The ELF loader in Linux kernel 2.4 before 2.4.25 allows local users to cause a denial of service (crash) via a crafted ELF file with an interpreter with an invalid arch (architecture), which triggers a BUG() when an invalid VMA is unmapped.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-0427     A local denial of service vulnerability in do_fork() has     been found.

  - CVE-2005-0489     A local denial of service vulnerability in proc memory     handling has been found.

  - CVE-2004-0394     A buffer overflow in the panic handling code has been     found.

  - CVE-2004-0447     A local denial of service vulnerability through a NULL     pointer dereference in the IA64 process handling code     has been found.

  - CVE-2004-0554     A local denial of service vulnerability through an     infinite loop in the signal handler code has been found.

  - CVE-2004-0565     An information leak in the context switch code has been     found on the IA64 architecture.

  - CVE-2004-0685     Unsafe use of copy_to_user in USB drivers may disclose     sensitive information.

  - CVE-2005-0001     A race condition in the i386 page fault handler may     allow privilege escalation.

  - CVE-2004-0883     Multiple vulnerabilities in the SMB filesystem code may     allow denial of service or information disclosure.

  - CVE-2004-0949     An information leak discovered in the SMB filesystem     code.

  - CVE-2004-1016     A local denial of service vulnerability has been found     in the SCM layer.

  - CVE-2004-1333     An integer overflow in the terminal code may allow a     local denial of service vulnerability.

  - CVE-2004-0997     A local privilege escalation in the MIPS assembly code     has been found.

  - CVE-2004-1335     A memory leak in the ip_options_get() function may lead     to denial of service.

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2003-0984     Inproper initialization of the RTC may disclose     information.

  - CVE-2004-1070     Insufficient input sanitising in the load_elf_binary()     function may lead to privilege escalation.

  - CVE-2004-1071     Incorrect error handling in the binfmt_elf loader may     lead to privilege escalation.

  - CVE-2004-1072     A buffer overflow in the binfmt_elf loader may lead to     privilege escalation or denial of service.

  - CVE-2004-1073     The open_exec function may disclose information.

  - CVE-2004-1074     The binfmt code is vulnerable to denial of service     through malformed a.out binaries.

  - CVE-2004-0138     A denial of service vulnerability in the ELF loader has     been found.

  - CVE-2004-1068     A programming error in the unix_dgram_recvmsg() function     may lead to privilege escalation.

  - CVE-2004-1234     The ELF loader is vulnerable to denial of service     through malformed binaries.

  - CVE-2005-0003     Crafted ELF binaries may lead to privilege escalation,     due to insufficient checking of overlapping memory     regions.

  - CVE-2004-1235     A race condition in the load_elf_library() and     binfmt_aout() functions may allow privilege escalation.

  - CVE-2005-0504     An integer overflow in the Moxa driver may lead to     privilege escalation.

  - CVE-2005-0384     A remote denial of service vulnerability has been found     in the PPP driver.

  - CVE-2005-0135     An IA64 specific local denial of service vulnerability     has been found in the unw_unwind_to_user() function.

The following matrix explains which kernel version for which architecture fixes the problems mentioned above :

                                Debian 3.1 (sarge)              Source                        2.4.17-1woody4                  HP Precision architecture     32.5                            Intel IA-64 architecture      011226.18                       IBM S/390 architecture/image  2.4.17-2.woody.5                IBM S/390 architecture/patch  0.0.20020816-0.woody.4          PowerPC architecture (apus)   2.4.17-6                        MIPS architecture             2.4.17-0.020226.2.woody7

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-0427     A local denial of service vulnerability in do_fork() has     been found.

  - CVE-2005-0489     A local denial of service vulnerability in proc memory     handling has been found.

  - CVE-2004-0394     A buffer overflow in the panic handling code has been     found.

  - CVE-2004-0447     A local denial of service vulnerability through a NULL     pointer dereference in the IA64 process handling code     has been found.

  - CVE-2004-0554     A local denial of service vulnerability through an     infinite loop in the signal handler code has been found.

  - CVE-2004-0565     An information leak in the context switch code has been     found on the IA64 architecture.

  - CVE-2004-0685     Unsafe use of copy_to_user in USB drivers may disclose     sensitive information.

  - CVE-2005-0001     A race condition in the i386 page fault handler may     allow privilege escalation.

  - CVE-2004-0883     Multiple vulnerabilities in the SMB filesystem code may     allow denial of service or information disclosure.

