Linux kernel 2.6.x before 2.6.20 allows local users to read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump, a variant of CVE-2004-1073.

From Red Hat Security Advisory 2007:0488 :

Updated kernel packages that fix several security issues and bugs in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the connection tracking support for SCTP that allowed a remote user to cause a denial of service by dereferencing a NULL pointer. (CVE-2007-2876, Important)

* a flaw in the mount handling routine for 64-bit systems that allowed a local user to cause denial of service (crash). (CVE-2006-7203, Important)

* a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access. (CVE-2007-2172, Important)

* a flaw in the PPP over Ethernet implementation that allowed a local user to cause a denial of service (memory consumption) by creating a socket using connect and then releasing it before the PPPIOCGCHAN ioctl has been called. (CVE-2007-2525, Important)

* a flaw in the fput ioctl handling of 32-bit applications running on 64-bit platforms that allowed a local user to cause a denial of service (panic). (CVE-2007-0773, Important)

* a flaw in the NFS locking daemon that allowed a local user to cause denial of service (deadlock). (CVE-2006-5158, Moderate)

* a flaw in the sysfs_readdir function that allowed a local user to cause a denial of service by dereferencing a NULL pointer.
(CVE-2007-3104, Moderate)

* a flaw in the core-dump handling that allowed a local user to create core dumps from unreadable binaries via PT_INTERP. (CVE-2007-0958, Low)

* a flaw in the Bluetooth subsystem that allowed a local user to trigger an information leak. (CVE-2007-1353, Low)

In addition, the following bugs were addressed :

* the NFS could recurse on the same spinlock. Also, NFS, under certain conditions, did not completely clean up Posix locks on a file close, leading to mount failures.

* the 32bit compatibility didn't return to userspace correct values for the rt_sigtimedwait system call.

* the count for unused inodes could be incorrect at times, resulting in dirty data not being written to disk in a timely manner.

* the cciss driver had an incorrect disk size calculation (off-by-one error) which prevented disk dumps.

Red Hat would like to thank Ilja van Sprundel and the OpenVZ Linux kernel team for reporting issues fixed in this erratum.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0347 advisory.

    [2.6.18-8.1.4.0.1.el5]
     -Fix bonding primary=ethX so it picks correct network (Bert Barbe) [IT      101532] [ORA 5136660]
     -Add entropy module option to e1000 (John Sobecki) [ORA 6045759]
     -Add entropy module option to bnx2 (John Sobecki) [ORA 6045759]

     [2.6.18.8.1.4.el5]
     - [ipv6] Fix routing regression. (David S. Miller ) [238046]
     - [mm] Gdb does not accurately output the backtrace. (Dave Anderson )      [235511]
     - [NMI] change watchdog timeout to 30 seconds (Larry Woodman ) [237655]
     - [dlm] fix mode munging (David Teigland ) [238731]
     - [net] kernel-headers: missing include of types.h (Neil Horman ) [238749]
     - [net] fib_semantics.c out of bounds check (Thomas Graf ) [238948]      {CVE-2007-2172}
     - [net] disallow RH0 by default (Thomas Graf ) [238949] {CVE-2007-2242}
     - [net] Fix user OOPS'able bug in FIB netlink (David S. Miller )      [238960] {CVE-2007-1861}
     - [net] IPv6 fragments bypass in nf_conntrack netfilter code (Thomas      Graf ) [238947] {CVE-2007-1497}
     - [net] ipv6_fl_socklist is inadvertently shared (David S. Miller )      [238944] {CVE-2007-1592}
     - [net] Various NULL pointer dereferences in netfilter code (Thomas Graf      ) [238946] {CVE-2007-1496}

     [2.6.18-8.1.3.el5]
     - [s390] page_mkclean causes data corruption on s390 (Jan Glauber ) [236605]

     [2.6.18-8.1.2.el5]
     - [utrace] exploit and unkillable cpu fixes (Roland McGrath ) [228816]      (CVE-2007-0771)
     - [net] IPV6 security holes in ipv6_sockglue.c - 2 (David S. Miller )      [232257] {CVE-2007-1000}
     - [net] IPV6 security holes in ipv6_sockglue.c (David S. Miller )      [232255] {CVE-2007-1388}
     - [audit] GFP_KERNEL allocations in non-blocking context fix (Alexander      Viro ) [233157]

     [2.6.18-8.1.1.el5]
     - [cpufreq] Remove __initdata from tscsync (Prarit Bhargava ) [229887]
     - [security] Fix key serial number collision problem (David Howells )      [229883] {CVE-2007-0006}
     - [fs] Don't core dump read-only binarys (Don Howard ) [229885]      {CVE-2007-0958}
     - [xen] Enable booting on machines with > 64G (Chris Lalancette) [230117]
     - Fix potential buffer overflow in cardman 4040 cmx driver (Don Howard)      [229884] {CVE-2007-0005}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

