Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service (data corruption) and possibly gain privileges via unknown vectors.

From Red Hat Security Advisory 2007:0014 :

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the get_fdb_entries function of the network bridging support that allowed a local user to cause a denial of service (crash) or allow a potential privilege escalation (CVE-2006-5751, Important)

* an information leak in the _block_prepare_write function that allowed a local user to read kernel memory (CVE-2006-4813, Important)

* an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read kernel memory (CVE-2006-5174, Important)

* a flaw in the handling of /proc/net/ip6_flowlabel that allowed a local user to cause a denial of service (infinite loop) (CVE-2006-5619, Important)

* a flaw in the AIO handling that allowed a local user to cause a denial of service (panic) (CVE-2006-5754, Important)

* a race condition in the mincore system core that allowed a local user to cause a denial of service (system hang) (CVE-2006-4814, Moderate)

* a flaw in the ELF handling on ia64 and sparc architectures which triggered a cross-region memory mapping and allowed a local user to cause a denial of service (CVE-2006-4538, Moderate)

* a flaw in the dev_queue_xmit function of the network subsystem that allowed a local user to cause a denial of service (data corruption) (CVE-2006-6535, Moderate)

* a flaw in the handling of CAPI messages over Bluetooth that allowed a remote system to cause a denial of service or potential code execution. This flaw is only exploitable if a privileged user establishes a connection to a malicious remote device (CVE-2006-6106, Moderate)

* a flaw in the listxattr system call that allowed a local user to cause a denial of service (data corruption) or potential privilege escalation. To successfully exploit this flaw the existence of a bad inode is required first (CVE-2006-5753, Moderate)

* a flaw in the __find_get_block_slow function that allowed a local privileged user to cause a denial of service (CVE-2006-5757, Low)

* various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service (CVE-2006-5823, CVE-2006-6053, CVE-2006-6054, CVE-2006-6056, Low)

In addition to the security issues described above, fixes for the following bugs were included :

* initialization error of the tg3 driver with some BCM5703x network card

* a memory leak in the audit subsystem

* x86_64 nmi watchdog timeout is too short

* ext2/3 directory reads fail intermittently

Red Hat would like to thank Dmitriy Monakhov and Kostantin Khorenko for reporting issues fixed in this erratum.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

This kernel update fixes the following security problems :

  - The ftdi_sio driver allowed local users to cause a     denial of service (memory consumption) by writing more     data to the serial port than the hardware can handle,     which causes the data to be queued. This requires this     driver to be loaded, which only happens if such a device     is plugged in. (CVE-2006-2936)

  - A deadlock in mincore that could be caused by local     attackers was fixed. (CVE-2006-4814)

  - Multiple buffer overflows in the cmtp_recv_interopmsg     function in the Bluetooth driver     (net/bluetooth/cmtp/capi.c) in the Linux kernel allowed     remote attackers to cause a denial of service (crash)     and possibly execute arbitrary code via CAPI messages     with a large value for the length of the (1) manu     (manufacturer) or (2) serial (serial number) field.
    (CVE-2006-6106)

  - The isdn_ppp_ccp_reset_alloc_state function in     drivers/isdn/isdn_ppp.c in the Linux kernel does not     call the init_timer function for the ISDN PPP CCP reset     state timer, which has unknown attack vectors and     results in a system crash. (CVE-2006-5749)

  - Unspecified vulnerability in the listxattr system call     in Linux kernel, when a 'bad inode' is present, allows     local users to cause a denial of service (data     corruption) and possibly gain privileges.
    (CVE-2006-5753)

  - A remote denial of service problem on NFSv2 mounts with     ACL enabled was fixed.

and the following non security bugs :

  - patches.xen/xen-x86_64-agp: add missing header [#222174]     [#224170]

  - patches.fixes/dcache-race-during-umount: Fix dcache race     during umount [#136310] [#151638]

  - patches.arch/x86_64-kdump-bootmem-fix: Handle     reserve_bootmem_generic beyond end_pfn [#179093]

  - patches.fixes/rpc-no-paranoia: Ratelimit some messages     from SUNRPC servers (nfsd) [#190178]

