The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.

New kernels are available for Slackware 9.1 and -current to fix a bounds-checking problem in the kernel's mremap() call which could be used by a local attacker to gain root privileges. Please note that this is not the same issue as CAN-2003-0985 which was fixed in early January. The kernels in Slackware 8.1 and 9.0 that were updated in January are not vulnerable to this new issue because the patch from Solar Designer that was used to fix the CAN-2003-0985 bugs also happened to fix the problem that was discovered later. Sites running Slackware 9.1 or -current should upgrade to a new kernel. After installing the new kernel, be sure to run 'lilo'.

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap(2) system call. Due to flushing the TLB (Translation Lookaside Buffer, an address cache) too early it is possible for an attacker to trigger a local root exploit.

The attack vectors for 2.4.x and 2.2.x kernels are exclusive for the respective kernel series, though. We formerly believed that the exploitable vulnerability in 2.4.x does not exist in 2.2.x which is still true. However, it turned out that a second (sort of) vulnerability is indeed exploitable in 2.2.x, but not in 2.4.x, with a different exploit, of course.

Several local root exploits have been discovered recently in the Linux kernel. This security advisory updates the PA-RISC kernel 2.4.18 for Debian GNU/Linux. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update :

  - CAN-2003-0961 :
    An integer overflow in brk() system call (do_brk()     function) for Linux allows a local attacker to gain root     privileges. Fixed upstream in Linux 2.4.23.

  - CAN-2003-0985 :

    Paul Starzetz discovered a flaw in bounds checking in     mremap() in the Linux kernel (present in version 2.4.x     and 2.6.x) which may allow a local attacker to gain root     privileges. Version 2.2 is not affected by this bug.
    Fixed upstream in Linux 2.4.24.

  - CAN-2004-0077 :

    Paul Starzetz and Wojciech Purczynski of isec.pl     discovered a critical security vulnerability in the     memory management code of Linux inside the mremap(2)     system call. Due to missing function return value check     of internal functions a local attacker can gain root     privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.

Please note that the source package has to include a lot of updates in order to compile the package, which wasn't possible with the old source package.

Several local root exploits have been discovered recently in the Linux kernel. This security advisory updates the hppa kernel 2.4.17 for Debian GNU/Linux. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update :

  - CAN-2003-0961 :
    An integer overflow in brk() system call (do_brk()     function) for Linux allows a local attacker to gain root     privileges. Fixed upstream in Linux 2.4.23.

  - CAN-2003-0985 :

    Paul Starzetz discovered a flaw in bounds checking in     mremap() in the Linux kernel (present in version 2.4.x     and 2.6.x) which may allow a local attacker to gain root     privileges. Version 2.2 is not affected by this bug.
    Fixed upstream in Linux 2.4.24.

  - CAN-2004-0077 :

    Paul Starzetz and Wojciech Purczynski of isec.pl     discovered a critical security vulnerability in the     memory management code of Linux inside the mremap(2)     system call. Due to missing function return value check     of internal functions a local attacker can gain root     privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.

Several local root exploits have been discovered recently in the Linux kernel. This security advisory updates the mips kernel 2.4.19 for Debian GNU/Linux. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update :

  - CAN-2003-0961 :
    An integer overflow in brk() system call (do_brk()     function) for Linux allows a local attacker to gain root     privileges. Fixed upstream in Linux 2.4.23.

  - CAN-2003-0985 :

    Paul Starzetz discovered a flaw in bounds checking in     mremap() in the Linux kernel (present in version 2.4.x     and 2.6.x) which may allow a local attacker to gain root     privileges. Version 2.2 is not affected by this bug.
    Fixed upstream in Linux 2.4.24.

  - CAN-2004-0077 :

    Paul Starzetz and Wojciech Purczynski of isec.pl     discovered a critical security vulnerability in the     memory management code of Linux inside the mremap(2)     system call. Due to missing function return value check     of internal functions a local attacker can gain root     privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a critical security vulnerability in the memory management code of Linux inside the mremap(2) system call. Due to missing function return value check of internal functions a local attacker can gain root privileges.

Several security related problems have been fixed in the Linux kernel 2.4.17 used for the S/390 architecture, mostly by backporting fixes from 2.4.18 and incorporating recent security fixes. The corrections are listed below with the identification from the Common Vulnerabilities and Exposures (CVE) project :

  - CVE-2002-0429 :
    The iBCS routines in arch/i386/kernel/traps.c for Linux     kernels 2.4.18 and earlier on x86 systems allow local     users to kill arbitrary processes via a binary     compatibility interface (lcall).

  - CAN-2003-0001 :

    Multiple ethernet network interface card (NIC) device     drivers do not pad frames with null bytes, which allows     remote attackers to obtain information from previous     packets or kernel memory by using malformed packets, as     demonstrated by Etherleak.

