Race condition in the (1) add_key, (2) request_key, and (3) keyctl functions in Linux kernel 2.6.x allows local users to cause a denial of service (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the fourth regular update to Red Hat Enterprise Linux 4.

New features introduced in this update include :

* Device Mapper mirroring support

* IDE diskdump support

* x86, AMD64 and Intel EM64T: Multi-core scheduler support enhancements

* Itanium: perfmon support for Montecito

* much improved support for IBM x460

* AMD PowerNow! patches to support Opteron Rev G

* Vmalloc support > 64MB

The following device drivers have been upgraded to new versions :

ipmi: 33.11 to 33.13 ib_mthca: 0.06 to 0.08 bnx2: 1.4.30 to 1.4.38 bonding: 2.6.1 to 2.6.3 e100: 3.4.8-k2-NAPI to 3.5.10-k2-NAPI e1000:
6.1.16-k3-NAPI to 7.0.33-k2-NAPI sky2: 0.13 to 1.1 tg3: 3.43-rh to 3.52-rh ipw2100: 1.1.0 to git-1.1.4 ipw2200: 1.0.0 to git-1.0.10 3w-9xxx: 2.26.02.001 to 2.26.04.010 ips: 7.10.18 to 7.12.02 iscsi_sfnet: 4:0.1.11-2 to 4:0.1.11-3 lpfc: 0:8.0.16.18 to 0:8.0.16.27 megaraid_sas: 00.00.02.00 to 00.00.02.03-RH1 qla2xxx: 8.01.02-d4 to 8.01.04-d7 qla6312: 8.01.02-d4 to 8.01.04-d7 sata_promise: 1.03 to 1.04 sata_vsc: 1.1 to 1.2 ibmvscsic: 1.5.5 to 1.5.6 ipr: 2.0.11.1 to 2.0.11.2

Added drivers :

dcdbas: 5.6.0-2 sata_mv: 0.6 sata_qstor: 0.05 sata_uli: 0.5 skge: 1.1 stex: 2.9.0.13 pdc_adma: 0.03

This update includes fixes for the security issues :

* a flaw in the USB devio handling of device removal that allowed a local user to cause a denial of service (crash) (CVE-2005-3055, moderate)

* a flaw in the ACL handling of nfsd that allowed a remote user to bypass ACLs for readonly mounted NFS file systems (CVE-2005-3623, moderate)

* a flaw in the netfilter handling that allowed a local user with CAP_NET_ADMIN rights to cause a buffer overflow (CVE-2006-0038, low)

* a flaw in the IBM S/390 and IBM zSeries strnlen_user() function that allowed a local user to cause a denial of service (crash) or to retrieve random kernel data (CVE-2006-0456, important)

* a flaw in the keyctl functions that allowed a local user to cause a denial of service (crash) or to read sensitive kernel memory (CVE-2006-0457, important)

* a flaw in unaligned accesses handling on Itanium processors that allowed a local user to cause a denial of service (crash) (CVE-2006-0742, important)

* a flaw in SELinux ptrace logic that allowed a local user with ptrace permissions to change the tracer SID to a SID of another process (CVE-2006-1052, moderate)

* an info leak on AMD-based x86 and x86_64 systems that allowed a local user to retrieve the floating point exception state of a process run by a different user (CVE-2006-1056, important)

* a flaw in IPv4 packet output handling that allowed a remote user to bypass the zero IP ID countermeasure on systems with a disabled firewall (CVE-2006-1242, low)

* a minor info leak in socket option handling in the network code (CVE-2006-1343, low)

* a flaw in the HB-ACK chunk handling of SCTP that allowed a remote user to cause a denial of service (crash) (CVE-2006-1857, moderate)

* a flaw in the SCTP implementation that allowed a remote user to cause a denial of service (deadlock) (CVE-2006-2275, moderate)

* a flaw in the socket buffer handling that allowed a remote user to cause a denial of service (panic) (CVE-2006-2446, important)

* a flaw in the signal handling access checking on PowerPC that allowed a local user to cause a denial of service (crash) or read arbitrary kernel memory on 64-bit systems (CVE-2006-2448, important)

* a flaw in the netfilter SCTP module when receiving a chunkless packet that allowed a remote user to cause a denial of service (crash) (CVE-2006-2934, important)

There were several bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 4.

A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

sysctl.c in the Linux kernel prior to 2.6.14.1 allows local users to cause a Denial of Service (kernel oops) and possibly execute code by opening an interface file in /proc/sys/net/ipv4/conf/, waiting until the interface is unregistered, then obtaining and modifying function pointers in memory that was used for the ctl_table (CVE-2005-2709).

Multiple vulnerabilities in versions prior to 2.6.13.2 allow local users to cause a DoS (oops from null dereference) via fput in a 32bit ioctl on 64-bit x86 systems or sockfd_put in the 32-bit routing_ioctl function on 64-bit systems (CVE-2005-3044). Note that this was previously partially corrected in MDKSA-2005:235.