  - patches.fixes/nfs-lock-warning-removal: Remove useless     warning about VFS being out of sync with lock manager     [#192813]

  - patches.fixes/acpiphp-fix-ibm-hotplug-oops.patch: Fix     acpiphp oops when hotplug is performed on an IBM 8864/6     [#203923]

  - patches.fixes/oom-child-kill-fix.patch: OOM: prevent     OOM_DISABLE tasks from being killed when out of memory     [#211859]

  - patches.drivers/alsa-control-warning-fix: Fix bogus     kernel error messages from ALSA control.c [#212484]

  - patches.fixes/init_isolcpus.diff: sched: force     /sbin/init off isolated cpus [#216799]

  - patches.fixes/ocfs2-network-send-lock.diff: fix     regression that caused the idle timer not to be reset     during packet processing [#216912]

  - patches.fixes/workqueue_cpu_deadlock-fix.diff: [PATCH]     workqueue: fix deadlock when workqueue func takes the     workqueue mutex [#217222]

  - patches.drivers/open-iscsi-handle-check-condition: Host     lockups then Reboots when an iSCSI session is attempted     [#219968]

  - patches.arch/ia64-fp-rate-limit: [ia64] Reduce overhead     of FP exception logging messages. [#223314]

  - patches.arch/ia64-sn2-bte_unaligned_copy-overrun: [ia64]     Avert transfer of extra cache line by     bte_unaligned_copy(). [#224166]

  - patches.fixes/natsemi-long-cable-fix: natsemi: make     cable length magic configurable [#225091]

  - patches.fixes/sunrpc-randomize-xids: SUNRPC: NFS_ROOT     always uses the same XIDs [#225251]

  - patches.drivers/usb-funsoft-hwinfo.patch: USB: fix     hwinfo issue with funsoft driver [#226661]     patches.fixes/fix-ext3-kmalloc-flags-with-journal-handle     .diff: ext3: use GFP_NOFS for allocations while holding     journal handle [#228694]

  - patches.fixes/nfs-tcp-reconnect-on-error: RPC: Ensure     that we disconnect TCP socket when client requests error     out [#230210]

  - patches.fixes/sunrpc-listen-race: knfsd: Fix race that     can disable NFS server. [#230287]     patches.drivers/pci-quirk-1k-i-o-space-iobl_adr-fix-on-p     64h2.patch: PCI Quirk: 1k I/O space IOBL_ADR fix on     P64H2 [#230365]

  - patches.drivers/ide-generic-fix-JMB-entries: [PATCH]     ide-generic: fix JMB handling [#231218] [#207939]

  - patches.drivers/qla2xxx-block-error-handler: crash in     qla2xxx driver during error recovery [#232957]

  - patches.fixes/loop_early_wakeup_fix.diff: Fix oops in     loopback device during mount. [#232992]

  - patches.fixes/nfs-jiffie-wrap: Avoid extra GETATTR calls     caused by 'jiffie wrap'. [#233155]

  - add patches.fixes/atalk_sendmsg-crash.patch Fix     potential OOPS in atalk_sendmsg() [#235049]

  - patches.fixes/ext3_readdir_use_generic_readahead.diff:
    ext3_readdir: use generic readahead [#228682] [#235302]

  - patches.drivers/ide-fix-drive-side-80c-detection:
    [PATCH] ide: fix drive side 80c cable detection     [#237164]

  - patches.fixes/xfs-kern-28000a-buffer-unwritten-new: Set     the buffer new flag on writes to unwritten XFS extents.
    This fixes a corruption in preallocated files on XFS     [#237908]

  - patches.drivers/ide-atiixp-fix-cable-detection: [PATCH]     atiixp: fix cable detection [#241403]

  - patches.drivers/ide-atiixp-sb600-has-only-one-port:
    [PATCH] atiixp: SB600 has only one channel [#241403]

  - patches.fixes/md-avoid-bitmap-overflow: Avoid possible     BUG_ON in md bitmap handling. [#242180]

  - patches.fixes/ocfs2-loop-aops-hack.diff: ocfs2/loop:
    forbid use of aops when inappropriate [#242200]

