LinuxQuestions.org
Page 1 of 6 1 23 Last »
Show 50 post(s) from this thread on one page

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Kernel Vulns (https://www.linuxquestions.org/questions/linux-security-4/kernel-vulns-399624/)

unSpawn 01-04-2006 07:19 PM
Kernel Vulns
 
I would like to ask anyone who sees kernel vulnerabilities posted to add them to this thread. This way we can make sure they're published centrally. Please add a good, short title or CVE ID and the date it was published. If you post a summary keep it concise and please link to the original publication.

Please note this thread serves as a listing and not for *discussing* those vulnerabilities: please create a separate thread. Thanks.

CVE entries for linux+kernel.




FYI from win32sux to all: I am now unable to post vulnerabilities regarding the 2.4 branch, as well as prior 2.6 branches. In other words, I am only posting vulnerabilities which affect the latest stable 2.6 branch. Also, please keep in mind that I only announce new kernel releases when they include patches to known security vulnerabilities.

unSpawn 01-04-2006 07:28 PM
2006-01-04 CVE-2005-3358 (mempolicy, sysctl, fib_lookup, TwinHan DST driver)
 
Advisory ID : FrSIRT/ADV-2006-0035
CVE ID : CVE-2005-3358
Rated as : Moderate Risk
Remotely Exploitable : No
Locally Exploitable : Yes
Release Date : 2006-01-04


Technical Description
Multiple vulnerabilities were identified in Linux Kernel, which could be exploited by malicious users to cause a denial of service and potentially obtain elevated privileges.
- The first issue is due to an error in "mm/mempolicy.c" when handling policy system calls, which could be exploited by local attackers to cause a denial of service via a "set_mempolicy" call with a 0 bitmask.
- The second flaw is due to a one-byte buffer overrun error in "kernel/sysctl.c" when processing an overly long user-supplied string, which could be exploited by local attackers to potentially execute arbitrary commands.
- The third vulnerability is due to an error in "net/ipv4/fib_frontend.c" when processing malformed "fib_lookup" netlink messages, which could cause illegal memory references.
- The fourth issue is due to a buffer overflow error in the CA-driver for TwinHan DST Frontend/Card [drivers/media/dvb/bt8xx/dst_ca.c], which could be exploited by malicious users to cause a denial of service or potentially execute arbitrary commands.

Affected Products
Linux Kernel version 2.6.x

Solution
Upgrade to Linux Kernel version 2.6.15


See full advisory: FrSIRT/ADV-2006-0035.

nx5000 01-17-2006 02:36 AM
2006-01-16 CVE-2006-0035/0036/0037 (netlink_rcv_skb, PPTP NAT helper)
 
Advisory ID : FrSIRT/ADV-2006-0220
CVE ID : CVE-2006-0035 - CVE-2006-0036 - CVE-2006-0037
Rated as : Moderate Risk
CVSS Severity: 3.5 (Low), 3.3 (Low), 2.3 (Low)
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2006-01-16

Technical Description

Multiple vulnerabilities were identified in Linux Kernel, which could be exploited by remote or local attackers to cause a denial of service.

The first issue is due to an infinite loop in the "netlink_rcv_skb" [af_netlink.c] function when handling a specially crafted "nlmsg_len" value, which could be exploited by local attackers to cause a denial of service.

The second flaw is due to an error in the PPTP NAT helper that does not properly calculate the offset when handling an inbound "PPTP_IN_CALL_REQUEST" packet, which could be exploited by attackers to crash a vulnerable system.

The third vulnerability is due to an error in the PPTP NAT helper that does not properly calculate the offset based on the difference between two pointers to the header, which could be exploited by attackers to cause a kernel crash.

Affected Products

Linux Kernel version 2.6.15 and prior

Solution

Upgrade to Linux Kernel 2.6.15.1 :
http://www.kernel.org/

Credits

Vulnerabilities reported by Martin Murray and the vendor

See full advisory

nx5000 01-18-2006 01:48 AM
2006-01-17 CVE-2006-0095 ( dm-crypt)
 
Advisory ID : FrSIRT/ADV-2006-0235
CVE ID : CVE-2006-0095
Rated as : Low Risk
CVSS Severity: 1.6 (Low)
Remotely Exploitable : No
Locally Exploitable : Yes
Release Date : 2006-01-17


Technical Description

A vulnerability has been identified in Linux Kernel, which could be exploited by local attackers to gain knowledge of sensitive information. This flaw is due to an error in the "dm-crypt" [drivers/md/dm-crypt.c] driver that fails to properly clear memory before freeing it, which could be exploited by malicious users to disclose sensitive about cryptographic keys.

