The copy_to_user function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest users to access arbitrary physical memory by triggering certain mapping operations.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0089 advisory.

    [2.6.18-53.1.6.0.1.el5]
     - [NET] Add entropy support to e1000 and bnx2 (John Sobecki) [ORA 6045759]
     - [NET] Fix msi issue with kexec/kdump (Michael Chan) [ORA 6219364]
     - [MM] Fix alloc_pages_node() static `nid\' race made kernel crash (Joe      Jin) [ORA 6187457]
     - [splice] Fix bad unlock_page() in error case  (Jens Axboe) [ORA 6263574]
     - [dio] fix error-path crashes (Linux Torvalds) [ORA 6242289]
     - [MM] Fix leak in hugepages, regression for shared pagetables patch      (Adam Litke) [ORABUG 6732368]

     [2.6.18-53.1.6.el5]
     - [fs] corruption by unprivileged user in directories (Vitaly Mayatskikh      ) [428796] {CVE-2008-0001}

     [2.6.18-53.1.5.el5]
     - [ia64] ptrace: access to user register backing (Roland McGrath ) [259801]
     - [fs] cifs: buffer overflow due to corrupt response (Jeff Layton ) [372991]
     - [net] s2io: correct VLAN frame reception (Andy Gospodarek ) [426289]
     - [net] s2io: allow VLAN creation on interfaces (Andy Gospodarek ) [426289]
     - [misc] tux: get rid of O_ATOMICLOOKUP (Michal Schmidt ) [426494]
     - [x86_64] fix race conditions in setup_APIC_timer (Geoff Gustafson )      [424181]
     - [fs] core dump file ownership (Don Howard ) [396991]
     - [nfs] let rpciod finish sillyrename then umount (Steve Dickson ) [414041]
     - [nfs] fix a race in silly rename (Steve Dickson ) [414041]
     - [nfs] clean up the silly rename code (Steve Dickson ) [414041]
     - [nfs] infrastructure changes for silly renames (Steve Dickson ) [414041]
     - [nfs] introduce nfs_removeargs and nfs_removeres (Steve Dickson ) [414041]
     - [ia64] remove stack hard limit (Aron Griffis ) [412091]
     - [fs] sysfs: fix race condition around sd->s_dentry (Eric Sandeen )      [245777] {CVE-2007-3104}
     - [fs] sysfs: fix condition check in sysfs_drop_dentry() (Eric Sandeen )      [245777] {CVE-2007-3104}
     - [fs] sysfs: store inode nrs in s_ino (Eric Sandeen ) [245777]      {CVE-2007-3104}
     - [xen] ia64: vulnerability of copy_to_user in PAL emu (Jarod Wilson )      [425938]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

These new kernel packages fix the following security issues :

A flaw was found in the virtual filesystem (VFS). An unprivileged local user could truncate directories to which they had write permission; this could render the contents of the directory inaccessible. (CVE-2008-0001, Important)

A flaw was found in the Xen PAL emulation on Intel 64 platforms. A guest Hardware-assisted virtual machine (HVM) could read the arbitrary physical memory of the host system, which could make information available to unauthorized users. (CVE-2007-6416, Important)

A flaw was found in the way core dump files were created. If a local user can get a root-owned process to dump a core file into a directory, which the user has write access to, they could gain read access to that core file, potentially containing sensitive information. (CVE-2007-6206, Moderate)

A buffer overflow flaw was found in the CIFS virtual file system. A remote,authenticated user could issue a request that could lead to a denial of service. (CVE-2007-5904, Moderate)

A flaw was found in the 'sysfs_readdir' function. A local user could create a race condition which would cause a denial of service (kernel oops). (CVE-2007-3104, Moderate)

As well, these updated packages fix the following bugs :

  - running the 'strace -f' command caused strace to hang,     without displaying information about child processes.

  - unmounting an unresponsive, interruptable NFS mount, for     example, one mounted with the 'intr' option, may have     caused a system crash.

