported,     independently, that bad argument handling and bad     integer arithmetics in the IPv4 sendmsg handling of     control messages could lead to a local attacker crashing     the machine. The fixes were done by Herbert Xu     (CVE-2004-1016)

  - Rob Landley discovered a race condition in the handling     of /proc/.../cmdline where, under rare circumstances, a     user could read the environment variables of another     process that was still spawning leading to the potential     disclosure of sensitive information such as passwords     (CVE-2004-1058)

  - Paul Starzetz reported that the missing serialization in     unix_dgram_recvmsg() which was added to kernel 2.4.28     can be used by a local attacker to gain elevated (root)     privileges (CVE-2004-1068)

  - Ross Kendall Axe discovered a possible kernel panic     (DoS) while sending AF_UNIX network packets if certain     SELinux-related kernel options were enabled. By default     the CONFIG_SECURITY_NETWORK and CONFIG_SECURITY_SELINUX     options are not enabled (CVE-2004-1069)

  - Paul Starzetz of isec.pl discovered several issues with     the error handling of the ELF loader routines in the     kernel. The fixes were provided by Chris Wright     (CVE-2004-1070, CVE-2004-1071, CVE-2004-1072,     CVE-2004-1073)

  - It was discovered that hand-crafted a.out binaries could     be used to trigger a local DoS condition in both the 2.4     and 2.6 kernels. The fixes were done by Chris Wright     (CVE-2004-1074)

  - Paul Starzetz found bad handling in the IGMP code which     could lead to a local attacker being able to crash the     machine. The fix was done by Chris Wright     (CVE-2004-1137)

  - Jeremy Fitzhardinge discovered two buffer overflows in     the sys32_ni_syscall() and sys32_vm86_warning()     functions that could be used to overwrite kernel memory     with attacker-supplied code resulting in privilege     escalation (CVE-2004-1151)

  - Paul Starzetz found locally exploitable flaws in the     binary format loader's uselib() function that could be     abused to allow a local user to obtain root privileges     (CVE-2004-1235)

  - Paul Starzetz found an exploitable flaw in the page     fault handler when running on SMP machines     (CVE-2005-0001)

  - A vulnerability in insert_vm_struct could allow a locla     user to trigger BUG() when the user created a large vma     that overlapped with arg pages during exec     (CVE-2005-0003)

  - Paul Starzetz also found a number of vulnerabilities in     the kernel binfmt_elf loader that could lead a local     user to obtain elevated (root) privileges     (isec-0017-binfmt_elf)

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandrakesoft.com/security/kernelupdate

PLEASE NOTE: Mandrakelinux 10.0 users will need to upgrade to the latest module-init-tools package prior to upgrading their kernel.
Likewise, MNF8.2 users will need to upgrade to the latest modutils package prior to upgrading their kernel.

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

Petr Vandrovec discovered a flaw in the 32bit emulation code affecting the Linux 2.4 kernel on the AMD64 architecture. A local attacker could use this flaw to gain privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1144 to this issue.

ISEC security research discovered multiple vulnerabilities in the IGMP functionality which was backported in the Red Hat Enterprise Linux 3 kernels. These flaws could allow a local user to cause a denial of service (crash) or potentially gain privileges. Where multicast applications are being used on a system, these flaws may also allow remote users to cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1137 to this issue.

ISEC security research and Georgi Guninski independently discovered a flaw in the scm_send function in the auxiliary message layer. A local user could create a carefully crafted auxiliary message which could cause a denial of service (system hang). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1016 to this issue.

A floating point information leak was discovered in the ia64 architecture context switch code. A local user could use this flaw to read register values of other processes by setting the MFH bit. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0565 to this issue.

Kirill Korotaev found a flaw in load_elf_binary affecting kernels prior to 2.4.26. A local user could create a carefully crafted binary in such a way that it would cause a denial of service (system crash).
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1234 to this issue.

These packages also fix issues in the io_edgeport driver, and a memory leak in ip_options_get.

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

ID	Name	Product	Family	Severity
20654	Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-38-1)	Nessus	Ubuntu Local Security Checks	critical
17183	RHEL 4 : kernel (RHSA-2005:092)	Nessus	Red Hat Local Security Checks	high
16303	SUSE-SA:2004:044: kernel	Nessus	SuSE Local Security Checks	critical
16259	Mandrake Linux Security Advisory : kernel (MDKSA-2005:022)	Nessus	Mandriva Local Security Checks	critical
16054	RHEL 3 : kernel (RHSA-2004:689)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2004-1137

critical

Tenable Plugins

critical

high

critical

critical

critical