Affected Products

Linux Kernel version 2.6.15.1 and prior

Solution

Upgrade to Linux Kernel version 2.6.15.2 :
http://www.kernel.org


Credits

Vulnerability reported by Stefan Rompf

See full advisory

nx5000 02-06-2006 01:24 AM
2006-02-02 CVE-2006-0482 (compat_sys_clock_settime for SPARC)
 
Advisory ID : FrSIRT/ADV-2006-0418
CVE ID : CVE-2006-0482
Rated as : Low Risk
CVSS Severity: 1.6 (Low)
Remotely Exploitable : No
Locally Exploitable : Yes
Release Date : 2006-02-02

Technical Description

A vulnerability has been identified in Linux Kernel, which could be exploited by malicious users to cause a denial of service. This flaw is due to an error in the "compat_sys_clock_settime()" [arch/sparc64/kernel/sys32.S] function that provides invalid sign extended arguments to the "get_compat_timespec()" function call when processing a "date -s" command on SPARC architectures, which could be exploited by local attackers to panic the system, creating a denial of service condition.

Affected Products

Linux Kernel version 2.6.15.1 and prior

Solution

The FrSIRT is not aware of any official supplied patch for this issue.

Credits

Vulnerability reported by Ludovic Courtès

See full advisory: FrSIRT/ADV-2006-0418

nx5000 02-08-2006 07:25 AM
2006-02-08 CVE-2006-0454 (icmp response remote DoS)
 
Advisory ID : FrSIRT/ADV-2006-0464
CVE ID : CVE-2006-0454
Rated as : Moderate Risk
CVSS Severity: 2.3 (Low)
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2006-02-08

Technical Description

A vulnerability has been identified in Linux Kernel, which could be exploited by remote attackers to cause a denial of service. This flaw is due to an error in the "ip_options_echo()" [net/ipv4/icmp.c] function when constructing an ICMP response, which could be exploited by remote attackers to cause a denial of service by sending specially crafted ICMP packets containing record-route or timestamp IP options to a vulnerable system.

Affected Products

Linux Kernel versions 2.6.12 through 2.6.15.2

Solution

Upgrade to Linux Kernel 2.6.15.3 :
http://www.kernel.org/


Credits

Vulnerability reported by the vendor

See full advisory

unSpawn 02-21-2006 05:27 PM
2006-02-21CAN-2005-1767 (Stack Fault Exceptions Unspecified DoS)
 
HTTP link: http://www.securityfocus.com/bid/14467
Bugtraq ID: 14467
CVE ID : CAN-2005-1767
Remotely: No
Local: Yes
Release Date : 2006-02-21


Description
Linux kernel is reported prone to an unspecified local denial of service vulnerability. It was reported that this issue arises when a local user triggers stack fault exceptions. A local attacker may exploit this issue to carry out a denial of service attack against a vulnerable computer by crashing the kernel.


Affected Products
Linux Kernel versions 2.4 to 2.6


Solution
Upgrade to latest Linux Kernel: http://www.kernel.org/

win32sux 03-02-2006 10:40 AM
Linux Kernel Local Denial of Service Vulnerabilities (Not Critical)
 
Quote:
CVE reference: CVE-2006-0554, CVE-2006-0555, CVE-2006-0741

Description:
Some vulnerabilities have been reported in the Linux kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

1) An error in the "nfs_get_user_pages()" function due to insufficient checks on the return value returned by the "get_user_pages()" function can be exploited to cause a local DoS by performing an O_DIRECT write to an NFS file where the user buffer starts with a valid mapped page, but also contains an unmapped page.

2) Missing checks for bad elf entry addresses can be exploited to cause an endless recursive fault on Intel systems, which results in a local DoS.

An error in the XFS "ftruncate()" function, which may expose stale data off disk to users, has also been reported.

Solution:
Update to version 2.6.15.5.
http://www.kernel.org/
Secunia Advisory: http://secunia.com/advisories/19083/

win32sux 03-08-2006 01:48 AM
Linux Kernel "die_if_kernel()" Potential Denial of Service (Not Critical)
 
Quote:
CVE reference: CVE-2006-0742

Description:
A vulnerability has been reported in the Linux kernel, which potentially can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to the "die_if_kernel()" function in "arch/ia64/kernel/unaligned.c" being erroneously marked with a "noreturn" attribute. This can potentially be exploited to cause a DoS on Itanium systems, when the kernel is compiled with certain version of the gcc compiler.

