Debian DSA-1845-1 : linux-2.6 - denial of service, privilege escalation

High Nessus Plugin ID 44710

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2009-1895 Julien Tinnes and Tavis Ormandy reported an issue in the Linux personality code. Local users can take advantage of a setuid binary that can either be made to dereference a NULL pointer or drop privileges and return control to the user. This allows a user to bypass mmap_min_addr restrictions which can be exploited to execute arbitrary code.

- CVE-2009-2287 Matt T. Yourst discovered an issue in the kvm subsystem.
Local users with permission to manipulate /dev/kvm can cause a denial of service (hang) by providing an invalid cr3 value to the KVM_SET_SREGS call.

- CVE-2009-2406 CVE-2009-2407 Ramon de Carvalho Valle discovered two issues with the eCryptfs layered filesystem using the fsfuzzer utility.
A local user with permissions to perform an eCryptfs mount may modify the contents of a eCryptfs file, overflowing the stack and potentially gaining elevated privileges.

Solution

Upgrade the linux-2.6 and user-mode-linux packages.

For the stable distribution (lenny), these problems have been fixed in version 2.6.26-17lenny1.

For the oldstable distribution (etch), these problems, where applicable, will be fixed in updates to linux-2.6 and linux-2.6.24.

Note: Debian carefully tracks all known security issues across every linux kernel package in all releases under active security support.
However, given the high frequency at which low-severity security issues are discovered in the kernel and the resource requirements of doing an update, updates for lower priority issues will normally not be released for all kernels at the same time. Rather, they will be released in a staggered or 'leap-frog' fashion.

See Also

https://security-tracker.debian.org/tracker/CVE-2009-1895

https://security-tracker.debian.org/tracker/CVE-2009-2287

https://security-tracker.debian.org/tracker/CVE-2009-2406

https://security-tracker.debian.org/tracker/CVE-2009-2407

https://www.debian.org/security/2009/dsa-1845

Plugin Details

Severity: High

ID: 44710

File Name: debian_DSA-1845.nasl

Version: 1.13

Type: local

Agent: unix

Published: 2010/02/24

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:linux-2.6, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2009/07/28

Reference Information

CVE: CVE-2009-1895, CVE-2009-2287, CVE-2009-2406, CVE-2009-2407

BID: 35529, 35647, 35850, 35851

DSA: 1845

CWE: 16, 20, 119