The selinux_ptrace logic in hooks.c in SELinux for Linux 2.6.6 allows local users with ptrace permissions to change the tracer SID to an SID of another process.

This advisory covers the S/390 components of the recent security update for the Linux 2.6.8 kernel that were missing due to technical problems. For reference, please see the text of the original advisory.

  Several security related problems have been discovered in the Linux   kernel which may lead to a denial of service or even the execution   of arbitrary code. The Common Vulnerabilities and Exposures project   identifies the following problems :

    - CVE-2004-2660       Toshihiro Iwamoto discovered a memory leak in the       handling of direct I/O writes that allows local users       to cause a denial of service.

    - CVE-2005-4798       A buffer overflow in NFS readlink handling allows a       malicious remote server to cause a denial of service.

    - CVE-2006-1052       Stephen Smalley discovered a bug in the SELinux ptrace       handling that allows local users with ptrace       permissions to change the tracer SID to the SID of       another process.

    - CVE-2006-1343       Pavel Kankovsky discovered an information leak in the       getsockopt system call which can be exploited by a       local program to leak potentially sensitive memory to       userspace.

    - CVE-2006-1528       Douglas Gilbert reported a bug in the sg driver that       allows local users to cause a denial of service by       performing direct I/O transfers from the sg driver to       memory mapped I/O space.

    - CVE-2006-1855       Mattia Belletti noticed that certain debugging code       left in the process management code could be exploited       by a local attacker to cause a denial of service.

    - CVE-2006-1856       Kostik Belousov discovered a missing LSM       file_permission check in the readv and writev       functions which might allow attackers to bypass       intended access restrictions.

    - CVE-2006-2444       Patrick McHardy discovered a bug in the SNMP NAT       helper that allows remote attackers to cause a denial       of service.

    - CVE-2006-2446       A race condition in the socket buffer handling allows       remote attackers to cause a denial of service.

    - CVE-2006-2935       Diego Calleja Garcia discovered a buffer overflow in       the DVD handling code that could be exploited by a       specially crafted DVD USB storage device to execute       arbitrary code.

    - CVE-2006-2936       A bug in the serial USB driver has been discovered       that could be exploited by a custom made USB serial       adapter to consume arbitrary amounts of memory.

    - CVE-2006-3468       James McKenzie discovered a denial of service       vulnerability in the NFS driver. When exporting an       ext3 file system over NFS, a remote attacker could       exploit this to trigger a file system panic by sending       a specially crafted UDP packet.

    - CVE-2006-3745       Wei Wang discovered a bug in the SCTP implementation       that allows local users to cause a denial of service       and possibly gain root privileges.

    - CVE-2006-4093       Olof Johansson discovered that the kernel does not       disable the HID0 bit on PowerPC 970 processors which       could be exploited by a local attacker to cause a       denial of service.

    - CVE-2006-4145       A bug in the Universal Disk Format (UDF) filesystem       driver could be exploited by a local user to cause a       denial of service.

    - CVE-2006-4535       David Miller reported a problem with the fix for       CVE-2006-3745 that allows local users to crash the       system via an SCTP socket with a certain SO_LINGER       value.

The following matrix explains which kernel version for which architecture fixes the problem mentioned above :

                              stable (sarge)                 Source                       2.6.8-16sarge5                 Alpha architecture           2.6.8-16sarge5                 AMD64 architecture           2.6.8-16sarge5                 HP Precision architecture    2.6.8-6sarge5                  Intel IA-32 architecture     2.6.8-16sarge5                 Intel IA-64 architecture     2.6.8-14sarge5                 Motorola 680x0 architecture  2.6.8-4sarge5                  PowerPC architecture         2.6.8-12sarge5                 IBM S/390                    2.6.8-5sarge5                  Sun Sparc architecture       2.6.8-15sarge5                 FAI                          1.9.1sarge4

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the fourth regular update to Red Hat Enterprise Linux 4.