Solution:
Update to version 2.6.15.6.
http://www.kernel.org/
Secunia Advisory: http://secunia.com/advisories/19078/

unSpawn 03-22-2006 07:07 AM
Linux kernel Netfilter/do_replace and NDIS response (Moderately critical)
 
HTTP link: http://secunia.com/advisories/19330/
CVE ID : unknown
Remotely: no
Release Date : 2006-03-22

Description
Two vulnerabilities have been reported in the Linux Kernel, which has an unknown impact.

1) An integer overflow error exists within the "do_replace()" function in Netfilter. This can be exploited to cause a buffer overflow and allows the overwrite of arbitrary amounts of kernel memory when data is copied from user space.

2) Insufficient memory allocation in "drivers/usb/gadget/rndis.c" when handling NDIS response to OID_GEN_SUPPORTED_LIST may cause kernel memory corruption.

Solution:
Update to version 2.6.16.
http://www.kernel.org/

win32sux 03-22-2006 07:25 AM
Quote:
Originally Posted by unSpawn
An integer overflow error exists within the "do_replace()" function in Netfilter. This can be exploited to cause a buffer overflow and allows the overwrite of arbitrary amounts of kernel memory when data is copied from user space.
Quote:
From: Harald Welte <laforge@netfilter.org>
To: vuldb@securityfocus.com
Date: Wed, 22 Mar 2006 11:57:17 +0100
Subject: Wrong information on http://www.securityfocus.com/bid/17178/discuss
Hi!

As a member of the netfilter core team, I would like to ask you to
immediately stop spreading false information about an allegeldy remotely
exploitable vulnerability that simply doesn't exist.

I don't know how you come to the conclusion at
http://www.securityfocus.com/bid/17178/discuss, that "This issue allows
remote attackers to overwrite kernel memory with arbitrary data,
potentially allowing them to execute malicious machine code in the
context of affected kernels."

The respective bug [called do_replace() bug] is in a code path that can
ONLY be executed by a local root user. In fact, it is a bug in the
codepath for ruleset changes.

So unless you have a locally malicious root user (which could change the
ruleset anyway, and very likely load arbitrary code via kernel modules
or patch /proc/kmem), there is nothing that can be exploited.

Neither for local non-root users, not for any remote party.

Please correct information in your vulnerability data base as soon as
possible! Your wrong assessment has already been picked up by some
other news sites, and users are starting to inquire the project about a
security threat that doesn't even exist.

Thanks in advance,
Harald
NOTE: This post is only meant as a follow-up, to further inform admins about this specific bug (so that no unnecessary freaking-out occurs). It should not be interpreted as a "discussion starter" in any way. To discuss this bug (or any others), please use a separate thread, as was indicated in the OP by unSpawn. Thanks.

win32sux 03-23-2006 11:43 AM
Linux Kernel IPv4 "sockaddr_in.sin_zero" Information Disclosure (Not Critical)
 
Quote:
CVE reference: CVE-2006-1342, CVE-2006-1343

Description:
Pavel Kankovsky has reported a weakness in the Linux kernel, which can be exploited by malicious, local users to disclose potentially sensitive information.

The weakness is caused due to the "sockaddr_in.sin_zero" array not being zeroed before being returned to user space programs calling certain socket functions to retrieve information about the specified socket. This can be exploited to disclose six uninitialised bytes of the kernel stack via calls to the "getsockopt()" function with the "SO_ORIGINAL_DST" option, or via calls to the "getsockname()", "getpeername()", and "accept()" functions.

The weakness has been reported in the 2.4 and 2.6 kernel branches.

NOTE: The weakness in the "getsockname()", "getpeername()", and "accept()" functions affect only the 2.4 kernel.

Solution:
The weakness have been fixed in the 2.4 kernel branch in the CVS repositories.

Secunia is currently not aware of any official patches for the 2.6 kernel.
Secunia Advisory: http://secunia.com/advisories/19357/

win32sux 03-28-2006 11:26 AM
Linux Kernel IP ID Value Increment Weakness (Not Critical)
 
Quote:
CVE reference: CVE-2006-1242

Description:
Marco Ivaldi has reported a weakness in the Linux kernel, which can be exploited by malicious people to disclose certain system information and potentially to bypass certain security restrictions.

The weakness is caused due to an error within the "ip_push_pending_frames()" function when creating a packet in reply to a received SYN/ACK packet. This causes RST packets to be sent with a IP ID value that is incremented per packet. This can potentially be exploited to conduct idle scan attacks.

The weakness has been reported in the 2.4 and 2.6 kernel branches.

