Multiple integer signedness errors in the sg_scsi_ioctl function in scsi_ioctl.c for Linux 2.6.x allow local users to read or modify kernel memory via negative integers in arguments to the scsi ioctl, which bypass a maximum length check before calling the copy_from_user and copy_to_user functions.

Multiple vulnerabilities in the Linux 2.6 kernel have been discovered and corrected in this update :

An integer overflow in vc_resize (CVE-2004-1333).

A race condition in the sysfs_read_file and sysfs_write_file functions in 2.6.10 and earlier allows local users to read kernel memory and cause a DoS (crash) via large offsets in sysfs files (CVE-2004-2302).

An integer signedness error in scsi_ioctl.c (CVE-2005-0180).

Netfilter allows a local user to cause a DoS (memory consumption) via certain packet fragments that are reassembled twice, which causes a data structure to be allocated twice (CVE-2005-0210).

A DoS in pkt_ioctl in pktcdvc.c (CVE-2005-1589).

An array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c allows local users to cause a DoS (oops or deadlock) and possibly execute arbitrary code (CVE-2005-2456).

The zisofs driver in versions prior to 2.6.12.5 allows local users and remove attackers to cause a DoS (crash) via a crafted compressed ISO filesystem (CVE-2005-2457).

inflate.c in the zlib routines in versions prior to 2.6.12.5 allow remove attackers to cause a DoS (crash) via a compressed file with 'improper tables' (CVE-2005-2458).

The huft_build function in inflate.c in the zlib routines in versions prior to 2.6.12.5 returns the wrong value, allowing remote attackers to cause a DoS (crash) via a certain compressed file that leads to a NULL pointer dereference (CVE-2005-2459).

A stack-based buffer overflow in the sendmsg function call in versions prior to 2.6.13.1 allow local users to execute arbitrary code by calling sendmsg and modifying the message contents in another thread (CVE-2005-2490).

vlan_dev.c in version 2.6.8 allows remote attackers to cause a DoS (oops from null dereference) via certain UDP packets that lead to a function call with the wrong argument (CVE-2005-2548).

The kernel does not properly restrict socket policy access to users with the CAP_NET_ADMIN capability, which could allow local users to conduct unauthorized activities via ipv4/ip_sockglue.c and ipv6/ipv6_sockglue.c (CVE-2005-2555).

A memory leak in the seq_file implementation in the SCSI procfs interface (sg.c) in 2.6.13 and earlier allows a local user to cause a DoS (memory consumption) via certain repeated reads from /proc/scsi/gs/devices file which is not properly handled when the next() interator returns NULL or an error (CVE-2005-2800).

xattr.c in the ext2 and ext3 file system code does not properly compare the name_index fields when sharing xattr blocks which could prevent ACLs from being applied (CVE-2005-2801).

The ipt_recent module in versions prior to 2.6.12 when running on 64bit processors allows remote attackers to cause a DoS (kernel panic) via certain attacks such as SSH brute force (CVE-2005-2872).

The ipt_recent module in versions prior to 2.6.12 does not properly perform certain tests when the jiffies value is greater than LONG_MAX, which can cause ipt_recent netfilter rules to block too early (CVE-2005-2873).

Multiple vulnerabilities in versions prior to 2.6.13.2 allow local users to cause a DoS (oops from null dereference) via fput in a 32bit ioctl on 64-bit x86 systems or sockfd_put in the 32-bit routing_ioctl function on 64-bit systems (CVE-2005-3044).

The sys_set_mempolicy function in mempolicy.c allows local users to cause a DoS via a negative first argument (CVE-2005-3053).

Versions 2.6.8 to 2.6.14-rc2 allow local users to cause a DoS (oops) via a userspace process that issues a USB Request Block (URB) to a USB device and terminates before the URB is finished, which leads to a stale pointer reference (CVE-2005-3055).

The Orinoco driver in 2.6.13 and earlier does not properly clear memory from a previously used packet whose length is increased, allowing remote attackers to obtain sensitive information (CVE-2005-3180).