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the get_fdb_entries function of the network bridging support that allowed a local user to cause a denial of service (crash) or allow a potential privilege escalation (CVE-2006-5751, Important)

* an information leak in the _block_prepare_write function that allowed a local user to read kernel memory (CVE-2006-4813, Important)

* an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read kernel memory (CVE-2006-5174, Important)

* a flaw in the handling of /proc/net/ip6_flowlabel that allowed a local user to cause a denial of service (infinite loop) (CVE-2006-5619, Important)

* a flaw in the AIO handling that allowed a local user to cause a denial of service (panic) (CVE-2006-5754, Important)

* a race condition in the mincore system core that allowed a local user to cause a denial of service (system hang) (CVE-2006-4814, Moderate)

* a flaw in the ELF handling on ia64 and sparc architectures which triggered a cross-region memory mapping and allowed a local user to cause a denial of service (CVE-2006-4538, Moderate)

* a flaw in the dev_queue_xmit function of the network subsystem that allowed a local user to cause a denial of service (data corruption) (CVE-2006-6535, Moderate)

* a flaw in the handling of CAPI messages over Bluetooth that allowed a remote system to cause a denial of service or potential code execution. This flaw is only exploitable if a privileged user establishes a connection to a malicious remote device (CVE-2006-6106, Moderate)

* a flaw in the listxattr system call that allowed a local user to cause a denial of service (data corruption) or potential privilege escalation. To successfully exploit this flaw the existence of a bad inode is required first (CVE-2006-5753, Moderate)

* a flaw in the __find_get_block_slow function that allowed a local privileged user to cause a denial of service (CVE-2006-5757, Low)

* various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service (CVE-2006-5823, CVE-2006-6053, CVE-2006-6054, CVE-2006-6056, Low)

In addition to the security issues described above, fixes for the following bugs were included :

* initialization error of the tg3 driver with some BCM5703x network card

* a memory leak in the audit subsystem

* x86_64 nmi watchdog timeout is too short

* ext2/3 directory reads fail intermittently

Red Hat would like to thank Dmitriy Monakhov and Kostantin Khorenko for reporting issues fixed in this erratum.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-2731     infamous41md reported multiple integer overflows in the     Sbus PROM driver that would allow for a DoS (Denial of     Service) attack by a local user, and possibly the     execution of arbitrary code.

  - CVE-2006-4814     Doug Chapman discovered a potential local DoS (deadlock)     in the mincore function caused by improper lock     handling.

  - CVE-2006-5753     Eric Sandeen provided a fix for a local memory     corruption vulnerability resulting from a     misinterpretation of return values when operating on     inodes which have been marked bad.

  - CVE-2006-5823     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted cramfs filesystem.

  - CVE-2006-6053     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext3 filesystem.

  - CVE-2006-6054     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext2 filesystem.

  - CVE-2006-6106     Marcel Holtman discovered multiple buffer overflows in     the Bluetooth subsystem which can be used to trigger a     remote DoS (crash) and potentially execute arbitrary     code.

  - CVE-2007-1353     Ilja van Sprundel discovered that kernel memory could be     leaked via the Bluetooth setsockopt call due to an     uninitialized stack buffer. This could be used by local     attackers to read the contents of sensitive kernel     memory.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

  - CVE-2007-2172     Thomas Graf reported a typo in the DECnet protocol     handler that could be used by a local attacker to     overrun an array via crafted packets, potentially     resulting in a Denial of Service (system crash). A     similar issue exists in the IPV4 protocol handler and     will be fixed in a subsequent update.

  - CVE-2007-2525     Florian Zumbiehl discovered a memory leak in the PPPOE     subsystem caused by releasing a socket before     PPPIOCGCHAN is called upon it. This could be used by a     local user to DoS a system by consuming all available     memory.

  - CVE-2007-3848     Wojciech Purczynski discovered that pdeath_signal was     not being reset properly under certain conditions which     may allow local users to gain privileges by sending     arbitrary signals to suid binaries.

  - CVE-2007-4308     Alan Cox reported an issue in the aacraid driver that     allows unprivileged local users to make ioctl calls     which should be restricted to admin privileges.