Solution:
Update to version 2.6.16.1.
http://www.kernel.org/

Secunia is currently not aware of any official patches for the 2.4 kernel.
Secunia Advisory: http://secunia.com/advisories/19402/

win32sux 04-07-2006 07:19 AM
Linux Kernel Sysfs Local Denial of Service Vulnerability (Not Critical)
 
Quote:
CVE reference: CVE-2006-1055

Description:
A vulnerability has been reported in Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to an out-of-bounds memory error in the "fill_write_buffer()" function in sysfs/file.c when writing exactly PAGE_SIZE amount of data with no zeroes in it to a sysfs file.

Solution:
The vulnerability has been fixed in version 2.6.17-rc1.
Secunia Advisory: http://secunia.com/advisories/19495/



UPDATE: Stable kernel 2.6.16.2 has just been released. It includes the patch for CVE-2006-1055, among other things. As usual, you can get your copy at: http://www.kernel.org/

win32sux 04-11-2006 11:54 AM
Linux Kernel "__keyring_search_one()" Denial of Service (Not Critical)
 
Quote:
CVE reference: CVE-2006-1522

Description:
A vulnerability has been reported in Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the "__keyring_search_one()" function when adding a key to a non-keyring key.

Solution:
Update to version 2.6.16.3 or later.
Secunia Advisory: http://secunia.com/advisories/19573/



UPDATE #1: 2.6.16.4 has been released.

Less than 12 hours after 2.6.16.3 was released, the -stable team patched the code with a one-liner, releasing 2.6.16.4. A Secunia advisory isn't out yet, but the commit in git states the patch addresses an issue with RCU signal handling, which is CVE-2006-1523.


UPDATE #2: 2.6.16.5 has been released.

One day after 2.6.16.4 was released, the -stable team patched the code once again, releasing 2.6.16.5. A Secunia advisory isn't out yet, but git shows that one patch addresses an issue with uncanonical return addresses on x86_64, which is CVE-2006-0744 .

win32sux 04-12-2006 06:46 PM
This post is just a bump, so that all thread subscribers are made aware of the two updates which were made to the previous post yesterday (UPDATE #1) and today (UPDATE #2).

win32sux 04-18-2006 05:14 AM
Linux 2.6.16.6 was released about 13 hours ago. As can be seen in the ChangeLog, it included a fair number of bugfix patches (23 commits since 2.6.16.5 was released). One of these patches was indeed assigned a CVE ID. In Hugh Dickins' (patch author) own words:
Quote:
I found that all of 2.4 and 2.6 have been letting mprotect give write permission to a readonly attachment of shared memory, whether or not IPC would give the caller that permission.
View Commit

About two hours after the release of 2.6.16.6, the code was patched once again by Hugh Dickins - and Linux 2.6.16.7 was released.

This is CVE-2006-1524.

win32sux 04-18-2006 06:38 PM
Linux 2.6.16.8 has been released. From the ChangeLog:
Quote:
This fixes http://bugzilla.kernel.org/show_bug.cgi?id=6388
The bug is caused by ip_route_input dereferencing skb->nh.protocol of the dummy skb passed dow from inet_rtm_getroute (Thanks Thomas for seeing it). It only happens if the route requested is for a multicast IP address.
This is CVE-2006-1525.

win32sux 04-19-2006 06:55 AM
Linux 2.6.16.9 has been released. From the ChangeLog:
Quote:
AMD K7/K8 CPUs only save/restore the FOP/FIP/FDP x87 registers in FXSAVE when an exception is pending. This means the value leak through context switches and allow processes to observe some x87 instruction state of other processes.
This is CVE-2006-1056.

win32sux 04-20-2006 01:16 PM
Linux Kernel perfmon Local Denial of Service Vulnerability (Not Critical)
 
Quote:
Description:
A vulnerability has been reported in Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in perfmon (perfmon.c) during exit processing and may cause a crash when a task is interrupted while another process is accessing the "mm_struct" structure.

Solution:
Secunia is currently not aware of an official version addressing this.
Secunia Advisory

This is CVE-2006-0558.

win32sux 04-28-2006 04:15 PM
Linux Kernel CIFS chroot Directory Traversal Vulnerability (Not Critical)
 
Quote:
Description:
Marcel Holtmann has reported a vulnerability in the Linux Kernel, which can be exploited by malicious, local users to bypass certain security restrictions.

The vulnerability is caused due to an input validation error in the CIFS mounted filesystem. This can be exploited to bypass chroot restrictions via the "..\\" directory traversal sequences.

The vulnerability has been reported in versions prior to 2.6.16.11.

