The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).

From Red Hat Security Advisory 2006:0710 :

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the IPC shared-memory implementation that allowed a local user to cause a denial of service (deadlock) that resulted in freezing the system (CVE-2006-4342, Important)

* an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read arbitrary kernel memory (CVE-2006-5174, Important)

* a flaw in the ATM subsystem affecting systems with installed ATM hardware and configured ATM support that allowed a remote user to cause a denial of service (panic) by accessing socket buffer memory after it has been freed (CVE-2006-4997, Moderate)

* a directory traversal vulnerability in smbfs that allowed a local user to escape chroot restrictions for an SMB-mounted filesystem via '..\\' sequences (CVE-2006-1864, Moderate)

* a flaw in the mprotect system call that allowed enabling write permission for a read-only attachment of shared memory (CVE-2006-2071, Moderate)

* a flaw in the DVD handling of the CDROM driver that could be used together with a custom built USB device to gain root privileges (CVE-2006-2935, Moderate)

In addition to the security issues described above, a bug fix for a clock skew problem (which could lead to unintended keyboard repeat under X11) was also included. The problem only occurred when running the 32-bit x86 kernel on 64-bit dual-core x86_64 hardware.

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Updated kernel packages that fix security issues are now available. 

This update has been rated as having important security impact by the Red Hat Security Response Team. 

The Linux kernel handles the basic functions of the operating system. 

These new kernel packages contain fixes for the security issues described below :


From Red Hat Security Advisory 2006-0617 :

* a flaw in the proc file system that allowed a local user to use a suid-wrapper for scripts to gain root privileges (CVE-2006-3626, Important)

* a flaw in the SCTP implementation that allowed a local user to cause a denial of service (panic) or to possibly gain root privileges (CVE-2006-3745, Important)

* a flaw in NFS exported ext2/ext3 partitions when handling invalid inodes that allowed a remote authenticated user to cause a denial of service (filesystem panic) (CVE-2006-3468, Important)

* a flaw in the restore_all code path of the 4/4GB split support of non-hugemem kernels that allowed a local user to cause a denial of service (panic) (CVE-2006-2932, Important)

* a flaw in IPv4 netfilter handling for the unlikely use of SNMP NAT processing that allowed a remote user to cause a denial of service (crash) or potential memory corruption (CVE-2006-2444, Moderate)

* a flaw in the DVD handling of the CDROM driver that could be used together with a custom built USB device to gain root privileges (CVE-2006-2935, Moderate)

* a flaw in the handling of O_DIRECT writes that allowed a local user to cause a denial of service (memory consumption) (CVE-2004-2660, Low)

* a flaw in the SCTP chunk length handling that allowed a remote user to cause a denial of service (crash) (CVE-2006-1858, Low)

* a flaw in the input handling of the ftdi_sio driver that allowed a local user to cause a denial of service (memory consumption) (CVE-2006-2936, Low)

In addition a bugfix was added to enable a clean reboot for the IBM Pizzaro machines.

Red Hat would like to thank Wei Wang of McAfee Avert Labs and Kirill Korotaev for reporting issues fixed in this erratum.


From Red Hat Security Advisory ELSA-2006-0689 :

* a flaw in the SCTP support that allowed a local user to cause a denial of service (crash) with a specific SO_LINGER value.
(CVE-2006-4535, Important)

* a flaw in the hugepage table support that allowed a local user to cause a denial of service (crash). (CVE-2005-4811, Important)

* a flaw in the mprotect system call that allowed setting write permission for a read-only attachment of shared memory.
(CVE-2006-2071, Moderate)

* a flaw in HID0[31] (en_attn) register handling on PowerPC 970 systems that allowed a local user to cause a denial of service.
(crash) (CVE-2006-4093, Moderate)

* a flaw in the perfmon support of Itanium systems that allowed a local user to cause a denial of service by consuming all file descriptors. (CVE-2006-3741, Moderate)

* a flaw in the ATM subsystem. On systems with installed ATM hardware and configured ATM support, a remote user could cause a denial of service (panic) by accessing socket buffers memory after freeing them.
(CVE-2006-4997, Moderate)

* a flaw in the DVB subsystem. On systems with installed DVB hardware and configured DVB support, a remote user could cause a denial of service (panic) by sending a ULE SNDU packet with length of 0.
(CVE-2006-4623, Low)

* an information leak in the network subsystem that possibly allowed a local user to read sensitive data from kernel memory. (CVE-2006-0039, Low)

In addition, two bugfixes for the IPW-2200 wireless driver were included. The first one ensures that wireless management applications correctly identify IPW-2200 controlled devices, while the second fix ensures that DHCP requests using the IPW-2200 operate correctly.

