Linux kernel 2.6.16-rc2 and earlier, when running on x86_64 systems with preemption enabled, allows local users to cause a denial of service (oops) via multiple ptrace tasks that perform single steps, which can cause corruption of the DEBUG_STACK stack during the do_debug function call.

A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

Prior to and including 2.6.16-rc2, when running on x86_64 systems with preemption enabled, local users can cause a DoS (oops) via multiple ptrace tasks that perform single steps (CVE-2006-1066).

Prior to 2.6.16, a directory traversal vulnerability in CIFS could allow a local user to escape chroot restrictions for an SMB-mounted filesystem via '..\' sequences (CVE-2006-1863).

Prior to 2.6.16, a directory traversal vulnerability in smbfs could allow a local user to escape chroot restrictions for an SMB-mounted filesystem via '..\' sequences (CVE-2006-1864).

Prior to to 2.6.16.23, SCTP conntrack in netfilter allows remote attackers to cause a DoS (crash) via a packet without any chunks, causing a variable to contain an invalid value that is later used to dereference a pointer (CVE-2006-2934).

The dvd_read_bca function in the DVD handling code assigns the wrong value to a length variable, which could allow local users to execute arbitrary code via a crafted USB storage device that triggers a buffer overflow (CVE-2006-2935).

Prior to 2.6.17, the ftdi_sio driver could allow local users to cause a DoS (memory consumption) by writing more data to the serial port than the hardware can handle, causing the data to be queued (CVE-2006-2936).

The 2.6 kernel, when using both NFS and EXT3, allowed remote attackers to cause a DoS (file system panic) via a crafted UDP packet with a V2 lookup procedure that specifies a bad file handle (inode number), triggering an error and causing an exported directory to be remounted read-only (CVE-2006-3468).

The 2.6 kernel's SCTP was found to cause system crashes and allow for the possibility of local privilege escalation due to a bug in the get_user_iov_size() function that doesn't properly handle overflow when calculating the length of iovec (CVE-2006-3745).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - added support for new devices: o Testo products in     usb-serial o ATI SB600 IDE o ULI M-1573 south Bridge o     PATA and SATA support for nVidia MCP55, MCP61, MCP65,     and AMD CS5536 o Asus W6A motherboard in snd-hda-intel o     bcm 5780

  - fixed ip_gre module unload OOPS

    - enabled opti621 driver for x86 and x86_64

    - fixed a local DoS introduced by an imcomplete fix for       CVE-2006-2445

    - updated to Xen 3.0.1 with selected fixes

    - enable hugetlbfs

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2005-0449     An error in the skb_checksum_help() function from the     netfilter framework has been discovered that allows the     bypass of packet filter rules or a denial of service     attack.

  - CVE-2005-2457     Tim Yamin discovered that insufficient input validation     in the zisofs driver for compressed ISO file systems     allows a denial of service attack through maliciously     crafted ISO images.

  - CVE-2005-2490     A buffer overflow in the sendmsg() function allows local     users to execute arbitrary code.

  - CVE-2005-2555     Herbert Xu discovered that the setsockopt() function was     not restricted to users/processes with the CAP_NET_ADMIN     capability. This allows attackers to manipulate IPSEC     policies or initiate a denial of service attack. 

  - CVE-2005-2709     Al Viro discovered a race condition in the /proc     handling of network devices. A (local) attacker could     exploit the stale reference after interface shutdown to     cause a denial of service or possibly execute code in     kernel mode.

  - CVE-2005-2800     Jan Blunck discovered that repeated failed reads of     /proc/scsi/sg/devices leak memory, which allows a denial     of service attack.

  - CVE-2005-2973     Tetsuo Handa discovered that the udp_v6_get_port()     function from the IPv6 code can be forced into an     endless loop, which allows a denial of service attack.

  - CVE-2005-3044     Vasiliy Averin discovered that the reference counters     from sockfd_put() and fput() can be forced into     overlapping, which allows a denial of service attack     through a NULL pointer dereference.

  - CVE-2005-3053     Eric Dumazet discovered that the set_mempolicy() system     call accepts a negative value for its first argument,     which triggers a BUG() assert. This allows a denial of     service attack.

  - CVE-2005-3055     Harald Welte discovered that if a process issues a USB     Request Block (URB) to a device and terminates before     the URB completes, a stale pointer would be     dereferenced. This could be used to trigger a denial of     service attack.

  - CVE-2005-3180     Pavel Roskin discovered that the driver for Orinoco     wireless cards clears its buffers insufficiently. This     could leak sensitive information into user space.

  - CVE-2005-3181     Robert Derr discovered that the audit subsystem uses an     incorrect function to free memory, which allows a denial     of service attack.