Solution:
Update to version 2.6.16.11.
Secunia Advisory

This is CVE-2006-1863.

win32sux 04-28-2006 04:19 PM
Linux Kernel SMBFS chroot Directory Traversal Vulnerability (Not Critical)
 
Quote:
Description:
Marcel Holtmann has reported a vulnerability in the Linux Kernel, which can be exploited by malicious, local users to bypass certain security restrictions.

The vulnerability is caused due to an input validation error in the SMBFS mounted filesystem. This can be exploited to bypass chroot restrictions via the "..\\" directory traversal sequences.

Solution:
Restrict access to affected systems.

Secunia is currently not aware of an official version addressing this.
Secunia Advisory

This is CVE-2006-1864.

win32sux 05-02-2006 06:36 PM
Linux 2.6.16.13 has been released. It fixes a Netfilter vulnerability.

From the git commit:
Quote:
[NETFILTER]: SCTP conntrack: fix infinite loop

fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
guarantee progress of for_each_sctp_chunk(). (all other uses of
for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
should be complete.)
This is CVE-2006-1527.

win32sux 05-05-2006 07:10 AM
Linux 2.6.16.14 has been released. It fixes a smbfs chroot vulnerability.

From the ChangeLog:
Quote:
Mark Moseley reported that a chroot environment on a SMB share can be left via "cd ..\\". Similar to CVE-2006-1863 issue with cifs, this fix is for smbfs.
This is CVE-2006-1864.

win32sux 05-09-2006 07:50 AM
SCTP Denial of Service Vulnerabilities (Moderately Critical)
 
Quote:
Description:
Mu Security research team has reported two vulnerabilities in Linux Kernel, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) An incorrect use of state table entries in the SCTP code when certain ECNE chunks are received in CLOSED state can be exploited to cause kernel panic via a specially crafted packet.

2) An error in the handling of incoming IP-fragmented SCTP control chunks can be exploited to cause kernel panic via specially crafted packets.

The vulnerabilities have been reported in version 2.6.16. Other versions may also be affected.

Solution:
The vulnerabilities have been fixed in the CVS repositories, and will reportedly be fixed in version 2.6.17.
Secunia Advisory


Patches for this can be found here:

http://git.kernel.org/git/?p=linux/k...60e84637bc432e

http://git.kernel.org/git/?p=linux/k...dd1d8191a6e813

win32sux 05-09-2006 03:33 PM
Linux 2.6.16.15 has been released. It consists of these SCTP patches:

Quote:
Prevent possible infinite recursion with multiple bundled DATA.
CVE-2006-2274 | Commit


Quote:
Allow spillover of receive buffer to avoid deadlock.
CVE-2006-2275 | Commit


Quote:
Fix state table entries for chunks received in CLOSED state.
CVE-2006-2271 | Commit


Quote:
Fix panic's when receiving fragmented SCTP control chunks.
CVE-2006-2272 | Commit


The ChangeLog is available here.

win32sux 05-10-2006 10:33 PM
Linux 2.6.16.16 has been released. It's a basically a patch for CVE-2006-1860.

From the ChangeLog:
Quote:
It is insane to be giving lease_init() the task of freeing the lock it is
supposed to initialise, given that the lock is not guaranteed to be
allocated on the stack. This causes lockups in fcntl_setlease().

win32sux 05-20-2006 07:26 PM
Linux 2.6.16.17 has been released.

The ChangeLog shows three CVE issues (among other things) are addressed:

Quote:
SCTP: Validate the parameter length in HB-ACK chunk

If SCTP receives a badly formatted HB-ACK chunk, it is possible
that we may access invalid memory and potentially have a buffer
overflow. We should really make sure that the chunk format is
what we expect, before attempting to touch the data.
CVE-2006-1857


Quote:
SCTP: Respect the real chunk length when walking parameters

When performing bound checks during the parameter processing, we
want to use the real chunk and paramter lengths for bounds instead
of the rounded ones. This prevents us from potentially walking of
the end if the chunk length was miscalculated. We still use rounded
lengths when advancing the pointer. This was found during a
conformance test that changed the chunk length without modifying
parameters.
CVE-2006-1858


Quote:
Netfilter: do_add_counters race, possible oops or info leak

Solar Designer found a race condition in do_add_counters(). The beginning
of paddc is supposed to be the same as tmp which was sanity-checked
above, but it might not be the same in reality. In case the integer
overflow and/or the race condition are triggered, paddc->num_counters
might not match the allocation size for paddc. If the check below
(t->private->number != paddc->num_counters) nevertheless passes (perhaps
this requires the race condition to be triggered), IPT_ENTRY_ITERATE()
would read kernel memory beyond the allocation size, potentially causing
an oops or leaking sensitive data (e.g., passwords from host system or
from another VPS) via counter increments. This requires CAP_NET_ADMIN.
CVE-2006-0039

win32sux 05-22-2006 06:09 PM
Linux 2.6.16.18 has been released.