These new kernel packages contain fixes for the security issues described below :

  - a flaw in the connection tracking support for SCTP that     allowed a remote user to cause a denial of service by     dereferencing a NULL pointer. (CVE-2007-2876, Important)

  - a flaw in the mount handling routine for 64-bit systems     that allowed a local user to cause denial of service     (crash). (CVE-2006-7203, Important)

  - a flaw in the IPv4 forwarding base that allowed a local     user to cause an out-of-bounds access. (CVE-2007-2172,     Important)

  - a flaw in the PPP over Ethernet implementation that     allowed a local user to cause a denial of service     (memory consumption) by creating a socket using connect     and then releasing it before the PPPIOCGCHAN ioctl has     been called. (CVE-2007-2525, Important)

  - a flaw in the fput ioctl handling of 32-bit applications     running on 64-bit platforms that allowed a local user to     cause a denial of service (panic). (CVE-2007-0773,     Important)

  - a flaw in the NFS locking daemon that allowed a local     user to cause denial of service (deadlock).
    (CVE-2006-5158, Moderate)

  - a flaw in the sysfs_readdir function that allowed a     local user to cause a denial of service by dereferencing     a NULL pointer. (CVE-2007-3104, Moderate)

  - a flaw in the core-dump handling that allowed a local     user to create core dumps from unreadable binaries via     PT_INTERP. (CVE-2007-0958, Low)

  - a flaw in the Bluetooth subsystem that allowed a local     user to trigger an information leak. (CVE-2007-1353,     Low)

In addition, the following bugs were addressed :

  - the NFS could recurse on the same spinlock. Also, NFS,     under certain conditions, did not completely clean up     Posix locks on a file close, leading to mount failures.

  - the 32bit compatibility didn't return to userspace     correct values for the rt_sigtimedwait system call.

  - the count for unused inodes could be incorrect at times,     resulting in dirty data not being written to disk in a     timely manner.

  - the cciss driver had an incorrect disk size calculation     (off-by-one error) which prevented disk dumps.

NOTE1: From The Upstream Vendors release notes 'During PCI probing, Red Hat Enterprise Linux 4 Update 5 attempts to use information obtained from MCFG (memory-mapped PCI configuration space). On AMD-systems, this type of access does not work on some buses, as the kernel cannot parse the MCFG table.

To work around this, add the parameter pci=conf1 or pci=nommconf on the kernel boot line in /etc/grub.conf. For example :

title Red Hat Enterprise Linux AS (2.6.9-42.0.2.EL) root (hd0,0) kernel /vmlinuz-2.6.9-42.0.2.EL ro root=/dev/VolGroup00/LogVol00 rhgb quiet pci=conf1 initrd /initrd-2.6.9-42.0.2.EL.img

Doing this instructs the kernel to use PCI Conf1 access instead of MCFG-based access.'

NOTE2: From The Upstream Vendors Knowledge Base 'Why did the ordering of my NIC devices change in Red Hat Enterprise Linux 4.5?

The 2.6.9-55 version of the Red Hat Enterprise Linux 4 kernel (Update 5) reverts to the 2.4 ordering of network interface cards (NICs) on certain systems. Note that if the 'HWADDR=MAC ADDRESS' line is present in the /etc/sysconfig/network-scripts/ifcfg-ethX files, the NIC ordering will not change.

To restore the original 2.6 ordering, which is different from the 2.4 ordering, boot with the option pci=nobfsort '

The kernel key management code did not correctly handle key reuse. A local attacker could create many key requests, leading to a denial of service. (CVE-2007-0006)

The kernel NFS code did not correctly validate NFSACL2 ACCESS requests. If a system was serving NFS mounts, a remote attacker could send a specially crafted packet, leading to a denial of service.
(CVE-2007-0772)

When dumping core, the kernel did not correctly handle PT_INTERP processes. A local attacker could create situations where they could read the contents of otherwise unreadable executable programs.
(CVE-2007-0958).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix several security issues and bugs in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the connection tracking support for SCTP that allowed a remote user to cause a denial of service by dereferencing a NULL pointer. (CVE-2007-2876, Important)

* a flaw in the mount handling routine for 64-bit systems that allowed a local user to cause denial of service (crash). (CVE-2006-7203, Important)

* a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access. (CVE-2007-2172, Important)

