The KEYCTL_JOIN_SESSION_KEYRING operation in the Linux kernel before 2.6.12.5 contains an error path that does not properly release the session management semaphore, which allows local users or remote attackers to cause a denial of service (semaphore hang) via a new session keyring (1) with an empty name string, (2) with a long name string, (3) with the key quota reached, or (4) ENOMEM.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 4. This is the second regular update.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the second regular kernel update to Red Hat Enterprise Linux 4.

New features introduced in this update include: - Audit support - systemtap - kprobes, relayfs - Keyring support - iSCSI Initiator - iscsi_sfnet 4:0.1.11-1 - Device mapper multipath support - Intel dual core support - esb2 chipset support - Increased exec-shield coverage - Dirty page tracking for HA systems - Diskdump -- allow partial diskdumps and directing to swap

There were several bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 4.

The following security bugs were fixed in this update, detailed below with corresponding CAN names available from the Common Vulnerabilities and Exposures project (cve.mitre.org) :

  - flaws in ptrace() syscall handling on 64-bit systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-0756, CVE-2005-1761, CVE-2005-1762,     CVE-2005-1763)

  - flaws in IPSEC network handling that allowed a local     user to cause a denial of service or potentially gain     privileges (CVE-2005-2456, CVE-2005-2555)

  - a flaw in sendmsg() syscall handling on 64-bit systems     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2490)

  - a flaw in sendmsg() syscall handling that allowed a     local user to cause a denial of service by altering     hardware state (CVE-2005-2492)

  - a flaw that prevented the topdown allocator from     allocating mmap areas all the way down to address zero     (CVE-2005-1265)

  - flaws dealing with keyrings that could cause a local     denial of service (CVE-2005-2098, CVE-2005-2099)

  - a flaw in the 4GB split patch that could allow a local     denial of service (CVE-2005-2100)

  - a xattr sharing bug in the ext2 and ext3 file systems     that could cause default ACLs to disappear     (CVE-2005-2801)

  - a flaw in the ipt_recent module on 64-bit architectures     which could allow a remote denial of service     (CVE-2005-2872)

The following device drivers have been upgraded to new versions :

qla2100 --------- 8.00.00b21-k to 8.01.00b5-rh2 qla2200 --------- 8.00.00b21-k to 8.01.00b5-rh2 qla2300 --------- 8.00.00b21-k to 8.01.00b5-rh2 qla2322 --------- 8.00.00b21-k to 8.01.00b5-rh2 qla2xxx
--------- 8.00.00b21-k to 8.01.00b5-rh2 qla6312 --------- 8.00.00b21-k to 8.01.00b5-rh2 megaraid_mbox --- 2.20.4.5 to 2.20.4.6 megaraid_mm
----- 2.20.2.5 to 2.20.2.6 lpfc ------------ 0:8.0.16.6_x2 to 0:8.0.16.17 cciss ----------- 2.6.4 to 2.6.6 ipw2100 --------- 1.0.3 to 1.1.0 tg3 ------------- 3.22-rh to 3.27-rh e100 ------------ 3.3.6-k2-NAPI to 3.4.8-k2-NAPI e1000 ----------- 5.6.10.1-k2-NAPI to 6.0.54-k2-NAPI 3c59x ----------- LK1.1.19 mptbase --------- 3.01.16 to 3.02.18 ixgb ------------ 1.0.66 to 1.0.95-k2-NAPI libata ---------- 1.10 to 1.11 sata_via -------- 1.0 to 1.1 sata_ahci ------- 1.00 to 1.01 sata_qstor ------ 0.04 sata_sil -------- 0.8 to 0.9 sata_svw
-------- 1.05 to 1.06 s390: crypto ---- 1.31 to 1.57 s390: zfcp ------ s390: CTC-MPC --- s390: dasd ------- s390: cio ------- s390: qeth
------

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

David Howells discovered a local Denial of Service vulnerability in the key session joining function. Under certain user-triggerable conditions, a semaphore was not released properly, which caused processes which also attempted to join a key session to hang forever.
This only affects Ubuntu 5.04 (Hoary Hedgehog). (CAN-2005-2098)

David Howells discovered a local Denial of Service vulnerability in the keyring allocator. A local attacker could exploit this to crash the kernel by attempting to add a specially crafted invalid keyring.
This only affects Ubuntu 5.04 (Hoary Hedgehog). (CAN-2005-2099)

Balazs Scheidler discovered a local Denial of Service vulnerability in the xfrm_compile_policy() function. By calling setsockopt() with an invalid xfrm_user policy message, a local attacker could cause the kernel to write to an array beyond its boundaries, thus causing a kernel crash. (CAN-2005-2456)

Tim Yamin discovered that the driver for compressed ISO file systems did not sufficiently validate the iput data. By tricking an user into mounting a malicious CD-ROM with a specially crafted compressed ISO file system, he could cause a kernel crash. (CAN-2005-2457)

It was discovered that the kernel's embedded zlib compression library was still vulnerable to two old vulnerabilities of the standalone zlib library. This library is used by various drivers and can also be used by third-party modules, so the impact varies. (CAN-2005-2458, CAN-2005-2459)

Peter Sandstrom discovered a remote Denial of Service vulnerability in the SNMP handler. Certain UDP packages lead to a function call with the wrong argument, which resulted in a crash of the network stack.
This only affects Ubuntu 4.10 (Warty Warthog). (CAN-2005-2548)

Herbert Xu discovered that the setsockopt() function was not restricted to privileged users. This allowed a local attacker to bypass intended IPSec policies, set invalid policies to exploit flaws like CAN-2005-2456, or cause a Denial of Service by adding policies until kernel memory is exhausted. Now the call is restricted to processes with the CAP_NET_ADMIN capability. (CAN-2005-2555)

The Ubuntu 5.04 kernel update also fixes a memory leak in the 'md' (Software RAID) driver which eventually lead to kernel memory exhaustion. Ubuntu 4.10 is not affected by this.
(http://bugs.debian.org/317787)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:514 advisory.