The ChangeLog shows it consists of a single patch for a Netfilter SNMP NAT issue:
Quote:
Fix memory corruption caused by snmp_trap_decode:

- When snmp_trap_decode fails before the id and address are allocated,
the pointers contain random memory, but are freed by the caller
(snmp_parse_mangle).

- When snmp_trap_decode fails after allocating just the ID, it tries
to free both address and ID, but the address pointer still contains
random memory. The caller frees both ID and random memory again.

- When snmp_trap_decode fails after allocating both, it frees both,
and the callers frees both again.

The corruption can be triggered remotely when the ip_nat_snmp_basic
module is loaded and traffic on port 161 or 162 is NATed.
This is CVE-2006-2444.

win32sux 05-31-2006 11:22 AM
Linux 2.6.16.19 has been released.

The ChangeLog shows it consists of a Netfilter information disclosure patch:
Quote:
Fix small information leak in SO_ORIGINAL_DST

It appears that sockaddr_in.sin_zero is not zeroed during
getsockopt(...SO_ORIGINAL_DST...) operation. This can lead
to an information leak.
This is CVE-2006-1343.

win32sux 05-31-2006 12:43 PM
Linux Kernel SMP "/proc" Race Condition Denial of Service (Not Critical)
 
Quote:
Description:
Tony Griffiths has reported a vulnerability in the Linux Kernel, which can be exploited malicious, local users to cause a DoS (Denial of Service).

The vulnerability is cause due to a memory corruption error in the "dentry_unused" list within the "prune_dcache()" function. This can be exploited to crash the kernel when running on SMP hardware by causing a race condition such that one or more tasks exit while another task is reading their /proc entries.

The vulnerability has been reported in versions 2.6.15 through 2.6.17. Other versions may also be affected.

Solution:
Grant only trusted users access to affected systems.

Secunia is currently not aware of an official version addressing this.
Secunia Advisory

This is CVE-2006-2629.

win32sux 06-20-2006 12:17 PM
Linux 2.6.16.21 and 2.6.17.1 have been released. Both releases address security issues.

Regarding 2.6.16.21:

The ChangeLog shows it consists of 4 patches, 3 of which have CVE IDs:

Quote:
[PATCH] xt_sctp: fix endless loop caused by 0 chunk length
This is CVE-2006-3085.

Quote:
[PATCH] run_posix_cpu_timers: remove a bogus BUG_ON()
This is CVE-2006-2445.

Quote:
[PATCH] powerpc: Fix machine check problem on 32-bit kernels
This is CVE-2006-2448.



Regarding 2.6.17.1:

The ChangeLog shows it consists of a patch for CVE-2006-3085:

Quote:
[PATCH] xt_sctp: fix endless loop caused by 0 chunk length
Secunia Advisory

win32sux 06-30-2006 05:58 PM
Linux 2.6.16.23 and 2.6.17.3 have been released.

Both releases address a Netfilter vulnerability:
Quote:
NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks

When a packet without any chunks is received, the newconntrack variable
in sctp_packet contains an out of bounds value that is used to look up an
pointer from the array of timeouts, which is then dereferenced, resulting
in a crash.
This is CVE-2006-2934.

ChangeLogs: 2.6.16.23, 2.6.17.3.

win32sux 07-07-2006 05:30 AM
Linux 2.6.16.24 and 2.6.17.4 have been released.

Both releases address a core dump handling vulnerability:
Quote:
fix prctl privilege escalation and suid_dumpable

During security research, Red Hat discovered a behavioral flaw in core
dump handling. A local user could create a program that would cause a
core file to be dumped into a directory they would not normally have
permissions to write to. This could lead to a denial of service (disk
consumption), or allow the local user to gain root privileges.
This is CVE-2006-2451.

ChangeLogs: 2.6.16.24, 2.6.17.4.

win32sux 07-14-2006 11:43 PM
Linux 2.6.16.25 and 2.6.17.5 have been released.

Both releases address a /proc vulnerability:
Quote:
Fix nasty /proc vulnerability

We have a bad interaction with both the kernel and user space being able
to change some of the /proc file status. This fixes the most obvious
part of it, but I expect we'll also make it harder for users to modify
even their "own" files in /proc.
This is CVE-2006-3626.