* a flaw in the PPP over Ethernet implementation that allowed a local user to cause a denial of service (memory consumption) by creating a socket using connect and then releasing it before the PPPIOCGCHAN ioctl has been called. (CVE-2007-2525, Important)

* a flaw in the fput ioctl handling of 32-bit applications running on 64-bit platforms that allowed a local user to cause a denial of service (panic). (CVE-2007-0773, Important)

* a flaw in the NFS locking daemon that allowed a local user to cause denial of service (deadlock). (CVE-2006-5158, Moderate)

* a flaw in the sysfs_readdir function that allowed a local user to cause a denial of service by dereferencing a NULL pointer.
(CVE-2007-3104, Moderate)

* a flaw in the core-dump handling that allowed a local user to create core dumps from unreadable binaries via PT_INTERP. (CVE-2007-0958, Low)

* a flaw in the Bluetooth subsystem that allowed a local user to trigger an information leak. (CVE-2007-1353, Low)

In addition, the following bugs were addressed :

* the NFS could recurse on the same spinlock. Also, NFS, under certain conditions, did not completely clean up Posix locks on a file close, leading to mount failures.

* the 32bit compatibility didn't return to userspace correct values for the rt_sigtimedwait system call.

* the count for unused inodes could be incorrect at times, resulting in dirty data not being written to disk in a timely manner.

* the cciss driver had an incorrect disk size calculation (off-by-one error) which prevented disk dumps.

Red Hat would like to thank Ilja van Sprundel and the OpenVZ Linux kernel team for reporting issues fixed in this erratum.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

CVE-2006-6060 CVE-2006-6106 CVE-2006-6535 CVE-2007-0958 CVE-2007-1357  CVE-2007-1592

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. 

This update also fixes a regression in the smbfs subsystem which was introduced in DSA-1233which caused symlinks to be interpreted as regular files.

The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-4811     David Gibson reported an issue in the hugepage code     which could permit a local DoS (system crash) on     appropriately configured systems.

  - CVE-2006-4814     Doug Chapman discovered a potential local DoS (deadlock)     in the mincore function caused by improper lock     handling.

  - CVE-2006-4623     Ang Way Chuang reported a remote DoS (crash) in the dvb     driver which can be triggered by a ULE package with an     SNDU length of 0.

  - CVE-2006-5753     Eric Sandeen provided a fix for a local memory     corruption vulnerability resulting from a     misinterpretation of return values when operating on     inodes which have been marked bad.

  - CVE-2006-5754     Darrick Wong discovered a local DoS (crash)     vulnerability resulting from the incorrect     initialization of 'nr_pages' in aio_setup_ring().

  - CVE-2006-5757     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted iso9660 filesystem.

  - CVE-2006-6053     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext3 filesystem.

  - CVE-2006-6056     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted hfs filesystem on systems     with SELinux hooks enabled (Debian does not enable     SELinux by default).

  - CVE-2006-6060     LMH reported a potential local DoS (infinite loop) which     could be exploited by a malicious user with the     privileges to mount and read a corrupted NTFS     filesystem.

  - CVE-2006-6106     Marcel Holtman discovered multiple buffer overflows in     the Bluetooth subsystem which can be used to trigger a     remote DoS (crash) and potentially execute arbitrary     code.

  - CVE-2006-6535     Kostantin Khorenko discovered an invalid error path in     dev_queue_xmit() which could be exploited by a local     user to cause data corruption.

  - CVE-2007-0958     Santosh Eraniose reported a vulnerability that allows     local users to read otherwise unreadable files by     triggering a core dump while using PT_INTERP. This is     related to CVE-2004-1073.

  - CVE-2007-1357     Jean Delvare reported a vulnerability in the appletalk     subsystem. Systems with the appletalk module loaded can     be triggered to crash by other systems on the local     network via a malformed frame.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* a flaw in the key serial number collision avoidance algorithm of the keyctl subsystem that allowed a local user to cause a denial of service (CVE-2007-0006, Important)

* a flaw in the Omnikey CardMan 4040 driver that allowed a local user to execute arbitrary code with kernel privileges. In order to exploit this issue, the Omnikey CardMan 4040 PCMCIA card must be present and the local user must have access rights to the character device created by the driver. (CVE-2007-0005, Moderate)

* a flaw in the core-dump handling that allowed a local user to create core dumps from unreadable binaries via PT_INTERP. (CVE-2007-0958, Low)

In addition to the security issues described above, a fix for a kernel panic in the powernow-k8 module, and a fix for a kernel panic when booting the Xen domain-0 on system with large memory installations have been included.

Red Hat would like to thank Daniel Roethlisberger for reporting an issue fixed in this erratum.