  - CVE-2007-4311     PaX team discovered an issue in the random driver where     a defect in the reseeding code leads to a reduction in     entropy.

  - CVE-2007-5093     Alex Smith discovered an issue with the pwc driver for     certain webcam devices. If the device is removed while a     userspace application has it open, the driver will wait     for userspace to close the device, resulting in a     blocked USB subsystem. This issue is of low security     impact as it requires the attacker to either have     physical access to the system or to convince a user with     local access to remove the device on their behalf.

  - CVE-2007-6063     Venustech AD-LAB discovered a a buffer overflow in the     isdn ioctl handling, exploitable by a local user.

  - CVE-2007-6151     ADLAB discovered a possible memory overrun in the ISDN     subsystem that may permit a local user to overwrite     kernel memory by issuing ioctls with unterminated data.

  - CVE-2007-6206     Blake Frantz discovered that when a core file owned by a     non-root user exists, and a root-owned process dumps     core over it, the core file retains its original     ownership. This could be used by a local user to gain     access to sensitive information.

  - CVE-2007-6694     Cyrill Gorcunov reported a NULL pointer dereference in     code specific to the CHRP PowerPC platforms. Local users     could exploit this issue to achieve a Denial of Service     (DoS).

  - CVE-2008-0007     Nick Piggin of SuSE discovered a number of issues in     subsystems which register a fault handler for memory     mapped areas. This issue can be exploited by local users     to achieve a Denial of Service (DoS) and possibly     execute arbitrary code.

The following matrix lists additional packages that were rebuilt for compatibility with or to take advantage of this update :

                              Debian 3.1 (sarge)             alsa-modules-i386            1.0.8+2sarge2                  kernel-image-2.4.27-arm      2.4.27-2sarge6                 kernel-image-2.4.27-m68k     2.4.27-3sarge6                 kernel-image-speakup-i386    2.4.27-1.1sarge5               kernel-image-2.4.27-alpha    2.4.27-10sarge6                kernel-image-2.4.27-s390     2.4.27-2sarge6                 kernel-image-2.4.27-sparc    2.4.27-9sarge6                 kernel-image-2.4.27-i386     2.4.27-10sarge6                kernel-image-2.4.27-ia64     2.4.27-10sarge6                kernel-patch-2.4.27-mips     2.4.27-10.sarge4.040815-3      kernel-patch-powerpc-2.4.27  2.4.27-10sarge6                kernel-latest-2.4-alpha      101sarge3                      kernel-latest-2.4-i386       101sarge2                      kernel-latest-2.4-s390       2.4.27-1sarge2                 kernel-latest-2.4-sparc      42sarge3                       i2c                          1:2.9.1-1sarge2                lm-sensors                   1:2.9.1-1sarge4                mindi-kernel                 2.4.27-2sarge5                 pcmcia-modules-2.4.27-i386   3.2.5+2sarge2                  hostap-modules-i386          1:0.3.7-1sarge3                systemimager                 3.2.3-6sarge5

Mark Dowd discovered that the netfilter iptables module did not correcly handle fragmented IPv6 packets. By sending specially crafted packets, a remote attacker could exploit this to bypass firewall rules. This has has already been fixed for Ubuntu 6.10 in USN-395-1;
this is the corresponding fix for Ubuntu 6.06.(CVE-2006-4572)

Doug Chapman discovered an improper lock handling in the mincore() function. A local attacker could exploit this to cause an eternal hang in the kernel, rendering the machine unusable. (CVE-2006-4814)

Al Viro reported that the ISDN PPP module did not initialize the reset state timer. By sending specially crafted ISDN packets, a remote attacker could exploit this to crash the kernel. (CVE-2006-5749)

Various syscalls (like listxattr()) misinterpreted the return value of return_EIO() when encountering bad inodes. By issuing particular system calls on a malformed file system, a local attacker could exploit this to crash the kernel. (CVE-2006-5753)

The task switching code did not save and restore EFLAGS of processes.
By starting a specially crafted executable, a local attacker could exploit this to eventually crash many other running processes. This only affects the amd64 platform. (CVE-2006-5755)