ChangeLogs: 2.6.16.25, 2.6.17.5.


UPDATE: Linux 2.6.16.26 and 2.6.17.6 were released shortly after, to relax the /proc fix a bit. Because this patch isn't in and of itself a vulnerability fix, I will not be making a new post for it (this thread is only for vulnerabilities, not just any bugfixes).
Quote:
Clearign all of i_mode was a bit draconian. We only really care about
S_ISUID/ISGID, after all.
ChangeLogs: 2.6.16.26, 2.6.17.6.

win32sux 07-19-2006 07:07 AM
Linux 2.6.16.27 has been released.

It's three patches, one of which addresses a security vulnerability:
Quote:
USB serial ftdi_sio: Prevent userspace DoS

This patch limits the amount of outstanding 'write' data that can be
queued up for the ftdi_sio driver, to prevent userspace DoS attacks (or
simple accidents) that use up all the system memory by writing lots of
data to the serial port.
This is CVE-2006-2936.

ChangeLog: 2.6.16.27.

win32sux 07-24-2006 11:00 PM
Linux 2.6.17.7 has been released.

It consists of many patches, one of which addresses a security vulnerability:
Quote:
USB serial ftdi_sio: Prevent userspace DoS

This patch limits the amount of outstanding 'write' data that can be
queued up for the ftdi_sio driver, to prevent userspace DoS attacks (or
simple accidents) that use up all the system memory by writing lots of
data to the serial port.
This is CVE-2006-2936 (this was patched in 2.6.16.y over a week ago).

ChangeLog: 2.6.17.7.

win32sux 08-07-2006 12:46 PM
Linux Kernel Ext3 Invalid Inode Number Denial of Service
 
Quote:
James McKenzie has reported a vulnerability in Linux Kernel, which can be exploited by malicious users to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in ext3 when handling an invalid inode number. This can be exploited by sending a specially crafted NFS request with a V2 procedure (e.g. V2_LOOKUP) that specifies an invalid inode number.

Successful exploitation causes the exported directory to be remounted read-only.

The vulnerability has been reported in versions 2.6.14.4, 2.6.17.6, and 2.6.17.7. Other versions may also be affected.
Secunia Advisory | CVE-2006-3468

NOTE: It seems like 2.6.17.8 addresses this, but it's not entirely clear whether the patch is a temporary workaround or a permanent fix.

win32sux 08-11-2006 01:56 PM
Linux 2.4.33 has been released.

It consists of a great deal of maintenance patches over 2.4.32, several of which address security vulnerabilities. Here's the essence, as far as patches with CVE IDs are concerned:

Quote:
[NETFILTER]: Fix do_add_counters race, possible oops or info leak (CVE-2006-0039)
Quote:
[SCTP]: Validate the parameter length in HB-ACK chunk. (CVE-2006-1857)
Quote:
[SCTP]: Respect the real chunk length when walking parameters. (CVE-2006-1858)
Quote:
smbfs chroot issue (CVE-2006-1864)
Quote:
[SCTP]: Fix state table entries for chunks received in CLOSED state. (CVE-2006-2271)
Quote:
[SCTP]: Fix panic's when receiving fragmented SCTP control chunks. (CVE-2006-2272)
Quote:
[IPV4]: ip_route_input panic fix (CVE-2006-1525)
Quote:
[SCTP]: Prevent possible infinite recursion with multiple bundled DATA. (CVE-2006-2274)
Quote:
fix shm mprotect (CVE-2006-1524)
Quote:
orinoco: CVE-2005-3180: Information leakage due to incorrect padding
Quote:
Backport of CVE-2005-2709 fix
Quote:
x86-64: user code panics kernel in exec.c (CVE-2005-2708)
Quote:
Fix sendmsg overflow (CVE-2005-2490)
The complete ChangeLog is here.

NOTE: I realize it might be a little odd to see the 2.4.x kernel make it into this thread. But considering that 2.4.x is still in such wide use, I feel it's important we post vulnerability reports for it also. Furthermore, the release of 2.4.33 seems like the perfect time to start doing so IMHO.

win32sux 08-17-2006 07:39 PM
Linux Kernel UDF Truncation Denial of Service (Not Critical)
 
Quote:
Description:
Colin reported a vulnerability in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in UDF and can be exploited to cause the system to stop responding by truncating certain files.

Solution:
Restrict access to UDF partitions to trusted users only.
Secunia Advisory | CVE-2006-4145

win32sux 08-18-2006 12:38 PM
Linux 2.6.17.9 has been released.