  - CVE-2004-0949     An information leak discovered in the SMB filesystem     code.

  - CVE-2004-1016     A local denial of service vulnerability has been found     in the SCM layer.

  - CVE-2004-1333     An integer overflow in the terminal code may allow a     local denial of service vulnerability.

  - CVE-2004-0997     A local privilege escalation in the MIPS assembly code     has been found.

  - CVE-2004-1335     A memory leak in the ip_options_get() function may lead     to denial of service.

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2003-0984     Inproper initialization of the RTC may disclose     information.

  - CVE-2004-1070     Insufficient input sanitising in the load_elf_binary()     function may lead to privilege escalation.

  - CVE-2004-1071     Incorrect error handling in the binfmt_elf loader may     lead to privilege escalation.

  - CVE-2004-1072     A buffer overflow in the binfmt_elf loader may lead to     privilege escalation or denial of service.

  - CVE-2004-1073     The open_exec function may disclose information.

  - CVE-2004-1074     The binfmt code is vulnerable to denial of service     through malformed a.out binaries.

  - CVE-2004-0138     A denial of service vulnerability in the ELF loader has     been found.

  - CVE-2004-1068     A programming error in the unix_dgram_recvmsg() function     may lead to privilege escalation.

  - CVE-2004-1234     The ELF loader is vulnerable to denial of service     through malformed binaries.

  - CVE-2005-0003     Crafted ELF binaries may lead to privilege escalation,     due to insufficient checking of overlapping memory     regions.

  - CVE-2004-1235     A race condition in the load_elf_library() and     binfmt_aout() functions may allow privilege escalation.

  - CVE-2005-0504     An integer overflow in the Moxa driver may lead to     privilege escalation.

  - CVE-2005-0384     A remote denial of service vulnerability has been found     in the PPP driver.

  - CVE-2005-0135     An IA64 specific local denial of service vulnerability     has been found in the unw_unwind_to_user() function.

The following matrix explains which kernel version for which architecture fixes the problems mentioned above :

                                   Debian 3.0 (woody)                 Source                           2.4.19-4                           Sun Sparc architecture           26woody1                           Little endian MIPS architecture  0.020911.1.woody5

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-0427     A local denial of service vulnerability in do_fork() has     been found.

  - CVE-2005-0489     A local denial of service vulnerability in proc memory     handling has been found.

  - CVE-2004-0394     A buffer overflow in the panic handling code has been     found.

  - CVE-2004-0447     A local denial of service vulnerability through a NULL     pointer dereference in the IA64 process handling code     has been found.

  - CVE-2004-0554     A local denial of service vulnerability through an     infinite loop in the signal handler code has been found.

  - CVE-2004-0565     An information leak in the context switch code has been     found on the IA64 architecture.

  - CVE-2004-0685     Unsafe use of copy_to_user in USB drivers may disclose     sensitive information.

  - CVE-2005-0001     A race condition in the i386 page fault handler may     allow privilege escalation.

  - CVE-2004-0883     Multiple vulnerabilities in the SMB filesystem code may     allow denial of service or information disclosure.

  - CVE-2004-0949     An information leak discovered in the SMB filesystem     code.

  - CVE-2004-1016     A local denial of service vulnerability has been found     in the SCM layer.

  - CVE-2004-1333     An integer overflow in the terminal code may allow a     local denial of service vulnerability.

  - CVE-2004-0997     A local privilege escalation in the MIPS assembly code     has been found.

  - CVE-2004-1335     A memory leak in the ip_options_get() function may lead     to denial of service.

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2003-0984     Inproper initialization of the RTC may disclose     information.

  - CVE-2004-1070     Insufficient input sanitising in the load_elf_binary()     function may lead to privilege escalation.

  - CVE-2004-1071     Incorrect error handling in the binfmt_elf loader may     lead to privilege escalation.

  - CVE-2004-1072     A buffer overflow in the binfmt_elf loader may lead to     privilege escalation or denial of service.

  - CVE-2004-1073     The open_exec function may disclose information.

  - CVE-2004-1074     The binfmt code is vulnerable to denial of service     through malformed a.out binaries.

  - CVE-2004-0138     A denial of service vulnerability in the ELF loader has     been found.

  - CVE-2004-1068     A programming error in the unix_dgram_recvmsg() function     may lead to privilege escalation.