Prior to 2.6.14, the kernel's atm module allows local users to cause a DoS (panic) via certain socket calls that produce inconsistent reference counts for loadable protocol modules (CVE-2005-3359).

A race condition in the (1) add_key, (2) request_key, and (3) keyctl functions in the 2.6.x kernel allows local users to cause a DoS (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory (CVE-2006-0457).

Prior to 2.6.15.5, the kernel allows local users to obtain sensitive information via a crafted XFS ftruncate call, which may return stale data (CVE-2006-0554).

Prior to 2.6.15.5, the kernel allows local users to cause a DoS (NFS client panic) via unknown attack vectors related to the use of O_DIRECT (CVE-2006-0555).

Prior to an including kernel 2.6.16, sys_mbind in mempolicy.c does not sanity check the maxnod variable before making certain computations, which has an unknown impact and attack vectors (CVE-2006-0557).

Prior to 2.6.15.5, the kernel allows local users to cause a DoS ('endless recursive fault') via unknown attack vectors related to a 'bad elf entry address' on Intel processors (CVE-2006-0741).

Prior to 2.6.15.6, the die_if_kernel function in the kernel can allow local users to cause a DoS by causing user faults on Itanium systems (CVE-2006-00742).

A race in the signal-handling code which allows a process to become unkillable when the race is triggered was also fixed.

In addition to these security fixes, other fixes have been included such as :

  - add ich8 support

    - libata locking rewrite

    - libata clear ATA_QCFLAG_ACTIVE flag before calling the       completion callback

  - support the Acer Aspire 5xxx/3xxx series in the acerhk     module

    - USB storage: remove info sysfs file as it violates the       sysfs one value per file rule

  - fix OOPS in sysfs_hash_and_remove_file()

    - pl2303 USB driver fixes; makes pl2303HX chip work       correctly

    - fix OOPS in IPMI driver which is probably caused when       trying to use ACPI functions when ACPI was not       properly initialized

  - fix de_thread() racy BUG_ON()

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Please note that users using the LSI Logic 53c1030 dual-channel ultra 320 SCSI card will need to re-create their initrd images manually prior to rebooting in order to fix a bug that prevents booting. A future update will correct this problem. To do this, execute :

# rm /boot/initrd-2.6.12-18mdk.img # mkinitrd /boot/initrd-2.6.12-18mdk.img 2.6.12-18mdk --with-module=mptspi

A flaw was found in the module reference counting for loadable protocol modules of netfilter. By performing particular socket operations, a local attacker could exploit this to crash the kernel.
This flaw only affects Ubuntu 5.10. (CVE-2005-3359)

David Howells noticed a race condition in the add_key(), request_key() and keyctl() functions. By modifying the length of string arguments after the kernel determined their length, but before the kernel copied them into kernel memory, a local attacker could either crash the kernel or read random parts of kernel memory (which could potentially contain sensitive data). (CVE-2006-0457)

An information disclosure vulnerability was discovered in the ftruncate() function for the XFS file system. Under certain conditions, this function could expose random unallocated blocks. A local user could potentially exploit this to recover sensitive data from previously deleted files. (CVE-2006-0554)

A local Denial of Service vulnerability was found in the NFS client module. By opening a file on an NFS share with O_DIRECT and performing some special operations on it, a local attacker could trigger a kernel crash. (CVE-2006-0555)

The ELF binary loader did not sufficiently verify some addresses in the ELF headers. By attempting to execute a specially crafted program, a local attacker could exploit this to trigger a recursive loop of kernel errors, which finally ended in a kernel crash. This only affects the amd64 architecture on Intel processors (EMT64).
(CVE-2006-0741)

The die_if_kernel() function was incorrectly declared as 'does never return' on the ia64 platform. A local attacker could exploit this to crash the kernel. Please note that ia64 is not an officially supported platform. (CVE-2006-0742)

Oleg Nesterov discovered a race condition in the signal handling. On multiprocessor (SMP) machines, a local attacker could exploit this to create many unkillable processes, which could eventually lead to a Denial of Service.

A memory leak was discovered in the handling of files which were opened with the O_DIRECT flag. By repeatedly opening files in a special way, a local attacker could eventually drain all available kernel memory and render the machine unusable. This flaw only affects Ubuntu 4.10.
(http://linux.bkbits.net:8080/linux-2.6/cset%404182a613oVsK0-8eCWpyYFr Uf8rhLA).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
22276	CentOS 4 : kernel (CESA-2006:0575)	Nessus	CentOS Local Security Checks	high
22221	RHEL 4 : kernel (RHSA-2006:0575)	Nessus	Red Hat Local Security Checks	high
21133	Mandrake Linux Security Advisory : kernel (MDKSA-2006:059)	Nessus	Mandriva Local Security Checks	high
21070	Ubuntu 4.10 / 5.04 / 5.10 : linux-source-2.6.8.1/-2.6.10/-2.6.12 vulnerabilities (USN-263-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2006-0457

medium

Tenable Plugins

high

high

high

high