  - a bug in the s2io.ko driver prevented VLAN devices from     being added. Attempting to add a device to a VLAN, for     example, running the 'vconfig add [device-name]     [vlan-id]' command caused vconfig to fail.

  - tux used an incorrect open flag bit. This caused     problems when building packages in a chroot environment,     such as mock, which is used by the koji build system.

Updated kernel packages that fix several security issues and several bugs in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These new kernel packages fix the following security issues :

A flaw was found in the virtual filesystem (VFS). An unprivileged local user could truncate directories to which they had write permission; this could render the contents of the directory inaccessible. (CVE-2008-0001, Important)

A flaw was found in the Xen PAL emulation on Intel 64 platforms. A guest Hardware-assisted virtual machine (HVM) could read the arbitrary physical memory of the host system, which could make information available to unauthorized users. (CVE-2007-6416, Important)

A flaw was found in the way core dump files were created. If a local user can get a root-owned process to dump a core file into a directory, which the user has write access to, they could gain read access to that core file, potentially containing sensitive information. (CVE-2007-6206, Moderate)

A buffer overflow flaw was found in the CIFS virtual file system. A remote,authenticated user could issue a request that could lead to a denial of service. (CVE-2007-5904, Moderate)

A flaw was found in the 'sysfs_readdir' function. A local user could create a race condition which would cause a denial of service (kernel oops). (CVE-2007-3104, Moderate)

As well, these updated packages fix the following bugs :

* running the 'strace -f' command caused strace to hang, without displaying information about child processes.

* unmounting an unresponsive, interruptable NFS mount, for example, one mounted with the 'intr' option, may have caused a system crash.

* a bug in the s2io.ko driver prevented VLAN devices from being added.
Attempting to add a device to a VLAN, for example, running the 'vconfig add [device-name] [vlan-id]' command caused vconfig to fail.

* tux used an incorrect open flag bit. This caused problems when building packages in a chroot environment, such as mock, which is used by the koji build system.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0089 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    These new kernel packages fix the following security issues:

    A flaw was found in the virtual filesystem (VFS). An unprivileged local     user could truncate directories to which they had write permission; this     could render the contents of the directory inaccessible. (CVE-2008-0001,     Important)

    A flaw was found in the Xen PAL emulation on Intel 64 platforms. A guest     Hardware-assisted virtual machine (HVM) could read the arbitrary physical     memory of the host system, which could make information available to     unauthorized users. (CVE-2007-6416, Important)

    A flaw was found in the way core dump files were created. If a local user     can get a root-owned process to dump a core file into a directory, which     the user has write access to, they could gain read access to that core     file, potentially containing sensitive information. (CVE-2007-6206, Moderate)

    A buffer overflow flaw was found in the CIFS virtual file system. A     remote,authenticated user could issue a request that could lead to a denial     of service. (CVE-2007-5904, Moderate)

    A flaw was found in the sysfs_readdir function. A local user could create     a race condition which would cause a denial of service (kernel oops).
    (CVE-2007-3104, Moderate)

    As well, these updated packages fix the following bugs:

    * running the strace -f command caused strace to hang, without displaying     information about child processes.

    * unmounting an unresponsive, interruptable NFS mount, for example, one     mounted with the intr option, may have caused a system crash.

    * a bug in the s2io.ko driver prevented VLAN devices from being added.
    Attempting to add a device to a VLAN, for example, running the vconfig     add [device-name] [vlan-id] command caused vconfig to fail.

    * tux used an incorrect open flag bit. This caused problems when building     packages in a chroot environment, such as mock, which is used by the koji     build system.

    Red Hat Enterprise Linux 5 users are advised to upgrade to these updated     packages, which contain backported patches to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
67645	Oracle Linux 5 : Important: / kernel (ELSA-2008-0089)	Nessus	Oracle Linux Local Security Checks	medium
60351	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43672	CentOS 5 : kernel (CESA-2008:0089)	Nessus	CentOS Local Security Checks	medium
30090	RHEL 5 : kernel (RHSA-2008:0089)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2007-6416

critical

Tenable Plugins

medium

medium

medium

critical