  - CVE-2005-3257     Rudolf Polzer discovered that the kernel improperly     restricts access to the KDSKBSENT ioctl, which can     possibly lead to privilege escalation.

  - CVE-2005-3356     Doug Chapman discovered that the mq_open syscall can be     tricked into decrementing an internal counter twice,     which allows a denial of service attack through a kernel     panic.

  - CVE-2005-3358     Doug Chapman discovered that passing a zero bitmask to     the set_mempolicy() system call leads to a kernel panic,     which allows a denial of service attack.

  - CVE-2005-3783     The ptrace code using CLONE_THREAD didn't use the thread     group ID to determine whether the caller is attaching to     itself, which allows a denial of service attack.

  - CVE-2005-3784     The auto-reaping of child processes functionality     included ptraced-attached processes, which allows denial     of service through dangling references.

  - CVE-2005-3806     Yen Zheng discovered that the IPv6 flow label code     modified an incorrect variable, which could lead to     memory corruption and denial of service.

  - CVE-2005-3847     It was discovered that a threaded real-time process,     which is currently dumping core can be forced into a     dead-lock situation by sending it a SIGKILL signal,     which allows a denial of service attack. 

  - CVE-2005-3848     Ollie Wild discovered a memory leak in the     icmp_push_reply() function, which allows denial of     service through memory consumption.

  - CVE-2005-3857     Chris Wright discovered that excessive allocation of     broken file lock leases in the VFS layer can exhaust     memory and fill up the system logging, which allows     denial of service.

  - CVE-2005-3858     Patrick McHardy discovered a memory leak in the     ip6_input_finish() function from the IPv6 code, which     allows denial of service.

  - CVE-2005-4605     Karl Janmar discovered that a signedness error in the     procfs code can be exploited to read kernel memory,     which may disclose sensitive information.

  - CVE-2005-4618     Yi Ying discovered that sysctl does not properly enforce     the size of a buffer, which allows a denial of service     attack.

  - CVE-2006-0095     Stefan Rompf discovered that dm_crypt does not clear an     internal struct before freeing it, which might disclose     sensitive information.

  - CVE-2006-0096     It was discovered that the SDLA driver's capability     checks were too lax for firmware upgrades.

  - CVE-2006-0482     Ludovic Courtes discovered that get_compat_timespec()     performs insufficient input sanitizing, which allows a     local denial of service attack.

  - CVE-2006-1066     It was discovered that ptrace() on the ia64 architecture     allows a local denial of service attack, when preemption     is enabled.

The sys_mbind() function did not properly verify the validity of the 'maxnod' argument. A local user could exploit this to trigger a buffer overflow, which caused a kernel crash. (CVE-2006-0557)

The SELinux module did not correctly handle the tracer SID when a process was already being traced. A local attacker could exploit this to cause a kernel crash. (CVE-2006-1052)

Al Viro discovered a local Denial of Service in the sysfs write buffer handling. By writing a block with a length exactly equal to the processor's page size to any writable file in /sys, a local attacker could cause a kernel crash. (CVE-2006-1055)

John Blackwood discovered a race condition with single-step debugging multiple processes at the same time. A local attacker could exploit this to crash the system. This only affects the amd64 platform.
(CVE-2006-1066)

Marco Ivaldi discovered a flaw in the handling of the ID number of IP packets. This number was incremented after receiving unsolicited TCP SYN-ACK packets. A remote attacker could exploit this to conduct port scans with the 'Idle scan' method (nmap -sI), which bypassed intended port scan protections. (CVE-2006-1242)

Pavel Kankovsky discovered that the getsockopt() function, when called with an SO_ORIGINAL_DST argument, does not properly clear the returned structure, so that a random piece of kernel memory is exposed to the user. This could potentially reveal sensitive data like passwords or encryption keys. (CVE-2006-1343)

A buffer overflow was discovered in the USB Gadget RNDIS implementation. While creating a reply message, the driver did not allocate enough memory for the reply structure. A remote attacker could exploit this to cause a kernel crash. (CVE-2006-1368)

Alexandra Kossovsky discovered an invalid memory access in the ip_route_input() function. By using the 'ip' command in a particular way to retrieve multicast routes, a local attacker could exploit this to crash the kernel. (CVE-2006-1525).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
23897	Mandrake Linux Security Advisory : kernel (MDKSA-2006:151)	Nessus	Mandriva Local Security Checks	high
22559	Debian DSA-1017-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
21375	Ubuntu 5.04 / 5.10 : linux-source-2.6.10, linux-source-2.6.12 vulnerabilities (USN-281-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2006-1066

medium

Tenable Plugins

high

critical

critical