New features introduced in this update include :

* Device Mapper mirroring support

* IDE diskdump support

* x86, AMD64 and Intel EM64T: Multi-core scheduler support enhancements

* Itanium: perfmon support for Montecito

* much improved support for IBM x460

* AMD PowerNow! patches to support Opteron Rev G

* Vmalloc support > 64MB

The following device drivers have been upgraded to new versions :

ipmi: 33.11 to 33.13 ib_mthca: 0.06 to 0.08 bnx2: 1.4.30 to 1.4.38 bonding: 2.6.1 to 2.6.3 e100: 3.4.8-k2-NAPI to 3.5.10-k2-NAPI e1000:
6.1.16-k3-NAPI to 7.0.33-k2-NAPI sky2: 0.13 to 1.1 tg3: 3.43-rh to 3.52-rh ipw2100: 1.1.0 to git-1.1.4 ipw2200: 1.0.0 to git-1.0.10 3w-9xxx: 2.26.02.001 to 2.26.04.010 ips: 7.10.18 to 7.12.02 iscsi_sfnet: 4:0.1.11-2 to 4:0.1.11-3 lpfc: 0:8.0.16.18 to 0:8.0.16.27 megaraid_sas: 00.00.02.00 to 00.00.02.03-RH1 qla2xxx: 8.01.02-d4 to 8.01.04-d7 qla6312: 8.01.02-d4 to 8.01.04-d7 sata_promise: 1.03 to 1.04 sata_vsc: 1.1 to 1.2 ibmvscsic: 1.5.5 to 1.5.6 ipr: 2.0.11.1 to 2.0.11.2

Added drivers :

dcdbas: 5.6.0-2 sata_mv: 0.6 sata_qstor: 0.05 sata_uli: 0.5 skge: 1.1 stex: 2.9.0.13 pdc_adma: 0.03

This update includes fixes for the security issues :

* a flaw in the USB devio handling of device removal that allowed a local user to cause a denial of service (crash) (CVE-2005-3055, moderate)

* a flaw in the ACL handling of nfsd that allowed a remote user to bypass ACLs for readonly mounted NFS file systems (CVE-2005-3623, moderate)

* a flaw in the netfilter handling that allowed a local user with CAP_NET_ADMIN rights to cause a buffer overflow (CVE-2006-0038, low)

* a flaw in the IBM S/390 and IBM zSeries strnlen_user() function that allowed a local user to cause a denial of service (crash) or to retrieve random kernel data (CVE-2006-0456, important)

* a flaw in the keyctl functions that allowed a local user to cause a denial of service (crash) or to read sensitive kernel memory (CVE-2006-0457, important)

* a flaw in unaligned accesses handling on Itanium processors that allowed a local user to cause a denial of service (crash) (CVE-2006-0742, important)

* a flaw in SELinux ptrace logic that allowed a local user with ptrace permissions to change the tracer SID to a SID of another process (CVE-2006-1052, moderate)

* an info leak on AMD-based x86 and x86_64 systems that allowed a local user to retrieve the floating point exception state of a process run by a different user (CVE-2006-1056, important)

* a flaw in IPv4 packet output handling that allowed a remote user to bypass the zero IP ID countermeasure on systems with a disabled firewall (CVE-2006-1242, low)

* a minor info leak in socket option handling in the network code (CVE-2006-1343, low)

* a flaw in the HB-ACK chunk handling of SCTP that allowed a remote user to cause a denial of service (crash) (CVE-2006-1857, moderate)

* a flaw in the SCTP implementation that allowed a remote user to cause a denial of service (deadlock) (CVE-2006-2275, moderate)

* a flaw in the socket buffer handling that allowed a remote user to cause a denial of service (panic) (CVE-2006-2446, important)

* a flaw in the signal handling access checking on PowerPC that allowed a local user to cause a denial of service (crash) or read arbitrary kernel memory on 64-bit systems (CVE-2006-2448, important)

* a flaw in the netfilter SCTP module when receiving a chunkless packet that allowed a remote user to cause a denial of service (crash) (CVE-2006-2934, important)

There were several bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 4.

A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

Prior to Linux kernel 2.6.16.5, the kernel does not properly handle uncanonical return addresses on Intel EM64T CPUs which causes the kernel exception handler to run on the user stack with the wrong GS (CVE-2006-0744).

The selinux_ptrace logic hooks in SELinux for 2.6.6 allow local users with ptrace permissions to change the tracer SID to an SID of another process (CVE-2006-1052).

Prior to 2.6.16, the ip_push_pending_frames function increments the IP ID field when sending a RST after receiving unsolicited TCP SYN-ACK packets, which allows a remote attacker to conduct an idle scan attack, bypassing any intended protection against such an attack (CVE-2006-1242).

In kernel 2.6.16.1 and some earlier versions, the sys_add_key function in the keyring code allows local users to cause a DoS (OOPS) via keyctl requests that add a key to a user key instead of a keyring key, causing an invalid dereference (CVE-2006-1522).

Prior to 2.6.16.8, the ip_route_input function allows local users to cause a DoS (panic) via a request for a route for a multicast IP address, which triggers a null dereference (CVE-2006-1525).