  - CVE-2004-1234     The ELF loader is vulnerable to denial of service     through malformed binaries.

  - CVE-2005-0003     Crafted ELF binaries may lead to privilege escalation,     due to insufficient checking of overlapping memory     regions.

  - CVE-2004-1235     A race condition in the load_elf_library() and     binfmt_aout() functions may allow privilege escalation.

  - CVE-2005-0504     An integer overflow in the Moxa driver may lead to     privilege escalation.

  - CVE-2005-0384     A remote denial of service vulnerability has been found     in the PPP driver.

  - CVE-2005-0135     An IA64 specific local denial of service vulnerability     has been found in the unw_unwind_to_user() function.

The following matrix explains which kernel version for which architecture fixes the problems mentioned above :

                                   Debian 3.0 (woody)                 Source                           2.4.18-14.4                        Alpha architecture               2.4.18-15woody1                    Intel IA-32 architecture         2.4.18-13.2                        HP Precision architecture        62.4                               PowerPC architecture             2.4.18-1woody6                     PowerPC architecture/XFS         20020329woody1                     PowerPC architecture/benh        20020304woody1                     Sun Sparc architecture           22woody1

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-0427     A local denial of service vulnerability in do_fork() has     been found.

  - CVE-2005-0489     A local denial of service vulnerability in proc memory     handling has been found.

  - CVE-2004-0394     A buffer overflow in the panic handling code has been     found.

  - CVE-2004-0447     A local denial of service vulnerability through a NULL     pointer dereference in the IA64 process handling code     has been found.

  - CVE-2004-0554     A local denial of service vulnerability through an     infinite loop in the signal handler code has been found.

  - CVE-2004-0565     An information leak in the context switch code has been     found on the IA64 architecture.

  - CVE-2004-0685     Unsafe use of copy_to_user in USB drivers may disclose     sensitive information.

  - CVE-2005-0001     A race condition in the i386 page fault handler may     allow privilege escalation.

  - CVE-2004-0883     Multiple vulnerabilities in the SMB filesystem code may     allow denial of service or information disclosure.

  - CVE-2004-0949     An information leak discovered in the SMB filesystem     code.

  - CVE-2004-1016     A local denial of service vulnerability has been found     in the SCM layer.

  - CVE-2004-1333     An integer overflow in the terminal code may allow a     local denial of service vulnerability.

  - CVE-2004-0997     A local privilege escalation in the MIPS assembly code     has been found.

  - CVE-2004-1335     A memory leak in the ip_options_get() function may lead     to denial of service.

  - CVE-2004-1017     Multiple overflows exist in the io_edgeport driver which     might be usable as a denial of service attack vector.

  - CVE-2005-0124     Bryan Fulton reported a bounds checking bug in the     coda_pioctl function which may allow local users to     execute arbitrary code or trigger a denial of service     attack.

  - CVE-2003-0984     Inproper initialization of the RTC may disclose     information.

  - CVE-2004-1070     Insufficient input sanitising in the load_elf_binary()     function may lead to privilege escalation.

  - CVE-2004-1071     Incorrect error handling in the binfmt_elf loader may     lead to privilege escalation.

  - CVE-2004-1072     A buffer overflow in the binfmt_elf loader may lead to     privilege escalation or denial of service.

  - CVE-2004-1073     The open_exec function may disclose information.

  - CVE-2004-1074     The binfmt code is vulnerable to denial of service     through malformed a.out binaries.

  - CVE-2004-0138     A denial of service vulnerability in the ELF loader has     been found.

  - CVE-2004-1068     A programming error in the unix_dgram_recvmsg() function     may lead to privilege escalation.

  - CVE-2004-1234     The ELF loader is vulnerable to denial of service     through malformed binaries.

  - CVE-2005-0003     Crafted ELF binaries may lead to privilege escalation,     due to insufficient checking of overlapping memory     regions.

  - CVE-2004-1235     A race condition in the load_elf_library() and     binfmt_aout() functions may allow privilege escalation.

  - CVE-2005-0504     An integer overflow in the Moxa driver may lead to     privilege escalation.

  - CVE-2005-0384     A remote denial of service vulnerability has been found     in the PPP driver.

  - CVE-2005-0135     An IA64 specific local denial of service vulnerability     has been found in the unw_unwind_to_user() function.