Red Hat would like to thank Olof Johansson, Stephane Eranian and Solar Designer for reporting issues fixed in this erratum.

This kernel update fixes the following security problems :

  - A bug within the UDF filesystem that caused machine     hangs when truncating files on the filesystem was fixed.
    [#186226]. (CVE-2006-4145)

  - A potential crash when receiving IPX packets was fixed.
    This problem is thought not to be exploitable. [#197809]

  - A problem in DVB packet handling could be used to crash     the machine when receiving DVB net packages is active.
    [#201429]. (CVE-2006-4623)

  - A struct file leak was fixed in the perfmon(2) system     call on the Itanium architecture. [#202269].
    (CVE-2006-3741)

  - A malformed ELF image can be used on the Itanium     architecture to trigger a kernel crash (denial of     service) when a local attacker can supply it to be     started. [#203822]. (CVE-2006-4538)

  - A problem in the ATM protocol handling clip_mkip     function could be used by remote attackers to     potentially crash the machine. [#205383].
    (CVE-2006-4997)

CVE-2006-5757/

  - A problem in the grow_buffers function could be used to     crash or hang the machine using a corrupted filesystem.
    This affects filesystem types ISO9660 and NTFS.
    [#205384]. (CVE-2006-6060)

  - On the i386 architecture the ELFAGS content was not     correctly saved, which could be used by local attackers     to crash other programs using the AC and NT flag or to     escalate privileges by waiting for iopl privileges to be     leaked. [#209386]. (CVE-2006-5173)

  - On the S/390 architecture copy_from_user() could be used     by local attackers to read kernel memory. [#209880].
    (CVE-2006-5174)

  - A problem in IPv6 flowlabel handling can be used by     local attackers to hang the machine. [#216590].
    (CVE-2006-5619)

  - On the PowerPC architecture a syscall has been wired     without the proper futex implementation that can be     exploited by a local attacker to hang the machine.
    [#217295]. (CVE-2006-5648)

  - On the PowerPC architecture the proper futex     implementation was missing a fix for alignment check     which could be used by a local attacker to crash the     machine. [#217295]. (CVE-2006-5649)

  - A problem in cramfs could be used to crash the machine     during mounting a crafted cramfs image. This requires an     attacker to supply such a crafted image and have a user     mount it. [#218237]. (CVE-2006-5823)

  - A problem in the ext3 filesystem could be used by     attackers able to supply a crafted ext3 image to cause a     denial of service or further data corruption if a user     mounts this image. [#220288]. (CVE-2006-6053)

  - Missing return code checking in the HFS could be used to     crash machine when a user complicit attacker is able to     supply a specially crafted HFS image. [#221230].
    (CVE-2006-6056)

  - Multiple unspecified vulnerabilities in netfilter for     IPv6 code allow remote attackers to bypass intended     restrictions via fragmentation attack vectors, aka (1)     'ip6_tables protocol bypass bug' and (2) 'ip6_tables     extension header bypass bug'. [#221313]. (CVE-2006-4572)

  - An integer overflow in the networking bridge ioctl     starting with Kernel 2.6.7 could be used by local     attackers to overflow kernel memory buffers and     potentially escalate privileges [#222656].
    (CVE-2006-5751)

and the following non security bugs :

  - patches.fixes/dm-bio_list_merge-fix.diff: device-mapper     snapshot: bio_list fix [#117435]

  - patches.fixes/statd-refcount-fix: Fix refcounting     problems in host management in lockd. [#148009]

  - patches.fixes/i8042-reentry: Prevents i8042_interrupt()     from being reentered. [#167187]

  - patches.suse/bonding-workqueue: Replace system timer     with work queue in monitor functions. Remove rtnl_lock     calls in monitor functions added in original version.
    [#174843] [#205196]

  - patches.arch/i386-profile-pc: i386: Account spinlocks to     the caller during profiling for !FP kernels [#176770]