A race condition was found in the grow_buffers() function. By mounting a specially crafted ISO9660 or NTFS file system, a local attacker could exploit this to trigger an infinite loop in the kernel, rendering the machine unusable. (CVE-2006-5757)

A buffer overread was found in the zlib_inflate() function. By tricking an user into mounting a specially crafted file system which uses zlib compression (such as cramfs), this could be exploited to crash the kernel. (CVE-2006-5823)

The ext3 file system driver did not properly handle corrupted data structures. By mounting a specially crafted ext3 file system, a local attacker could exploit this to crash the kernel. (CVE-2006-6053)

The ext2 file system driver did not properly handle corrupted data structures. By mounting a specially crafted ext2 file system, a local attacker could exploit this to crash the kernel. (CVE-2006-6054)

The hfs file system driver did not properly handle corrupted data structures. By mounting a specially crafted hfs file system, a local attacker could exploit this to crash the kernel. This only affects systems which enable SELinux (Ubuntu disables SELinux by default).
(CVE-2006-6056)

Several vulnerabilities have been found in the GFS2 file system driver. Since this driver has never actually worked in Ubuntu 6.10, it has been disabled. This only affects Ubuntu 6.10. (CVE-2006-6057)

Marcel Holtman discovered several buffer overflows in the Bluetooth driver. By sending Bluetooth packets with specially crafted CAPI messages, a remote attacker could exploit these to crash the kernel.
(CVE-2006-6106).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kernel update fixes the following security problems :

  - CVE-2006-5751: An integer overflow in the networking     bridge ioctl starting with Kernel 2.6.7 could be used by     local attackers to overflow kernel memory buffers and     potentially escalate privileges [#222656]

  - CVE-2006-6106: Multiple buffer overflows in the     cmtp_recv_interopmsg function in the Bluetooth driver     (net/bluetooth/cmtp/capi.c) in the Linux kernel allowed     remote attackers to cause a denial of service (crash)     and possibly execute arbitrary code via CAPI messages     with a large value for the length of the (1) manu     (manufacturer) or (2) serial (serial number) field.
    [#227603]

  - CVE-2006-5749: The isdn_ppp_ccp_reset_alloc_state     function in drivers/isdn/isdn_ppp.c in the Linux kernel     does not call the init_timer function for the ISDN PPP     CCP reset state timer, which has unknown attack vectors     and results in a system crash. [#229619]

  - CVE-2006-5753: Unspecified vulnerability in the     listxattr system call in Linux kernel, when a 'bad     inode' is present, allows local users to cause a denial     of service (data corruption) and possibly gain     privileges. [#230270]

  - CVE-2007-0006: The key serial number collision avoidance     code in the key_alloc_serial function allows local users     to cause a denial of service (crash) via vectors that     trigger a null dereference. [#243003]

  - CVE-2007-0772: A remote denial of service problem on     NFSv2 mounts with ACL enabled was fixed. [#244909]

Furthermore, it catches up to the mainline kernel, version 2.6.18.8, and contains a large number of additional fixes for non security bugs.

This kernel update fixes the following security problems :

  - CVE-2006-2936: The ftdi_sio driver allowed local users     to cause a denial of service (memory consumption) by     writing more data to the serial port than the hardware     can handle, which causes the data to be queued. This     requires this driver to be loaded, which only happens if     such a device is plugged in. [#191836]

  - CVE-2006-4814: A deadlock in mincore that could be     caused by local attackers was fixed. [#207667]

  - CVE-2006-6106: Multiple buffer overflows in the     cmtp_recv_interopmsg function in the Bluetooth driver     (net/bluetooth/cmtp/capi.c) in the Linux kernel allowed     remote attackers to cause a denial of service (crash)     and possibly execute arbitrary code via CAPI messages     with a large value for the length of the (1) manu     (manufacturer) or (2) serial (serial number) field.
    [#227603]

  - CVE-2006-5749: The isdn_ppp_ccp_reset_alloc_state     function in drivers/isdn/isdn_ppp.c in the Linux kernel     does not call the init_timer function for the ISDN PPP     CCP reset state timer, which has unknown attack vectors     and results in a system crash. [#229619]

  - CVE-2006-5753: Unspecified vulnerability in the     listxattr system call in Linux kernel, when a 'bad     inode' is present, allows local users to cause a denial     of service (data corruption) and possibly gain     privileges. [#230270]

  - A remote denial of service problem on NFSv3 mounts with     ACL enabled was fixed. [#244909]

Furthermore, this kernel catches up to the SLE 10 state of the kernel, with massive additional fixes.