  - CAN-2003-0244 :

    The route cache implementation in Linux 2.4, and the     Netfilter IP conntrack module, allows remote attackers     to cause a denial of service (CPU consumption) via     packets with forged source addresses that cause a large     number of hash table collisions related to the     PREROUTING chain.

  - CAN-2003-0246 :

    The ioperm system call in Linux kernel 2.4.20 and     earlier does not properly restrict privileges, which     allows local users to gain read or write access to     certain I/O ports.

  - CAN-2003-0247 :

    A vulnerability in the TTY layer of the Linux kernel 2.4     allows attackers to cause a denial of service ('kernel     oops').

  - CAN-2003-0248 :

    The mxcsr code in Linux kernel 2.4 allows attackers to     modify CPU state registers via a malformed address.

  - CAN-2003-0364 :

    The TCP/IP fragment reassembly handling in the Linux     kernel 2.4 allows remote attackers to cause a denial of     service (CPU consumption) via certain packets that cause     a large number of hash table collisions.

  - CAN-2003-0961 :

    An integer overflow in brk() system call (do_brk()     function) for Linux allows a local attacker to gain root     privileges. Fixed upstream in Linux 2.4.23.

  - CAN-2003-0985 :

    Paul Starzetz discovered a flaw in bounds checking in     mremap() in the Linux kernel (present in version 2.4.x     and 2.6.x) which may allow a local attacker to gain root     privileges. Version 2.2 is not affected by this bug.
    Fixed upstream in Linux 2.4.24.

  - CAN-2004-0077 :

    Paul Starzetz and Wojciech Purczynski of isec.pl     discovered a critical security vulnerability in the     memory management code of Linux inside the mremap(2)     system call. Due to missing function return value check     of internal functions a local attacker can gain root     privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.

Several local root exploits have been discovered recently in the Linux kernel. This security advisory updates the PowerPC/Apus kernel for Debian GNU/Linux. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update :

  - CAN-2003-0961 :
    An integer overflow in brk() system call (do_brk()     function) for Linux allows a local attacker to gain root     privileges. Fixed upstream in Linux 2.4.23.

  - CAN-2003-0985 :

    Paul Starzetz discovered a flaw in bounds checking in     mremap() in the Linux kernel (present in version 2.4.x     and 2.6.x) which may allow a local attacker to gain root     privileges. Version 2.2 is not affected by this bug.
    Fixed upstream in Linux 2.4.24.

  - CAN-2004-0077 :

    Paul Starzetz and Wojciech Purczynski of isec.pl     discovered a critical security vulnerability in the     memory management code of Linux inside the mremap(2)     system call. Due to missing function return value check     of internal functions a local attacker can gain root     privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.

Several local root exploits have been discovered recently in the Linux kernel. This security advisory updates the ARM kernel for Debian GNU/Linux. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update :

  - CAN-2003-0961 :
    An integer overflow in brk() system call (do_brk()     function) for Linux allows a local attacker to gain root     privileges. Fixed upstream in Linux 2.4.23.

  - CAN-2003-0985 :

    Paul Starzetz discovered a flaw in bounds checking in     mremap() in the Linux kernel (present in version 2.4.x     and 2.6.x) which may allow a local attacker to gain root     privileges. Version 2.2 is not affected by this bug.
    Fixed upstream in Linux 2.4.24.

  - CAN-2004-0077 :

    Paul Starzetz and Wojciech Purczynski of isec.pl     discovered a critical security vulnerability in the     memory management code of Linux inside the mremap(2)     system call. Due to missing function return value check     of internal functions a local attacker can gain root     privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.

The remote host is affected by the vulnerability described in GLSA-200403-02 (Linux kernel do_mremap local privilege escalation vulnerability)

    The memory subsystem allows for shrinking, growing, and moving of     chunks of memory along any of the allocated memory areas which the     kernel possesses.
    To accomplish this, the do_mremap code calls the do_munmap() kernel     function to remove any old memory mappings in the new location - but,     the code doesn't check the return value of the do_munmap() function     which may fail if the maximum number of available virtual memory area     descriptors has been exceeded.
    Due to the missing return value check after trying to unmap the middle     of the first memory area, the corresponding page table entries from the     second new area are inserted into the page table locations described by     the first old one, thus they are subject to page protection flags of     the first area. As a result, arbitrary code can be executed.
  Impact :

    Arbitrary code with normal non-super-user privileges may be able to     exploit this vulnerability and may disrupt the operation of other parts     of the kernel memory management subroutines finally leading to     unexpected behavior.
    Since no special privileges are required to use the mremap() and     munmap() system calls any process may misuse this unexpected behavior     to disrupt the kernel memory management subsystem. Proper exploitation     of this vulnerability may lead to local privilege escalation allowing     for the execution of arbitrary code with kernel level root access.
    Proof-of-concept exploit code has been created and successfully tested,     permitting root escalation on vulnerable systems. As a result, all     users should upgrade their kernels to new or patched versions.
  Workaround :

    Users who are unable to upgrade their kernels may attempt to use     'sysctl -w vm.max_map_count=1000000', however, this is a temporary fix     which only solves the problem by increasing the number of memory areas     that can be created by each process. Because of the static nature of     this workaround, it is not recommended and users are urged to upgrade     their systems to the latest available patched sources.