    The Linux kernel handles the basic functions of the operating system.

    This is the second regular kernel update to Red Hat Enterprise Linux 4.

    New features introduced in this update include:
    - Audit support
    - systemtap - kprobes, relayfs
    - Keyring support
    - iSCSI Initiator - iscsi_sfnet 4:0.1.11-1
    - Device mapper multipath support
    - Intel dual core support
    - esb2 chipset support
    - Increased exec-shield coverage
    - Dirty page tracking for HA systems
    - Diskdump -- allow partial diskdumps and directing to swap

    There were several bug fixes in various parts of the kernel. The ongoing     effort to resolve these problems has resulted in a marked improvement     in the reliability and scalability of Red Hat Enterprise Linux 4.

    The following security bugs were fixed in this update, detailed below with     corresponding CAN names available from the Common Vulnerabilities and     Exposures project (cve.mitre.org):

    - flaws in ptrace() syscall handling on 64-bit systems that allowed a local     user to cause a denial of service (crash) (CAN-2005-0756, CAN-2005-1761,     CAN-2005-1762, CAN-2005-1763)

    - flaws in IPSEC network handling that allowed a local user to cause a     denial of service or potentially gain privileges (CAN-2005-2456, CAN-2005-2555)

    - a flaw in sendmsg() syscall handling on 64-bit systems that allowed a     local user to cause a denial of service or potentially gain privileges     (CAN-2005-2490)

    - a flaw in sendmsg() syscall handling that allowed a local user to cause a     denial of service by altering hardware state (CAN-2005-2492)

    - a flaw that prevented the topdown allocator from allocating mmap areas     all the way down to address zero (CAN-2005-1265)

    - flaws dealing with keyrings that could cause a local denial of service     (CAN-2005-2098, CAN-2005-2099)

    - a flaw in the 4GB split patch that could allow a local denial of service     (CAN-2005-2100)

    - a xattr sharing bug in the ext2 and ext3 file systems that could cause     default ACLs to disappear (CAN-2005-2801)

    - a flaw in the ipt_recent module on 64-bit architectures which could allow     a remote denial of service (CAN-2005-2872)

    The following device drivers have been upgraded to new versions:

    qla2100 --------- 8.00.00b21-k to 8.01.00b5-rh2     qla2200 --------- 8.00.00b21-k to 8.01.00b5-rh2     qla2300 --------- 8.00.00b21-k to 8.01.00b5-rh2     qla2322 --------- 8.00.00b21-k to 8.01.00b5-rh2     qla2xxx --------- 8.00.00b21-k to 8.01.00b5-rh2     qla6312 --------- 8.00.00b21-k to 8.01.00b5-rh2     megaraid_mbox --- 2.20.4.5 to 2.20.4.6     megaraid_mm ----- 2.20.2.5 to 2.20.2.6     lpfc ------------ 0:8.0.16.6_x2 to 0:8.0.16.17     cciss ----------- 2.6.4 to 2.6.6     ipw2100 --------- 1.0.3 to 1.1.0     tg3 ------------- 3.22-rh to 3.27-rh     e100 ------------ 3.3.6-k2-NAPI to 3.4.8-k2-NAPI     e1000 ----------- 5.6.10.1-k2-NAPI to 6.0.54-k2-NAPI     3c59x ----------- LK1.1.19     mptbase --------- 3.01.16 to 3.02.18     ixgb ------------ 1.0.66 to 1.0.95-k2-NAPI     libata ---------- 1.10 to 1.11     sata_via -------- 1.0 to 1.1     sata_ahci ------- 1.00 to 1.01     sata_qstor ------ 0.04     sata_sil -------- 0.8 to 0.9     sata_svw -------- 1.05 to 1.06     s390: crypto ---- 1.31 to 1.57     s390: zfcp ------     s390: CTC-MPC ---     s390: dasd -------     s390: cio -------     s390: qeth ------

    All Red Hat Enterprise Linux 4 users are advised to upgrade their     kernels to the packages associated with their machine architectures     and configurations as listed in this erratum.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2005-514.

ID	Name	Product	Family	Severity
21943	CentOS 4 : kernel (CESA-2005:514)	Nessus	CentOS Local Security Checks	high
20575	Ubuntu 4.10 / 5.04 : linux-source-2.6.8.1, linux-source-2.6.10 vulnerabilities (USN-169-1)	Nessus	Ubuntu Local Security Checks	medium
19989	RHEL 4 : Updated kernel packages available for Red Hat Enterprise Linux 4 Update 2 (Important) (RHSA-2005:514)	Nessus	Red Hat Local Security Checks	high
801409	CentOS RHSA-2005-514 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2005-2098

medium

Tenable Plugins

high

medium

high

high