CVE-2006-6060 CVE-2006-6106 CVE-2006-6535 CVE-2007-0958 CVE-2007-1357  CVE-2007-1592

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. 

This update also fixes a regression in the smbfs subsystem which was introduced in DSA-1233which caused symlinks to be interpreted as regular files.

The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-4811     David Gibson reported an issue in the hugepage code     which could permit a local DoS (system crash) on     appropriately configured systems.

  - CVE-2006-4814     Doug Chapman discovered a potential local DoS (deadlock)     in the mincore function caused by improper lock     handling.

  - CVE-2006-4623     Ang Way Chuang reported a remote DoS (crash) in the dvb     driver which can be triggered by a ULE package with an     SNDU length of 0.

  - CVE-2006-5753     Eric Sandeen provided a fix for a local memory     corruption vulnerability resulting from a     misinterpretation of return values when operating on     inodes which have been marked bad.

  - CVE-2006-5754     Darrick Wong discovered a local DoS (crash)     vulnerability resulting from the incorrect     initialization of 'nr_pages' in aio_setup_ring().

  - CVE-2006-5757     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted iso9660 filesystem.

  - CVE-2006-6053     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext3 filesystem.

  - CVE-2006-6056     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted hfs filesystem on systems     with SELinux hooks enabled (Debian does not enable     SELinux by default).

  - CVE-2006-6060     LMH reported a potential local DoS (infinite loop) which     could be exploited by a malicious user with the     privileges to mount and read a corrupted NTFS     filesystem.

  - CVE-2006-6106     Marcel Holtman discovered multiple buffer overflows in     the Bluetooth subsystem which can be used to trigger a     remote DoS (crash) and potentially execute arbitrary     code.

  - CVE-2006-6535     Kostantin Khorenko discovered an invalid error path in     dev_queue_xmit() which could be exploited by a local     user to cause data corruption.

  - CVE-2007-0958     Santosh Eraniose reported a vulnerability that allows     local users to read otherwise unreadable files by     triggering a core dump while using PT_INTERP. This is     related to CVE-2004-1073.

  - CVE-2007-1357     Jean Delvare reported a vulnerability in the appletalk     subsystem. Systems with the appletalk module loaded can     be triggered to crash by other systems on the local     network via a malformed frame.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The 2.6.17 kernel and earlier, when running on IA64 and SPARC platforms would allow a local user to cause a DoS (crash) via a malformed ELF file (CVE-2006-4538).

The mincore function in the Linux kernel did not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock (CVE-2006-4814).

An unspecified vulnerability in the listxattr system call, when a 'bad inode' is present, could allow a local user to cause a DoS (data corruption) and possibly gain privileges via unknown vectors (CVE-2006-5753).

The zlib_inflate function allows local users to cause a crash via a malformed filesystem that uses zlib compression that triggers memory corruption (CVE-2006-5823).

The ext3fs_dirhash function could allow local users to cause a DoS (crash) via an ext3 stream with malformed data structures (CVE-2006-6053).

When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056).

The key serial number collision avoidance code in the key_alloc_serial function in kernels 2.6.9 up to 2.6.20 allows local users to cause a crash via vectors thatr trigger a null dereference (CVE-2007-0006).

The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772).

A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - add PCI IDs for cciss driver (HP ML370G5 / DL360G5)

    - fixed a mssive SCSI reset on megasas (Dell PE2960)

    - increased port-reset completion delay for HP       controllers (HP ML350)

    - NUMA rnage fixes for x86_64

    - various netfilter fixes

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Updated to kernel 2.6.19.5 plus additional fixes :

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19.4 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19.5

CVE-2007-0772: Summary: The Linux kernel before 2.6.20.1 allows remote attackers to cause a denial of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free of an incorrect pointer.