Prior to 2.6.16.13, the SCTP-netfilter code allows remote attackers to cause a DoS (infinite loop) via unknown vectors that cause an invalid SCTP chunk size to be processed (CVE-2006-1527).

Prior to 2.6.16, local users can bypass IPC permissions and modify a read-only attachment of shared memory by using mprotect to give write permission to the attachment (CVE-2006-2071).

Prior to 2.6.17, the ECNE chunk handling in SCTP (lksctp) allows remote attackers to cause a DoS (kernel panic) via an unexpected chucnk when the session is in CLOSED state (CVE-2006-2271).

Prior to 2.6.17, SCTP (lksctp) allows remote attacker to cause a DoS (kernel panic) via incoming IP fragmented COOKIE_ECHO and HEARTBEAT SCTP control chunks (CVE-2006-2272).

In addition to these security fixes, other fixes have been included such as :

  - fix a scheduler deadlock

    - Yenta oops fix

    - ftdi_sio: adds support for iPlus devices

    - enable kprobes on i386 and x86_64

    - avoid a panic on bind mount of autofs owned directory

    - fix a kernel OOPs when booting with 'console=ttyUSB0'       but without a USB-serial dongle plugged in

  - make dm-mirror not issue invalid resync requests

    - fix media change detection on scsi removable devices

    - add support for the realtek 8168 chipset

    - update hfsplus driver to 2.6.16 state

    - backport 'Gilgal' support from e1000 7.0.33

    - selected ACPI video fixes

    - update 3w-9xxx to 2.26.02.005 (9550SX support)

    - fix a deadlock in the ext2 filesystem

    - fix usbserial use-after-free bug

    - add i945GM DRI support

    - S3 resume fixes

    - add ECS PF22 hda model support

    - SMP suspend

    - CPU hotplug

    - miscellaneous AGP fixes

    - added sata-suspend patch for 2.6.12 for Napa platform

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

As well, updated mkinitrd and bootsplash packages are provided to fix minor issues; users should upgrade both packages prior to installing a new kernel.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

The sys_mbind() function did not properly verify the validity of the 'maxnod' argument. A local user could exploit this to trigger a buffer overflow, which caused a kernel crash. (CVE-2006-0557)

The SELinux module did not correctly handle the tracer SID when a process was already being traced. A local attacker could exploit this to cause a kernel crash. (CVE-2006-1052)

Al Viro discovered a local Denial of Service in the sysfs write buffer handling. By writing a block with a length exactly equal to the processor's page size to any writable file in /sys, a local attacker could cause a kernel crash. (CVE-2006-1055)

John Blackwood discovered a race condition with single-step debugging multiple processes at the same time. A local attacker could exploit this to crash the system. This only affects the amd64 platform.
(CVE-2006-1066)

Marco Ivaldi discovered a flaw in the handling of the ID number of IP packets. This number was incremented after receiving unsolicited TCP SYN-ACK packets. A remote attacker could exploit this to conduct port scans with the 'Idle scan' method (nmap -sI), which bypassed intended port scan protections. (CVE-2006-1242)

Pavel Kankovsky discovered that the getsockopt() function, when called with an SO_ORIGINAL_DST argument, does not properly clear the returned structure, so that a random piece of kernel memory is exposed to the user. This could potentially reveal sensitive data like passwords or encryption keys. (CVE-2006-1343)

A buffer overflow was discovered in the USB Gadget RNDIS implementation. While creating a reply message, the driver did not allocate enough memory for the reply structure. A remote attacker could exploit this to cause a kernel crash. (CVE-2006-1368)

Alexandra Kossovsky discovered an invalid memory access in the ip_route_input() function. By using the 'ip' command in a particular way to retrieve multicast routes, a local attacker could exploit this to crash the kernel. (CVE-2006-1525).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2006-0575.

ID	Name	Product	Family	Severity
22726	Debian DSA-1184-2 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	high
22276	CentOS 4 : kernel (CESA-2006:0575)	Nessus	CentOS Local Security Checks	high
22221	RHEL 4 : kernel (RHSA-2006:0575)	Nessus	Red Hat Local Security Checks	high
21575	Mandrake Linux Security Advisory : kernel (MDKSA-2006:086)	Nessus	Mandriva Local Security Checks	high
21375	Ubuntu 5.04 / 5.10 : linux-source-2.6.10, linux-source-2.6.12 vulnerabilities (USN-281-1)	Nessus	Ubuntu Local Security Checks	critical
801420	CentOS RHSA-2006-0575 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2006-1052

critical

Tenable Plugins

high

high

high

high

critical

high