  - patches.arch/add-user-mode: i386/x86-64: Add user_mode     checks to profile_pc for oprofile [#176770]

  - patches.drivers/aic7xxx-max-sectors-adjust: Adjust     .max_sectors to 8192 for aic7xxx [#177059]

  - patches.xen/xen-x86-dcr-fallback: Add fallback when     XENMEM_exchange fails to replace contiguous region     [#181869]

  - patches.suse/lkcd-support-large-minor-number: LKCD     should support minor numbers > 256 [#185125]

  - patches.fixes/scsi-scan-limit-luns-seqscan-16k: Limit     sequential scan to 16k LUNs [#185164]

  - patches.drivers/powernow-ext-mask: Handle extended     powernow vid mask properly [#185654]

  - patches.fixes/xfs-unlink-recovery-fix: [XFS] unlink     recovery fix. ([#185796]

  - patches.suse/lkcd-dont-lose-one-page: Fix incorrect     dumps on machines with memory holes [#186169]

  - patches.fixes/ieee80211-orinoco_ap_workaround.diff:
    ieee80211: workaround for broken Orinoco access points     [#186879]

  - patches.fixes/sched-group-exclusive: Fix scheduler crash     with exclusive cpusets [#188921]

  - patches.fixes/bdev-imapping-race.diff: Fix race between     sync_single_inode() and iput() [#188950]

  - patches.fixes/scsi-scan-blist-update: Update blacklist     entries for EMC Symmetrix and HP EVA [#191648]

  - patches.arch/ia64-mce-output: Save/restore     oops_in_progress around printing machine checks     [#191901]

  - patches.fixes/scsi-add-device-oops-during-eh: Fix Oops     in scsi_add_device during EH [#195050]

  - Included a set of fixes for [#195940]

  - patches.fixes/dm-fix-alloc_dev-error_path.patch: call     free_minor in alloc_dev error path.
    patches.fixes/dm-snapshot-fix-origin_write-pe-submission     .patch: fix origin_write pending_exception submission. -

patches.fixes/dm-snapshot-replace-sibling-list.patch: replace sibling list.

  - patches.fixes/dm-snapshot-fix-pending-pe-ref.patch: fix     references to pending pe.

  - patches.fixes/dm-snapshot-fix-invalidation.patch: fix     invalidation. -

patches.fixes/dm-kcopyd-error-accumulation-fix.patch: kcopyd should accumulate errors.
patches.fixes/dm-snapshot-fix-metadata-error-handling.patch: fix read_metadata error handling.
patches.fixes/dm-snapshot-fix-metadata-writing-when-suspending.patch:
fix metadata writing when suspending.

  - patches.fixes/nat-t-pskb-pull.patch: Fix NAT-T VPN with     certain ethernet chips, in particular recent e1000     chips. [#196747]

  - patches.drivers/e1000-update: Update so that we no     longer break the 'Disable Packet Split for PCI express     adapters' driver option.

  - patches.fixes/e1000-no-packet-split: Discard, no longer     needed.

  - patches.arch/acpi_T60_ultrabay.patch: Add T60 ACPI dock     station path to ibm_acpi module [#196884]

  - patches.fixes/acpi_battery_hotplug_fix.patch: Workaround     ACPI misdesign to recon dock station when booting     undocked.

  - patches.fixes/acpi_ibm_dock_fix_not_present.patch:
    Workaround ACPI misdesign to recon dock station when     booting undocked [#196884]

  - patches.arch/x86_64-monotonic-clock: Fix monotonic clock     on x86-64 [#197548]

  - patches.fixes/nfs-truncate-race: Fix a race when     truncating over NFS and writing via mmap [#198023]

  - patches.drivers/libata-no-spindown-on-shutdown: Don't     spindown SCSI disks when rebooting [#198687]

  - patches.drivers/qla2xxx-reset-fix: allow reset for     qla2xxx via sg_reset [#200325]

  - kabi/s390/symvers-default: Update kABI symbols [#202134]

  - patches.suse/bond_alb_deadlock_fix: bonding: fix     deadlock on high loads in bond_alb_monitor(). [#202512]

  - patches.arch/i386-fix-tsc-selection: Fix TSC timer     selection on i386 [#203713]

  - patches.drivers/aic94xx-remove-flash-manfid-reliance:
    Remove reliance on the FLASH MANFID [#203768]