CVE-2006-5753: Summary: Unspecified vulnerability in the listxattr system call in Linux kernel, when a 'bad inode' is present, allows local users to cause a denial of service (data corruption) and possibly gain privileges via unknown vectors. 

Fixed broken SCSI CDROM IOCTLs. Added Xen, which was missing from 1.2911.6.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated to kernel 2.6.19.5-rc1 plus additional fixes :

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19.4

2.6.19.5-rc1: 4 V4L fixes 3 usbaudio fixes 3 wireless driver fixes 2 IDE driver cable detection fixes NFS bugfix various other fixes

CVE-2007-0772: Summary: The Linux kernel before 2.6.20.1 allows remote attackers to cause a denial of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free of an incorrect pointer.

CVE-2006-5753: Summary: Unspecified vulnerability in the listxattr system call in Linux kernel, when a 'bad inode' is present, allows local users to cause a denial of service (data corruption) and possibly gain privileges via unknown vectors.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The isdn_ppp_ccp_reset_alloc_state function in drivers/isdn/isdn_ppp.c in the Linux 2.4 kernel before 2.4.34-rc4, as well as the 2.6 kernel, does not call the init_timer function for the ISDN PPP CCP reset state timer, which has unknown attack vectors and results in a system crash.
(CVE-2006-5749)

The listxattr syscall can corrupt user space under certain circumstances. The problem seems to be related to signed/unsigned conversion during size promotion. (CVE-2006-5753)

The ext3fs_dirhash function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via an ext3 stream with malformed data structures. (CVE-2006-6053)

The mincore function in the Linux kernel before 2.4.33.6, as well as the 2.6 kernel, does not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock.
(CVE-2006-4814)

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - Add Ralink RT2571W/RT2671 WLAN USB support (rt73 module)
    - Fix sys_msync() to report -ENOMEM as before when an     unmapped area falls within its range, and not to     overshoot (LSB regression) - Avoid disk sector_t     overflow for >2TB ext3 filesystem - USB: workaround to     fix HP scanners detection (#26728) - USB: unusual_devs.h     for Sony floppy (#28378) - Add preliminary ICH9 support
    - Add TI sd card reader support - Add RT61 driver - KVM     update - Fix bttv vbi offset

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0014.

ID	Name	Product	Family	Severity
67438	Oracle Linux 4 : kernel (ELSA-2007-0014)	Nessus	Oracle Linux Local Security Checks	high
59122	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2605)	Nessus	SuSE Local Security Checks	high
36838	CentOS 4 : kernel (CESA-2007:0014)	Nessus	CentOS Local Security Checks	high
31147	Debian DSA-1503-1 : kernel-source-2.4.27 - several vulnerabilities	Nessus	Debian Local Security Checks	high
29486	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2606)	Nessus	SuSE Local Security Checks	high
28005	Ubuntu 5.10 / 6.06 LTS / 6.10 : linux-source-2.6.12/2.6.15/2.6.17 vulnerabilities (USN-416-1)	Nessus	Ubuntu Local Security Checks	high
27293	openSUSE 10 Security Update : kernel (kernel-2705)	Nessus	SuSE Local Security Checks	high
27292	openSUSE 10 Security Update : kernel (kernel-2635)	Nessus	SuSE Local Security Checks	high
25529	Debian DSA-1304-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	high
24810	Mandrake Linux Security Advisory : kernel (MDKSA-2007:060)	Nessus	Mandriva Local Security Checks	high
24767	Fedora Core 6 : kernel-2.6.19-1.2911.6.4.fc6 (2007-291)	Nessus	Fedora Local Security Checks	high
24766	Fedora Core 5 : kernel-2.6.19-1.2288.2.1.fc5 (2007-277)	Nessus	Fedora Local Security Checks	high
24653	Mandrake Linux Security Advisory : kernel (MDKSA-2007:040)	Nessus	Mandriva Local Security Checks	high
24315	RHEL 4 : kernel (RHSA-2007:0014)	Nessus	Red Hat Local Security Checks	high
801424	CentOS RHSA-2007-0014 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2006-5753

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high