It consists of a single patch for a PowerPC vulnerability:
Quote:
Clear HID0[en_attn] at CPU init time on PPC970.
CVE-2006-4093 | ChangeLog

win32sux 08-19-2006 09:28 PM
Linux 2.4.33.1 has been released.

It includes a patch for the PowerPC vulnerability, as well as one for CVE-2006-1528.

The ChangeLog is here.

win32sux 08-22-2006 06:15 PM
Linux 2.4.33.2 has been released.

It includes a patch for CVE-2006-3745 (SCTP local privilage elevation).

The ChangeLog is here.

win32sux 08-22-2006 06:20 PM
Linux 2.6.17.10 has been released.

It consists of three patches, two of which have CVE IDs:
Quote:
Fix possible UDF deadlock and memory corruption

UDF code is not really ready to handle extents larger that 1GB. This is
the easy way to forbid creating those.

Also truncation code did not count with the case when there are no
extents in the file and we are extending the file.
This is CVE-2006-4145.

Quote:
Fix sctp privilege elevation

sctp_make_abort_user() now takes the msg_len along with the msg
so that we don't have to recalculate the bytes in iovec.
It also uses memcpy_fromiovec() so that we don't go beyond the
length allocated.

It is good to have this fix even if verify_iovec() is fixed to
return error on overflow.
This is CVE-2006-3745.

The 2.6.17.10 ChangeLog is here.


UPDATE: Linux 2.6.17.11 has been released, but because it doesn't seem to include any fixes for security vulnerabilities, a new post here isn't warranted.

win32sux 08-26-2006 07:10 PM
Linux 2.6.16.28 has been released.

It consists of several bugfixes, four of which address security vulnerabilities.

From the ChangeLog:
Quote:
Security fixes since 2.6.16.27:
- CVE-2006-2935: cdrom: fix bad cgc.buflen assignment
- CVE-2006-3745: Fix sctp privilege elevation
- CVE-2006-4093: powerpc: Clear HID0 attention enable on PPC970 at boot time
- CVE-2006-4145: Fix possible UDF deadlock and memory corruption

win32sux 08-31-2006 04:14 PM
Linux 2.4.33.3 has been released.

It includes a patch for CVE-2006-4145 (UDF deadlock and memory corruption).

The full ChangeLog is here.

win32sux 09-11-2006 06:06 PM
Linux Kernel ULE Packet Handling Denial of Service (Less Critical)
 
Quote:
Description:
Ang Way Chuang has reported a vulnerability in Linux Kernel, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the ULE (Unidirectional Lightweight Encapsulation) decapsulation code when processing ULE packets. This can be exploited to crash the system by sending a malicious ULE packet with an SNDU (Sub Network Data Unit) size of 0.

The vulnerability has been reported in version 2.6.17.11. Other versions may also be affected.

Solution:
Secunia is currently not aware of an official version fixing the vulnerability.
Secunia Advisory | CVE-2006-4623

win32sux 09-15-2006 02:06 AM
Linux 2.6.16.29 has been released.
 
It consists of many bugfixes, three of which address security vulnerabilities.
Quote:
Security fixes since 2.6.16.28:
- CVE-2006-3468: fix NFS over ext3 DoS
- fix NFS over ext2 DoS
- ipv6: fix oops triggerable by any user
ChangeLog | Patch | Tarball

win32sux 09-19-2006 01:08 PM
Linux Kernel SCTP Denial of Service Vulnerability (Not Critical)
 
Quote:
Description:
A vulnerability has been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the handling of SCTP sockets. This can be exploited to crash the Kernel by opening a SCTP socket with a special SO_LINGER value.

Solution:
Restrict access to trusted users only.
Secunia Advisory | CVE-2006-4535

NOTE: This affects both 2.4 and 2.6 kernels.

win32sux 10-07-2006 12:48 AM
Linux Kernel s390 "copy_from_user" Information Disclosure (Less Critical)
 
Quote:
Description:
A vulnerability has been reported in the Linux Kernel, which can be exploited by malicious, local users to gain knowledge of potentially sensitive information.

The vulnerability is caused due to the "copy_from_user" function not correctly clearing kernel buffers after receiving a fault because of invalid user space addresses. This can be exploited to read uninitialised kernel memory by appending to files from invalid addresses.

Note: The vulnerability affects the s390 architecture only.

Solution:
The vulnerability has been fixed in version 2.6.19-rc1.
Secunia Advisory | CVE-2006-5174


All times are GMT -5. The time now is 09:08 AM.
Page 1 of 6 1 23 Last »
Show 50 post(s) from this thread on one page