  - patches.fixes/xfs-kern-205110-xfs_dio_locking: Fix ABBA     deadlock between i_mutex and iolock [#205110]

  - patches.suse/bonding-workqueue: Replace system timer     with work queue in monitor functions. Remove rtnl_lock     calls in monitor functions added in original version.
    [#174843] [#205196]

  - add     patches.fixes/fix-incorrect-hugepage-interleaving.patch     fix NUMA interleaving for huge pages [#205268]

  - patches.suse/bondalb-hashtbl.patch: fix hang in bonding     ALB driver. [#206629]     patches.drivers/usb-add-raritan-kvm-usb-dongle-to-the-hi     d_quirk_noget-blacklist.patch: USB: add Raritan KVM USB     Dongle to the HID_QUIRK_NOGET blacklist [#206932]

  - patches.arch/ia64-mca_asm-set_kernel_registers: [IA64]     set ar.fpsr on MCA/INIT kernel entry. [#206967]

  - patches.fixes/md-bitmap-ffz: Use ffz instead of     find_first_set to convert multiplier to shift. [#207679]

  - patches.fixes/md-bitmap-compat-ioctl: Allow     SET_BITMAP_FILE to work on 64bit kernel with 32bit     userspace. [#207688]

  - patches.drivers/mpt-rport-stall: Fix MPT oops during     aborting commands [#207768]

  - patches.drivers/libata-jmicron-update: Fix handling of     JMicron controller [#207939]

  - patches.arch/i386-mmconfig-flush:
    arch/i386/pci/mmconfig.c tlb flush fix [#208414]

  - patches.fixes/scsi-fix-req-page-count: scsi_lib.c:
    properly count the number of pages in scsi_req_map_sg()     [#208782]

  - patches.fixes/fix-processor-placement.diff: sched: Fix     longstanding load balancing bug in the scheduler     [#209460].

  - patches.arch/x86_64-fpu-corruption: Fix FPU corruption     [#209903]

  - patches.drivers/qla1280-bus-reset-handling: performance     slowdown after bus reset on qla12160 HBA [#213717]

  - patches.drivers/qla1280-scb-timeout: qla1280 times out     on long operations such as tape rewind [#214695]

  - patches.fixes/slab-per-cpu-data: Make slab     initialization use per cpu data of correction CPU     [#216316]

  - patches.fixes/ocfs2-network-send-lock.diff: ocfs2:
    introduce sc->sc_send_lock to protect outbound network     messages [#216912]

  - marked module megaraid_sas as supported

  - marked module jsm as supported [#218969]

  - patches.suse/ocfs2-13-fix-quorum-work.diff: ocfs2:
    outstanding scheduled work can oops when quorum is shut     down [#220694]

  - patches.xen/xen-x86_64-agp: add missing header [#222174]     [#224170]

  - patches.fixes/md-rebuild-fix: md: Fix bug where a     rebuild of spares, when interrupted by a rebuild,     doesn't always get properly completed once the system is     back up, leading to filesystem corruption. [#224960].

  - patches.fixes/scsi-sdev-initialisation-block-race: SCSI     midlayer race: scan vs block/unblock deadlocks sdev     [#225770]

Mark Dowd discovered that the netfilter iptables module did not correcly handle fragmented packets. By sending specially crafted packets, a remote attacker could exploit this to bypass firewall rules. This has only be fixed for Ubuntu 6.10; the corresponding fix for Ubuntu 5.10 and 6.06 will follow soon. (CVE-2006-4572)

Dmitriy Monakhov discovered an information leak in the
__block_prepare_write() function. During error recovery, this function did not properly clear memory buffers which could allow local users to read portions of unlinked files. This only affects Ubuntu 5.10.
(CVE-2006-4813)

ADLab Venustech Info Ltd discovered that the ATM network driver referenced an already released pointer in some circumstances. By sending specially crafted packets to a host over ATM, a remote attacker could exploit this to crash that host. This does not affect Ubuntu 6.10. (CVE-2006-4997)

Matthias Andree discovered that the NFS locking management daemon (lockd) did not correctly handle mixing of 'lock' and 'nolock' option mounts on the same client. A remote attacker could exploit this to crash lockd and thus rendering the NFS imports inaccessible. This only affects Ubuntu 5.10. (CVE-2006-5158)