Paul Staretz discovered a flaw in return value checking in the mremap() function in the Linux kernel, versions 2.4.24 and previous that could allow a local user to obtain root privileges.

A vulnerability was found in the R128 DRI driver by Alan Cox. This could allow local privilege escalation.

A flaw in the ncp_lookup() function in the ncpfs code (which is used to mount NetWare volumes or print to NetWare printers) was found by Arjen van de Ven that could allow local privilege escalation.

The Vicam USB driver in Linux kernel versions prior to 2.4.25 does not use the copy_from_user function to access userspace, which crosses security boundaries. This problem does not affect the Mandrake Linux 9.2 kernel.

Additionally, a ptrace hole that only affects the amd64/x86_64 platform has been corrected.

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandrakesecure.net/en/kernelupdate.php

The remote host is missing the patch for the advisory SuSE-SA:2004:005 (Linux Kernel).


Another bug in the Kernel's do_mremap() function, which is unrelated to the bug fixed in SuSE-SA:2004:001, was found by Paul Starzetz.
The do_mremap() function of the Linux Kernel is used to manage Virtual Memory Areas (VMAs) which includes moving, removing and resizing of memory areas.  To remove old memory areas do_mremap() uses the function du_munmap() without checking the return value.
By forcing do_munmap() to return an error the memory management of a process can be tricked into moving page table entries from one VMA to another. The destination VMA may be protected by a different ACL which enables a local attacker to gain write access to previous read-only pages.
The result will be local root access to the system.

Additionally to the bug mentioned above some other bugs were fixed (depending on architecture) that can cause local denial-of-service conditions:
- Vicam USB driver: CVE-2004-0075 + denial-of-service due to problem while copying data from user to kernel space
- Direct Render Infrastructure: CVE-2004-0003 + denial-of-service due to integer overflow + needs r128 card and console to be exploited
- ncpfs/ncp_lookup: CVE-2004-0010 + buffer overflow with the probability to gain root
- execve():
+ malformed elf binaries can lead to a local denial-of-service attack

Paul Starzetz discovered a flaw in return value checking in mremap() in the Linux kernel versions 2.4.24 and previous that may allow a local attacker to gain root privileges. No exploit is currently available; however this issue is exploitable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0077 to this issue.

Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could allow local privilege escalation. ncpfs is only used to allow a system to mount volumes of NetWare servers or print to NetWare printers. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0010 to this issue.

All users are advised to upgrade to these errata packages, which contain backported security patches that correct these issues. 

Red Hat would like to thank Paul Starzetz from ISEC for reporting the issue CVE-2004-0077.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix a security vulnerability which may allow local users to gain root privileges are now available.

[Updated 5 March 2004] Added kernel-headers packages

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap() in the Linux kernel versions 2.4.24 and previous that may allow a local attacker to gain root privileges. No exploit is currently available; however this issue is exploitable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0077 to this issue.

Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could allow local privilege escalation. ncpfs is only used to allow a system to mount volumes of NetWare servers or print to NetWare printers. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0010 to this issue.

All users are advised to upgrade to these errata packages, which contain backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting this issue CVE-2004-0077.

Updated kernel packages that fix a security vulnerability that may allow local users to gain root privileges are now available. These packages also resolve other minor issues.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap() in the Linux kernel versions 2.4.24 and previous that may allow a local attacker to gain root privileges. No exploit is currently available; however this issue is exploitable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0077 to this issue.

All users are advised to upgrade to these errata packages, which contain backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting this issue.

For the IBM S/390 and IBM eServer zSeries architectures, the upstream version of the s390utils package (which fixes a bug in the zipl bootloader) is also included.

Updated kernel packages that fix a security vulnerability which may
allow local users to gain root privileges are now available.

[Updated 5 March 2004] Added kernel-headers packages

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap()
in the Linux kernel versions 2.4.24 and previous that may allow a
local attacker to gain root privileges. No exploit is currently
available; however this issue is exploitable. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0077 to this issue.

Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could
allow local privilege escalation. ncpfs is only used to allow a system
to mount volumes of NetWare servers or print to NetWare printers. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0010 to this issue.