The following matrix explains which kernel version for which architecture fixes the problems mentioned above :

                               Debian 3.0 (woody)             Source                       2.4.16-1woody2                 arm/lart                     20040419woody1                 arm/netwinder                20040419woody1                 arm/riscpc                   20040419woody1

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This update includes fixes for several security issues :

A missing serialization flaw in unix_dgram_recvmsg was discovered that affects kernels prior to 2.4.28. A local user could potentially make use of a race condition in order to gain privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1068 to this issue.

Paul Starzetz of iSEC discovered various flaws in the ELF binary loader affecting kernels prior to 2.4.28. A local user could use thse flaws to gain read access to executable-only binaries or possibly gain privileges. (CVE-2004-1070, CVE-2004-1071, CVE-2004-1072, CVE-2004-1073)

A flaw when setting up TSS limits was discovered that affects AMD AMD64 and Intel EM64T architecture kernels prior to 2.4.23. A local user could use this flaw to cause a denial of service (crash) or possibly gain privileges. (CVE-2004-0812)

An integer overflow flaw was discovered in the ubsec_keysetup function in the Broadcom 5820 cryptonet driver. On systems using this driver, a local user could cause a denial of service (crash) or possibly gain elevated privileges. (CVE-2004-0619)

Stefan Esser discovered various flaws including buffer overflows in the smbfs driver affecting kernels prior to 2.4.28. A local user may be able to cause a denial of service (crash) or possibly gain privileges. In order to exploit these flaws the user would require control of a connected Samba server. (CVE-2004-0883, CVE-2004-0949)

SGI discovered a bug in the elf loader that affects kernels prior to 2.4.25 which could be triggered by a malformed binary. On architectures other than x86, a local user could create a malicious binary which could cause a denial of service (crash). (CVE-2004-0136)

Conectiva discovered flaws in certain USB drivers affecting kernels prior to 2.4.27 which used the copy_to_user function on uninitialized structures. These flaws could allow local users to read small amounts of kernel memory. (CVE-2004-0685)

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in Red Hat
Enterprise Linux 3 are now available.

The Linux kernel handles the basic functions of the operating system.

This update includes fixes for several security issues :

A missing serialization flaw in unix_dgram_recvmsg was discovered that
affects kernels prior to 2.4.28. A local user could potentially make
use of a race condition in order to gain privileges. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-1068 to this issue.

Paul Starzetz of iSEC discovered various flaws in the ELF binary
loader affecting kernels prior to 2.4.28. A local user could use thse
flaws to gain read access to executable-only binaries or possibly gain
privileges. (CVE-2004-1070, CVE-2004-1071, CVE-2004-1072,
CVE-2004-1073)

A flaw when setting up TSS limits was discovered that affects AMD
AMD64 and Intel EM64T architecture kernels prior to 2.4.23. A local
user could use this flaw to cause a denial of service (crash) or
possibly gain privileges. (CVE-2004-0812)

An integer overflow flaw was discovered in the ubsec_keysetup function
in the Broadcom 5820 cryptonet driver. On systems using this driver, a
local user could cause a denial of service (crash) or possibly gain
elevated privileges. (CVE-2004-0619)

Stefan Esser discovered various flaws including buffer overflows in
the smbfs driver affecting kernels prior to 2.4.28. A local user may
be able to cause a denial of service (crash) or possibly gain
privileges. In order to exploit these flaws the user would require
control of a connected Samba server. (CVE-2004-0883, CVE-2004-0949)

SGI discovered a bug in the elf loader that affects kernels prior to
2.4.25 which could be triggered by a malformed binary. On
architectures other than x86, a local user could create a malicious
binary which could cause a denial of service (crash). (CVE-2004-0136)

Conectiva discovered flaws in certain USB drivers affecting kernels
prior to 2.4.27 which used the copy_to_user function on uninitialized
structures. These flaws could allow local users to read small amounts
of kernel memory. (CVE-2004-0685)

All Red Hat Enterprise Linux 3 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

ID	Name	Product	Family	Severity
22624	Debian DSA-1082-1 : kernel-source-2.4.17 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
22612	Debian DSA-1070-1 : kernel-source-2.4.19 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
22611	Debian DSA-1069-1 : kernel-source-2.4.18 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
22609	Debian DSA-1067-1 : kernel-source-2.4.16 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
15944	RHEL 3 : kernel (RHSA-2004:549)	Nessus	Red Hat Local Security Checks	high
801601	Red Hat 2004-549 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2004-0138

medium

Tenable Plugins

critical

critical

critical

critical

high

high