The task switching code did not save and restore EFLAGS of processes.
By starting a specially crafted executable, a local attacker could exploit this to eventually crash many other running processes. This does not affect Ubuntu 6.10. (CVE-2006-5173)

James Morris discovered that the ip6fl_get_n() function incorrectly handled flow labels. A local attacker could exploit this to crash the kernel. (CVE-2006-5619)

Fabio Massimo Di Nitto discovered that the sys_get_robust_list and sys_set_robust_list system calls lacked proper lock handling on the powerpc platform. A local attacker could exploit this to create unkillable processes, drain all available CPU/memory, and render the machine unrebootable. This only affects Ubuntu 6.10. (CVE-2006-5648)

Fabio Massimo Di Nitto discovered a flaw in the alignment check exception handling on the powerpc platform. A local attacker could exploit this to cause a kernel panic and crash the machine.
(CVE-2006-5649)

Certain corrupted squashfs file system images caused a memory allocation to be freed twice. By mounting a specially crafted squashfs file system, a local attacker could exploit this to crash the kernel.
This does not affect Ubuntu 5.10. (CVE-2006-5701)

An integer overflow was found in the get_fdb_entries() function of the network bridging code. By executing a specially crafted ioctl, a local attacker could exploit this to execute arbitrary code with root privileges. (CVE-2006-5751).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kernel update fixes the following security problems :

  - CVE-2006-4145: A bug within the UDF filesystem that     caused machine hangs when truncating files on the     filesystem was fixed. [#186226]

    - A potential crash when receiving IPX packets was       fixed. This problem is thought not to be exploitable.
      [#197809]

  - CVE-2006-4623: A problem in DVB packet handling could be     used to crash the machine when receiving DVB net     packages is active. [#201429]

  - CVE-2006-3741: A struct file leak was fixed in the     perfmon(2) system call on the Itanium architecture.
    [#202269]

  - CVE-2006-4538: A malformed ELF image can be used on the     Itanium architecture to trigger a kernel crash (denial     of service) when a local attacker can supply it to be     started. [#203822]

  - CVE-2006-4997: A problem in the ATM protocol handling     clip_mkip function could be used by remote attackers to     potentially crash the machine. [#205383]

CVE-2006-5757/

  - CVE-2006-6060: A problem in the grow_buffers function     could be used to crash or hang the machine using a     corrupted filesystem. This affects filesystem types     ISO9660 and NTFS. [#205384]

  - CVE-2006-5173: On the i386 architecture the ELFAGS     content was not correctly saved, which could be used by     local attackers to crash other programs using the AC and     NT flag or to escalate privileges by waiting for iopl     privileges to be leaked. [#209386]

  - CVE-2006-5174: On the S/390 architecture     copy_from_user() could be used by local attackers to     read kernel memory. [#209880]

  - CVE-2006-5619: A problem in IPv6 flowlabel handling can     be used by local attackers to hang the machine.
    [#216590]

  - CVE-2006-5648: On the PowerPC architecture a syscall has     been wired without the proper futex implementation that     can be exploited by a local attacker to hang the     machine. [#217295]

  - CVE-2006-5649: On the PowerPC architecture the proper     futex implementation was missing a fix for alignment     check which could be used by a local attacker to crash     the machine. [#217295]

  - CVE-2006-5823: A problem in cramfs could be used to     crash the machine during mounting a crafted cramfs     image. This requires an attacker to supply such a     crafted image and have a user mount it. [#218237]

  - CVE-2006-6053: A problem in the ext3 filesystem could be     used by attackers able to supply a crafted ext3 image to     cause a denial of service or further data corruption if     a user mounts this image. [#220288]

  - CVE-2006-6056: Missing return code checking in the HFS     could be used to crash machine when a user complicit     attacker is able to supply a specially crafted HFS     image. [#221230]

  - CVE-2006-4572: Multiple unspecified vulnerabilities in     netfilter for IPv6 code allow remote attackers to bypass     intended restrictions via fragmentation attack vectors,     aka (1) 'ip6_tables protocol bypass bug' and (2)     'ip6_tables extension header bypass bug'. [#221313]

  - CVE-2006-5751: An integer overflow in the networking     bridge ioctl starting with Kernel 2.6.7 could be used by     local attackers to overflow kernel memory buffers and     potentially escalate privileges [#222656]

Additionaly this kernel catches up to the SLE 10 state of the kernel, with massive additional fixes.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The __block_prepate_write function in the 2.6 kernel before 2.6.13 does not properly clear buffers during certain error conditions, which allows users to read portions of files that have been unlinked (CVE-2006-4813).