All users are advised to upgrade to these errata packages, which
contain backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting this
issue CVE-2004-0077.

Updated kernel packages that fix a security vulnerability that may
allow local users to gain root privileges are now available. These
packages also resolve other minor issues.

The Linux kernel handles the basic functions of the operating system.

Paul Starzetz discovered a flaw in return value checking in mremap()
in the Linux kernel versions 2.4.24 and previous that may allow a
local attacker to gain root privileges. No exploit is currently
available; however this issue is exploitable. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0077 to this issue.

All users are advised to upgrade to these errata packages, which
contain backported security patches that correct these issues.

Red Hat would like to thank Paul Starzetz from ISEC for reporting this
issue.

For the IBM S/390 and IBM eServer zSeries architectures, the upstream
version of the s390utils package (which fixes a bug in the zipl
bootloader) is also included.

Paul Starzetz discovered a flaw in return value checking in mremap()
in the Linux kernel versions 2.4.24 and previous that may allow a
local attacker to gain root privileges. No exploit is currently
available; however this issue is exploitable. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0077 to this issue.

Arjan van de Ven discovered a flaw in ncp_lookup() in ncpfs that could
allow local privilege escalation. ncpfs is only used to allow a system
to mount volumes of NetWare servers or print to NetWare printers. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-0010 to this issue.

All users are advised to upgrade to these errata packages, which
contain backported security patches that correct these issues. 

Red Hat would like to thank Paul Starzetz from ISEC for reporting the
issue CVE-2004-0077.

ID	Name	Product	Family	Severity
18789	Slackware 9.1 / current : Kernel security update (SSA:2004-049-01)	Nessus	Slackware Local Security Checks	high
15351	Debian DSA-514-1 : kernel-image-sparc-2.2 - failing function and TLB flush	Nessus	Debian Local Security Checks	high
15312	Debian DSA-475-1 : linux-kernel-2.4.18-hppa - several vulnerabilities	Nessus	Debian Local Security Checks	high
15307	Debian DSA-470-1 : linux-kernel-2.4.17-hppa - several vulnerabilities	Nessus	Debian Local Security Checks	high
15303	Debian DSA-466-1 : linux-kernel-2.2.10-powerpc-apus - failing function and TLB flush	Nessus	Debian Local Security Checks	high
15293	Debian DSA-456-1 : linux-kernel-2.2.19-arm - failing function and TLB flush	Nessus	Debian Local Security Checks	high
15291	Debian DSA-454-1 : linux-kernel-2.2.22-alpha - failing function and TLB flush	Nessus	Debian Local Security Checks	high
15290	Debian DSA-453-1 : linux-kernel-2.2.20-i386+m68k+powerpc - failing function and TLB flush	Nessus	Debian Local Security Checks	high
15287	Debian DSA-450-1 : linux-kernel-2.4.19-mips - several vulnerabilities	Nessus	Debian Local Security Checks	high
15281	Debian DSA-444-1 : linux-kernel-2.4.17-ia64 - missing function return value check	Nessus	Debian Local Security Checks	high
15279	Debian DSA-442-1 : linux-kernel-2.4.17-s390 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
15278	Debian DSA-441-1 : linux-kernel-2.4.17-mips+mipsel - missing function return value check	Nessus	Debian Local Security Checks	high
15277	Debian DSA-440-1 : linux-kernel-2.4.17-powerpc-apus - several vulnerabilities	Nessus	Debian Local Security Checks	high
15276	Debian DSA-439-1 : linux-kernel-2.4.16-arm - several vulnerabilities	Nessus	Debian Local Security Checks	high
15275	Debian DSA-438-1 : linux-kernel-2.4.18-alpha+i386+powerpc - missing function return value check	Nessus	Debian Local Security Checks	high
14453	GLSA-200403-02 : Linux kernel do_mremap local privilege escalation vulnerability	Nessus	Gentoo Local Security Checks	high
14115	Mandrake Linux Security Advisory : kernel (MDKSA-2004:015)	Nessus	Mandriva Local Security Checks	high
13823	SuSE-SA:2004:005: Linux Kernel	Nessus	SuSE Local Security Checks	high
13679	Fedora Core 1 : kernel-2.4.22-1.2173.nptl (2004-079)	Nessus	Fedora Local Security Checks	high
12469	RHEL 2.1 : kernel (RHSA-2004:069)	Nessus	Red Hat Local Security Checks	high
12468	RHEL 3 : kernel (RHSA-2004:066)	Nessus	Red Hat Local Security Checks	high
801590	Red Hat 2004-069 Security Check	Log Correlation Engine	Generic	high
801589	Red Hat 2004-066 Security Check	Log Correlation Engine	Generic	high
801547	Fedora 2004-079 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2004-0077

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high