Kernels 2.6.13 and earlier, when CONFIG_AUDITSYSCALL is enabled, use an incorrect function to free names_cache memory, preventing the memory from being tracked by AUDITSYSCALL code and leading to a memory leak (CVE-2005-3181).

The VT implementation in version 2.6.12 allows local users to use certain IOCTLs on terminals of other users and gain privileges (CVE-2005-3257).

Exec does not properly clear posix-timers in multi-threaded environments, which result in a resource leak and could allow a large number of multiple local users to cause a DoS by using more posix- timers than specified by the quota for a single user (CVE-2005-3271).

The rose_rt_ioctl function rose_route.c in versions prior to 2.6.12 does not properly verify the ndigis argument for a new route, allowing an attacker to trigger array out-of-bounds errors with a large number of digipeats (CVE-2005-3273).

A race condition in ip_vs_conn_flush in versions prior to 2.6.13, when running on SMP systems, allows local users to cause a DoS (null dereference) by causing a connection timer to expire while the connection table is being flushed before the appropriate lock is acquired (CVE-2005-3274).

The NAT code in versions prior to 2.6.13 incorrectly declares a variable to be static, allowing remote attackers to cause a DoS (memory corruption) by causing two packets for the same protocol to be NATed at the same time (CVE-2005-3275).

The sys_get_thread_area function in process.c in versions prior to 2.6.12.4 and 2.6.13 does not clear a data structure before copying it to userspace, which may allow a user process to obtain sensitive information (CVE-2005-3276).

The following non-security fixes are also applied :

Driver updates were made to the aic97xx and sata_sil modules.

Support was added for ATI ipx400 chipsets, for IDE and sound.

A build problem with icecream on the x86_64 platform was fixed.

The pin1 APIC timer on RS480-based motherboards was disabled.

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:092 advisory.

    The Linux kernel handles the basic functions of the operating system.

    This advisory includes fixes for several security issues:

    iSEC Security Research discovered multiple vulnerabilities in the IGMP     functionality.  These flaws could allow a local user to cause a denial of     service (crash) or potentially gain privileges.  Where multicast     applications are being used on a system, these flaws may also allow remote     users to cause a denial of service.  The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1137 to     this issue.

    iSEC Security Research discovered a flaw in the page fault handler code     that could lead to local users gaining elevated (root) privileges on     multiprocessor machines.  (CAN-2005-0001)

    iSEC Security Research discovered a VMA handling flaw in the uselib(2)     system call of the Linux kernel.  A local user could make use of this     flaw to gain elevated (root) privileges.  (CAN-2004-1235)

    A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T     architecture was discovered.  A local user could use this flaw to write to     privileged IO ports.  (CAN-2005-0204)

    The Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not     properly check the DMA lock, which could allow remote attackers or local     users to cause a denial of service (X Server crash) or possibly modify the     video output. (CAN-2004-1056)

    OGAWA Hirofumi discovered incorrect tables sizes being used in the     filesystem Native Language Support ASCII translation table.  This could     lead to a denial of service (system crash).  (CAN-2005-0177)

    Michael Kerrisk discovered a flaw in the 2.6.9 kernel which allows users to     unlock arbitrary shared memory segments.  This flaw could lead to     applications not behaving as expected.  (CAN-2005-0176)

    Improvements in the POSIX signal and tty standards compliance exposed     a race condition.  This flaw can be triggered accidentally by threaded     applications or deliberately by a malicious user and can result in a     denial of service (crash) or in occasional cases give access to a small     random chunk of kernel memory.  (CAN-2005-0178)

    The PaX team discovered a flaw in mlockall introduced in the 2.6.9 kernel.
    An unprivileged user could use this flaw to cause a denial of service     (CPU and memory consumption or crash).  (CAN-2005-0179)

    Brad Spengler discovered multiple flaws in sg_scsi_ioctl in the 2.6 kernel.
    An unprivileged user may be able to use this flaw to cause a denial of     service (crash) or possibly other actions.  (CAN-2005-0180)

