Linux kernel before 2.6.9, when running on the AMD64 and Intel EM64T architectures, allows local users to write to privileged IO ports via the OUTS instruction.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

The following security issues were fixed :

The Vicam USB driver did not use the copy_from_user function to access userspace, crossing security boundaries. (CVE-2004-0075)

The ext3 and jfs code did not properly initialize journal descriptor blocks. A privileged local user could read portions of kernel memory.
(CVE-2004-0177)

The terminal layer did not properly lock line discipline changes or pending IO. An unprivileged local user could read portions of kernel memory, or cause a denial of service (system crash). (CVE-2004-0814)

A race condition was discovered. Local users could use this flaw to read the environment variables of another process that is still spawning via /proc/.../cmdline. (CVE-2004-1058)

A flaw in the execve() syscall handling was discovered, allowing a local user to read setuid ELF binaries that should otherwise be protected by standard permissions. (CVE-2004-1073). Red Hat originally reported this as being fixed by RHSA-2004:549, but the associated fix was missing from that update.

Keith Owens reported a flaw in the Itanium unw_unwind_to_user() function. A local user could use this flaw to cause a denial of service (system crash) on the Itanium architecture. (CVE-2005-0135)

A missing Itanium syscall table entry could allow an unprivileged local user to cause a denial of service (system crash) on the Itanium architecture. (CVE-2005-0137)

A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T architectures was discovered. A local user could use this flaw to access privileged IO ports. (CVE-2005-0204)

A flaw was discovered in the Linux PPP driver. On systems allowing remote users to connect to a server using ppp, a remote client could cause a denial of service (system crash). (CVE-2005-0384)

A flaw in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 was discovered that left a pointer to a freed tty structure. A local user could potentially use this flaw to cause a denial of service (system crash) or possibly gain read or write access to ttys that should normally be prevented. (CVE-2005-0403)

A flaw in fragment queuing was discovered affecting the netfilter subsystem. On systems configured to filter or process network packets (for example those configured to do firewalling), a remote attacker could send a carefully crafted set of fragmented packets to a machine and cause a denial of service (system crash). In order to sucessfully exploit this flaw, the attacker would need to know (or guess) some aspects of the firewall ruleset in place on the target system to be able to craft the right fragmented packets. (CVE-2005-0449)

Missing validation of an epoll_wait() system call parameter could allow a local user to cause a denial of service (system crash) on the IBM S/390 and zSeries architectures. (CVE-2005-0736)

A flaw when freeing a pointer in load_elf_library was discovered. A local user could potentially use this flaw to cause a denial of service (system crash). (CVE-2005-0749)

A flaw was discovered in the bluetooth driver system. On system where the bluetooth modules are loaded, a local user could use this flaw to gain elevated (root) privileges. (CVE-2005-0750)

In addition to the security issues listed above, there was an important fix made to the handling of the msync() system call for a particular case in which the call could return without queuing modified mmap()'ed data for file system update. (BZ 147969)

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures/configurations

Please note that the fix for CVE-2005-0449 required changing the external symbol linkages (kernel module ABI) for the ip_defrag() and ip_ct_gather_frags() functions. Any third-party module using either of these would also need to be fixed.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:092 advisory.

    The Linux kernel handles the basic functions of the operating system.

    This advisory includes fixes for several security issues:

    iSEC Security Research discovered multiple vulnerabilities in the IGMP     functionality.  These flaws could allow a local user to cause a denial of     service (crash) or potentially gain privileges.  Where multicast     applications are being used on a system, these flaws may also allow remote     users to cause a denial of service.  The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1137 to     this issue.

    iSEC Security Research discovered a flaw in the page fault handler code     that could lead to local users gaining elevated (root) privileges on     multiprocessor machines.  (CAN-2005-0001)

    iSEC Security Research discovered a VMA handling flaw in the uselib(2)     system call of the Linux kernel.  A local user could make use of this     flaw to gain elevated (root) privileges.  (CAN-2004-1235)

    A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T     architecture was discovered.  A local user could use this flaw to write to     privileged IO ports.  (CAN-2005-0204)

    The Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not     properly check the DMA lock, which could allow remote attackers or local     users to cause a denial of service (X Server crash) or possibly modify the     video output. (CAN-2004-1056)

    OGAWA Hirofumi discovered incorrect tables sizes being used in the     filesystem Native Language Support ASCII translation table.  This could     lead to a denial of service (system crash).  (CAN-2005-0177)

    Michael Kerrisk discovered a flaw in the 2.6.9 kernel which allows users to     unlock arbitrary shared memory segments.  This flaw could lead to     applications not behaving as expected.  (CAN-2005-0176)

    Improvements in the POSIX signal and tty standards compliance exposed     a race condition.  This flaw can be triggered accidentally by threaded     applications or deliberately by a malicious user and can result in a     denial of service (crash) or in occasional cases give access to a small     random chunk of kernel memory.  (CAN-2005-0178)

    The PaX team discovered a flaw in mlockall introduced in the 2.6.9 kernel.
    An unprivileged user could use this flaw to cause a denial of service     (CPU and memory consumption or crash).  (CAN-2005-0179)

    Brad Spengler discovered multiple flaws in sg_scsi_ioctl in the 2.6 kernel.
    An unprivileged user may be able to use this flaw to cause a denial of     service (crash) or possibly other actions.  (CAN-2005-0180)

    Kirill Korotaev discovered a missing access check regression in the Red Hat     Enterprise Linux 4 kernel 4GB/4GB split patch.  On systems using the     hugemem kernel, a local unprivileged user could use this flaw to cause a     denial of service (crash).  (CAN-2005-0090)

    A flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch can     allow syscalls to read and write arbitrary kernel memory.  On systems using     the hugemem kernel, a local unprivileged user could use this flaw to gain     privileges.  (CAN-2005-0091)

    An additional flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split     patch was discovered. On x86 systems using the hugemem kernel, a local     unprivileged user may be able to use this flaw to cause a denial of service     (crash).  (CAN-2005-0092)

    All Red Hat Enterprise Linux 4 users are advised to upgrade their     kernels to the packages associated with their machine architectures     and configurations as listed in this erratum.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
21923	CentOS 3 : kernel (CESA-2005:293)	Nessus	CentOS Local Security Checks	high
18128	RHEL 3 : kernel (RHSA-2005:293)	Nessus	Red Hat Local Security Checks	high
17183	RHEL 4 : kernel (RHSA-2005:092)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2005-0204

high

Tenable Plugins

high

high

high