The clip_mkip function of the ATM subsystem in the 2.6 kernel allows remote attackers to dause a DoS (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (CVE-2006-4997).

The NFS lockd in the 2.6 kernel before 2.6.16 allows remote attackers to cause a DoS (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops and a deadlock (CVE-2006-5158).

The seqfile handling in the 2.6 kernel up to 2.6.18 allows local users to cause a DoS (hang or oops) via unspecified manipulations that trigger an infinite loop while searching for flowlabels (CVE-2006-5619).

A missing call to init_timer() in the isdn_ppp code of the Linux kernel can allow remote attackers to send a special kind of PPP pakcet which may trigger a kernel oops (CVE-2006-5749).

An integer overflow in the 2.6 kernel prior to 2.6.18.4 could allow a local user to execute arbitrary code via a large maxnum value in an ioctl request (CVE-2006-5751).

A race condition in the ISO9660 filesystem handling could allow a local user to cause a DoS (infinite loop) by mounting a crafted ISO9660 filesystem containing malformed data structures (CVE-2006-5757).

A vulnerability in the bluetooth support could allow for overwriting internal CMTP and CAPI data structures via malformed packets (CVE-2006-6106).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - __bread oops fix

  - added e1000_ng (nineveh support)

  - added sata_svw (Broadcom SATA support)

  - added Marvell PATA chipset support

  - disabled mmconf on some broken hardware/BIOSes

  - use GENERICARCH and enable bigsmp apic model for tulsa     machines

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

Bugs in the netfilter for IPv6 code, as reported by Mark Dowd, were fixed (CVE-2006-4572).

The ATM subsystem of the Linux kernel could allow a remote attacker to cause a Denial of Service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (CVE-2006-4997).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - updated to 2.6.17.14 - fix wrong error handling in     pccard_store_cis - add NX mask for PTE entry on x86_64 -     fix snd-hda-intel OOPS - backported support     r8169-related (r8168/r8169SC) network chipsets -     explicitly initialize some members of the drm_driver     structure, otherwise NULL init will have bad side     effects (mach64) - support for building a nosrc.rpm     package - fixed unplug/eject on pcmcia cards with r8169     chipsets - fix libata resource conflicts - fix xenU     crash and re-enable domU boot logs - fix refcount error     triggered by software using /proc/[pid]/auxv

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Updated kernel packages that fix a number of security issues as well as other bugs are now available for Red Hat Enterprise Linux 2.1 (32 bit architectures)

This security advisory has been rated as having moderate security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the ATM subsystem affecting systems with installed ATM hardware and configured ATM support that allowed a remote user to cause a denial of service (panic) by accessing socket buffer memory after it has been freed (CVE-2006-4997, Moderate)

* a flaw in the DVD handling of the CDROM driver that could be used together with a custom built USB device to gain root privileges (CVE-2006-2935, Moderate)

In addition to the security issues described above, the following bugs are also addressed :

* a potential overflow condition when reading /proc/devices * uninitialized memory in cdrom_init() that can lead to a crash at install time * a potential page corruption bug in /proc/kcore * a race condition when reading vmalloc()ed regions via /proc/kcore

All Red Hat Enterprise Linux 2.1 users are advised to upgrade their kernels to these updated packages, which contain backported fixes to correct these issues.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-4093     Olof Johansson reported a local DoS (Denial of Service)     vulnerability on the PPC970 platform. Unprivileged users     can hang the system by executing the 'attn' instruction,     which was not being disabled at boot.

  - CVE-2006-4538     Kirill Korotaev reported a local DoS (Denial of Service)     vulnerability on the ia64 and sparc architectures. A     user could cause the system to crash by executing a     malformed ELF binary due to insufficient verification of     the memory layout.

  - CVE-2006-4997     ADLab Venustech Info Ltd reported a potential remote DoS     (Denial of Service) vulnerability in the IP over ATM     subsystem. A remote system could cause the system to     crash by sending specially crafted packets that would     trigger an attempt to free an already-freed pointer     resulting in a system crash.