Red Hat Enterprise Linux 5 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0005     Daniel Roethlisberger discovered two buffer overflows in     the cm4040 driver for the Omnikey CardMan 4040 device. A     local user or malicious device could exploit this to     execute arbitrary code in kernel space.

  - CVE-2007-0958     Santosh Eraniose reported a vulnerability that allows     local users to read otherwise unreadable files by     triggering a core dump while using PT_INTERP. This is     related to CVE-2004-1073.

  - CVE-2007-1357     Jean Delvare reported a vulnerability in the appletalk     subsystem. Systems with the appletalk module loaded can     be triggered to crash by other systems on the local     network via a malformed frame.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056).

Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges. (CVE-2007-0005)

The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772).

A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958).

The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference. (CVE-2007-1000)

Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet. (CVE-2007-1217)

The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux kernel 2.6.17, and possibly other versions, allows local users to cause a denial of service (oops) by calling setsockopt with the IPV6_RTHDR option name and possibly a zero option length or invalid option value, which triggers a NULL pointer dereference.
(CVE-2007-1388)

net/ipv6/tcp_ipv6.c in Linux kernel 2.4 and 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double-free by opening a listeing IPv6 socket, attaching a flow label, and connecting to that socket. (CVE-2007-1592)

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - Suspend to disk speed improvements

    - Add nmi watchdog support for core2

    - Add atl1 driver

    - Update KVM

    - Add acer_acpi

    - Update asus_acpi

    - Fix suspend on r8169, i8259A

    - Fix suspend when using ondemand governor

    - Add ide acpi support

    - Add suspend/resume support for sata_nv chipsets.

    - USB: Let USB-Serial option driver handle anydata       devices (#29066)

    - USB: Add PlayStation 2 Trance Vibrator driver

    - Fix bogus delay loop in video/aty/mach64_ct.c

    - Add MCP61 support (#29398)

    - USB: fix floppy drive SAMSUNG SFD-321U/EP detected 8       times bug

    - Improve keyboard handling on Apple MacBooks

    - Add -latest patch

    - Workaround a possible binutils bug in smp alternatives

    - Add forcedeth support

    - Fix potential deadlock in driver core (USB hangs at       boot time #24683)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The 2.6.17 kernel and earlier, when running on IA64 and SPARC platforms would allow a local user to cause a DoS (crash) via a malformed ELF file (CVE-2006-4538).

The mincore function in the Linux kernel did not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock (CVE-2006-4814).

An unspecified vulnerability in the listxattr system call, when a 'bad inode' is present, could allow a local user to cause a DoS (data corruption) and possibly gain privileges via unknown vectors (CVE-2006-5753).

The zlib_inflate function allows local users to cause a crash via a malformed filesystem that uses zlib compression that triggers memory corruption (CVE-2006-5823).

The ext3fs_dirhash function could allow local users to cause a DoS (crash) via an ext3 stream with malformed data structures (CVE-2006-6053).

When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056).

The key serial number collision avoidance code in the key_alloc_serial function in kernels 2.6.9 up to 2.6.20 allows local users to cause a crash via vectors thatr trigger a null dereference (CVE-2007-0006).

The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772).

A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - add PCI IDs for cciss driver (HP ML370G5 / DL360G5)

    - fixed a mssive SCSI reset on megasas (Dell PE2960)

    - increased port-reset completion delay for HP       controllers (HP ML350)

    - NUMA rnage fixes for x86_64

    - various netfilter fixes

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

ID	Name	Product	Family	Severity
67520	Oracle Linux 4 : kernel (ELSA-2007-0488)	Nessus	Oracle Linux Local Security Checks	medium
67495	Oracle Linux 5 : Important: / kernel (ELSA-2007-0347)	Nessus	Oracle Linux Local Security Checks	medium
60215	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
28048	Ubuntu 6.06 LTS / 6.10 : linux-source-2.6.15/2.6.17 vulnerabilities (USN-451-1)	Nessus	Ubuntu Local Security Checks	high
25605	RHEL 4 : kernel (RHSA-2007:0488)	Nessus	Red Hat Local Security Checks	medium
25575	CentOS 4 : kernel (CESA-2007:0488)	Nessus	CentOS Local Security Checks	medium
25529	Debian DSA-1304-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	high
25319	RHEL 5 : kernel (RHSA-2007:0099)	Nessus	Red Hat Local Security Checks	medium
25153	Debian DSA-1286-1 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	high
24944	Mandrake Linux Security Advisory : kernel (MDKSA-2007:078)	Nessus	Mandriva Local Security Checks	high
24810	Mandrake Linux Security Advisory : kernel (MDKSA-2007:060)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2007-0958

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

high

medium

high

high

high