    Kirill Korotaev discovered a missing access check regression in the Red Hat     Enterprise Linux 4 kernel 4GB/4GB split patch.  On systems using the     hugemem kernel, a local unprivileged user could use this flaw to cause a     denial of service (crash).  (CAN-2005-0090)

    A flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch can     allow syscalls to read and write arbitrary kernel memory.  On systems using     the hugemem kernel, a local unprivileged user could use this flaw to gain     privileges.  (CAN-2005-0091)

    An additional flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split     patch was discovered. On x86 systems using the hugemem kernel, a local     unprivileged user may be able to use this flaw to cause a denial of service     (crash).  (CAN-2005-0092)

    All Red Hat Enterprise Linux 4 users are advised to upgrade their     kernels to the packages associated with their machine architectures     and configurations as listed in this erratum.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix several security issues are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the
Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This advisory includes fixes for several security issues :

iSEC Security Research discovered multiple vulnerabilities in the IGMP
functionality. These flaws could allow a local user to cause a denial
of service (crash) or potentially gain privileges. Where multicast
applications are being used on a system, these flaws may also allow
remote users to cause a denial of service. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-1137 to this issue.

iSEC Security Research discovered a flaw in the page fault handler
code that could lead to local users gaining elevated (root) privileges
on multiprocessor machines. (CVE-2005-0001)

iSEC Security Research discovered a VMA handling flaw in the uselib(2)
system call of the Linux kernel. A local user could make use of this
flaw to gain elevated (root) privileges. (CVE-2004-1235)

A flaw affecting the OUTS instruction on the AMD64 and Intel EM64T
architecture was discovered. A local user could use this flaw to write
to privileged IO ports. (CVE-2005-0204)

The Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not
properly check the DMA lock, which could allow remote attackers or
local users to cause a denial of service (X Server crash) or possibly
modify the video output. (CVE-2004-1056)

OGAWA Hirofumi discovered incorrect tables sizes being used in the
filesystem Native Language Support ASCII translation table. This could
lead to a denial of service (system crash). (CVE-2005-0177)

Michael Kerrisk discovered a flaw in the 2.6.9 kernel which allows
users to unlock arbitrary shared memory segments. This flaw could lead
to applications not behaving as expected. (CVE-2005-0176)

Improvements in the POSIX signal and tty standards compliance exposed
a race condition. This flaw can be triggered accidentally by threaded
applications or deliberately by a malicious user and can result in a
denial of service (crash) or in occasional cases give access to a
small random chunk of kernel memory. (CVE-2005-0178)

The PaX team discovered a flaw in mlockall introduced in the 2.6.9
kernel. An unprivileged user could use this flaw to cause a denial of
service (CPU and memory consumption or crash). (CVE-2005-0179)

Brad Spengler discovered multiple flaws in sg_scsi_ioctl in the 2.6
kernel. An unprivileged user may be able to use this flaw to cause a
denial of service (crash) or possibly other actions. (CVE-2005-0180)

Kirill Korotaev discovered a missing access check regression in the
Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch. On systems
using the hugemem kernel, a local unprivileged user could use this
flaw to cause a denial of service (crash). (CVE-2005-0090)

A flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch
can allow syscalls to read and write arbitrary kernel memory. On
systems using the hugemem kernel, a local unprivileged user could use
this flaw to gain privileges. (CVE-2005-0091)

An additional flaw in the Red Hat Enterprise Linux 4 kernel 4GB/4GB
split patch was discovered. On x86 systems using the hugemem kernel, a
local unprivileged user may be able to use this flaw to cause a denial
of service (crash). (CVE-2005-0092)

All Red Hat Enterprise Linux 4 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.

ID	Name	Product	Family	Severity
20450	Mandrake Linux Security Advisory : kernel (MDKSA-2005:219)	Nessus	Mandriva Local Security Checks	high
17183	RHEL 4 : kernel (RHSA-2005:092)	Nessus	Red Hat Local Security Checks	high
801605	Red Hat 2005-092 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2005-0180

high

Tenable Plugins

high

high

high