  - CVE-2006-5174     Martin Schwidefsky reported a potential leak of     sensitive information on s390 systems. The     copy_from_user function did not clear the remaining     bytes of the kernel buffer after receiving a fault on     the userspace address, resulting in a leak of     uninitialized kernel memory. A local user could exploit     this by appending to a file from a bad address.

  - CVE-2006-5649     Fabio Massimo Di Nitto reported a potential remote DoS     (Denial of Service) vulnerability on powerpc systems.
    The alignment exception only checked the exception table     for -EFAULT, not for other errors. This can be exploited     by a local user to cause a system crash (panic).

  - CVE-2006-5871     Bill Allombert reported that various mount options are     ignored by smbfs when UNIX extensions are enabled. This     includes the uid, gid and mode options. Client systems     would silently use the server-provided settings instead     of honoring these options, changing the security model.
    This update includes a fix from Haroldo Gamal that     forces the kernel to honor these mount options. Note     that, since the current versions of smbmount always pass     values for these options to the kernel, it is not     currently possible to activate unix extensions by     omitting mount options. However, this behavior is     currently consistent with the current behavior of the     next Debian release, 'etch'.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3741     Stephane Eranian discovered a local DoS (Denial of     Service) vulnerability on the ia64 architecture. A local     user could exhaust the available file descriptors by     exploiting a counting error in the permonctl() system     call.

  - CVE-2006-4538     Kirill Korotaev reported a local DoS (Denial of Service)     vulnerability on the ia64 and sparc architectures. A     user could cause the system to crash by executing a     malformed ELF binary due to insufficient verification of     the memory layout.

  - CVE-2006-4813     Dmitriy Monakhov reported a potential memory leak in the
    __block_prepare_write function. __block_prepare_write     does not properly sanitize kernel buffers during error     recovery, which could be exploited by local users to     gain access to sensitive kernel memory.

  - CVE-2006-4997     ADLab Venustech Info Ltd reported a potential remote DoS     (Denial of Service) vulnerability in the IP over ATM     subsystem. A remote system could cause the system to     crash by sending specially crafted packets that would     trigger an attempt to free an already-freed pointer     resulting in a system crash.

  - CVE-2006-5174     Martin Schwidefsky reported a potential leak of     sensitive information on s390 systems. The     copy_from_user function did not clear the remaining     bytes of the kernel buffer after receiving a fault on     the userspace address, resulting in a leak of     uninitialized kernel memory. A local user could exploit     this by appending to a file from a bad address.

  - CVE-2006-5619     James Morris reported a potential local DoS (Denial of     Service) vulnerability that could be used to hang or     oops a system. The seqfile handling for     /proc/net/ip6_flowlabel has a flaw that can be exploited     to cause an infinite loop by reading this file after     creating a flowlabel.

  - CVE-2006-5649     Fabio Massimo Di Nitto reported a potential remote DoS     (Denial of Service) vulnerability on powerpc systems.
    The alignment exception only checked the exception table     for -EFAULT, not for other errors. This can be exploited     by a local user to cause a system crash (panic).

  - CVE-2006-5751     Eugene Teo reported a vulnerability in the     get_fdb_entries function that could potentially be     exploited to allow arbitrary code execution with     escalated privileges.

  - CVE-2006-5871     Bill Allombert reported that various mount options are     ignored by smbfs when UNIX extensions are enabled. This     includes the uid, gid and mode options. Client systems     would silently use the server-provided settings instead     of honoring these options, changing the security model.
    This update includes a fix from Haroldo Gamal that     forces the kernel to honor these mount options. Note     that, since the current versions of smbmount always pass     values for these options to the kernel, it is not     currently possible to activate unix extensions by     omitting mount options. However, this behavior is     currently consistent with the current behavior of the     next Debian release, 'etch'.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the IPC shared-memory implementation that allowed a local user to cause a denial of service (deadlock) that resulted in freezing the system (CVE-2006-4342, Important)

* an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read arbitrary kernel memory (CVE-2006-5174, Important)

* a flaw in the ATM subsystem affecting systems with installed ATM hardware and configured ATM support that allowed a remote user to cause a denial of service (panic) by accessing socket buffer memory after it has been freed (CVE-2006-4997, Moderate)

* a directory traversal vulnerability in smbfs that allowed a local user to escape chroot restrictions for an SMB-mounted filesystem via '..\\' sequences (CVE-2006-1864, Moderate)

* a flaw in the mprotect system call that allowed enabling write permission for a read-only attachment of shared memory (CVE-2006-2071, Moderate)

* a flaw in the DVD handling of the CDROM driver that could be used together with a custom built USB device to gain root privileges (CVE-2006-2935, Moderate)

In addition to the security issues described above, a bug fix for a clock skew problem (which could lead to unintended keyboard repeat under X11) was also included. The problem only occurred when running the 32-bit x86 kernel on 64-bit dual-core x86_64 hardware.

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the SCTP support that allowed a local user to cause a denial of service (crash) with a specific SO_LINGER value.
(CVE-2006-4535, Important)

* a flaw in the hugepage table support that allowed a local user to cause a denial of service (crash). (CVE-2005-4811, Important)

* a flaw in the mprotect system call that allowed setting write permission for a read-only attachment of shared memory.
(CVE-2006-2071, Moderate)

* a flaw in HID0[31] (en_attn) register handling on PowerPC 970 systems that allowed a local user to cause a denial of service.
(crash) (CVE-2006-4093, Moderate)

* a flaw in the perfmon support of Itanium systems that allowed a local user to cause a denial of service by consuming all file descriptors. (CVE-2006-3741, Moderate)

* a flaw in the ATM subsystem. On systems with installed ATM hardware and configured ATM support, a remote user could cause a denial of service (panic) by accessing socket buffers memory after freeing them.
(CVE-2006-4997, Moderate)

* a flaw in the DVB subsystem. On systems with installed DVB hardware and configured DVB support, a remote user could cause a denial of service (panic) by sending a ULE SNDU packet with length of 0.
(CVE-2006-4623, Low)

* an information leak in the network subsystem that possibly allowed a local user to read sensitive data from kernel memory. (CVE-2006-0039, Low)

In addition, two bugfixes for the IPW-2200 wireless driver were included. The first one ensures that wireless management applications correctly identify IPW-2200 controlled devices, while the second fix ensures that DHCP requests using the IPW-2200 operate correctly.

Red Hat would like to thank Olof Johansson, Stephane Eranian and Solar Designer for reporting issues fixed in this erratum.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2006-0710.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2006-0689.

ID	Name	Product	Family	Severity
67413	Oracle Linux 3 : kernel (ELSA-2006-0710)	Nessus	Oracle Linux Local Security Checks	high
67401	Oracle Linux 4 : kernel (ELSA-2006-0617 / ELSA-2006-0689)	Nessus	Oracle Linux Local Security Checks	high
59162	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2393)	Nessus	SuSE Local Security Checks	high
29490	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2399)	Nessus	SuSE Local Security Checks	high
27981	Ubuntu 5.10 / 6.06 LTS / 6.10 : linux-source-2.6.12/-2.6.15/-2.6.17 vulnerabilities (USN-395-1)	Nessus	Ubuntu Local Security Checks	high
27291	openSUSE 10 Security Update : kernel (kernel-2397)	Nessus	SuSE Local Security Checks	high
24628	Mandrake Linux Security Advisory : kernel (MDKSA-2007:012)	Nessus	Mandriva Local Security Checks	high
24582	Mandrake Linux Security Advisory : kernel (MDKSA-2006:197)	Nessus	Mandriva Local Security Checks	high
24212	RHEL 2.1 : kernel (RHSA-2007:0013)	Nessus	Red Hat Local Security Checks	high
23911	Debian DSA-1237-1 : kernel-source-2.4.27 - several vulnerabilities	Nessus	Debian Local Security Checks	high
23846	Debian DSA-1233-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	high
22918	RHEL 3 : kernel (RHSA-2006:0710)	Nessus	Red Hat Local Security Checks	high
22879	CentOS 3 : kernel (CESA-2006:0710)	Nessus	CentOS Local Security Checks	high
22523	RHEL 4 : kernel (RHSA-2006:0689)	Nessus	Red Hat Local Security Checks	high
22513	CentOS 4 : kernel (CESA-2006:0689)	Nessus	CentOS Local Security Checks	high
801423	CentOS RHSA-2006-0710 Security Check	Log Correlation Engine	Generic	high
801422	CentOS RHSA-2006-0689 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2006-4997

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high