The key serial number collision avoidance code in the key_alloc_serial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service (crash) via vectors that trigger a null dereference, as originally reported as "spinlock CPU recursion."

From Red Hat Security Advisory 2007:0085 :

Updated kernel packages that fix two security issues and a bug in the Red Hat Enterprise Linux 4 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for two security issues :

* a flaw in the key serial number collision avoidance algorithm of the keyctl subsystem that allowed a local user to cause a denial of service (CVE-2007-0006, Important)

* a flaw in the file watch implementation of the audit subsystems that allowed a local user to cause a denial of service (panic). To exploit this flaw a privileged user must have previously created a watch for a file (CVE-2007-0001, Moderate)

In addition to the security issues described above, a fix for the SCTP subsystem to address a system crash which may be experienced in Telco environments has been included.

Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

The kernel key management code did not correctly handle key reuse. A local attacker could create many key requests, leading to a denial of service. (CVE-2007-0006)

The kernel NFS code did not correctly validate NFSACL2 ACCESS requests. If a system was serving NFS mounts, a remote attacker could send a specially crafted packet, leading to a denial of service.
(CVE-2007-0772)

When dumping core, the kernel did not correctly handle PT_INTERP processes. A local attacker could create situations where they could read the contents of otherwise unreadable executable programs.
(CVE-2007-0958).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kernel update fixes the following security problems :

  - CVE-2006-5751: An integer overflow in the networking     bridge ioctl starting with Kernel 2.6.7 could be used by     local attackers to overflow kernel memory buffers and     potentially escalate privileges [#222656]

  - CVE-2006-6106: Multiple buffer overflows in the     cmtp_recv_interopmsg function in the Bluetooth driver     (net/bluetooth/cmtp/capi.c) in the Linux kernel allowed     remote attackers to cause a denial of service (crash)     and possibly execute arbitrary code via CAPI messages     with a large value for the length of the (1) manu     (manufacturer) or (2) serial (serial number) field.
    [#227603]

  - CVE-2006-5749: The isdn_ppp_ccp_reset_alloc_state     function in drivers/isdn/isdn_ppp.c in the Linux kernel     does not call the init_timer function for the ISDN PPP     CCP reset state timer, which has unknown attack vectors     and results in a system crash. [#229619]

  - CVE-2006-5753: Unspecified vulnerability in the     listxattr system call in Linux kernel, when a 'bad     inode' is present, allows local users to cause a denial     of service (data corruption) and possibly gain     privileges. [#230270]

  - CVE-2007-0006: The key serial number collision avoidance     code in the key_alloc_serial function allows local users     to cause a denial of service (crash) via vectors that     trigger a null dereference. [#243003]

  - CVE-2007-0772: A remote denial of service problem on     NFSv2 mounts with ACL enabled was fixed. [#244909]

Furthermore, it catches up to the mainline kernel, version 2.6.18.8, and contains a large number of additional fixes for non security bugs.

Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* a flaw in the key serial number collision avoidance algorithm of the keyctl subsystem that allowed a local user to cause a denial of service (CVE-2007-0006, Important)

* a flaw in the Omnikey CardMan 4040 driver that allowed a local user to execute arbitrary code with kernel privileges. In order to exploit this issue, the Omnikey CardMan 4040 PCMCIA card must be present and the local user must have access rights to the character device created by the driver. (CVE-2007-0005, Moderate)

* a flaw in the core-dump handling that allowed a local user to create core dumps from unreadable binaries via PT_INTERP. (CVE-2007-0958, Low)

In addition to the security issues described above, a fix for a kernel panic in the powernow-k8 module, and a fix for a kernel panic when booting the Xen domain-0 on system with large memory installations have been included.

Red Hat would like to thank Daniel Roethlisberger for reporting an issue fixed in this erratum.

Red Hat Enterprise Linux 5 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The 2.6.17 kernel and earlier, when running on IA64 and SPARC platforms would allow a local user to cause a DoS (crash) via a malformed ELF file (CVE-2006-4538).

The mincore function in the Linux kernel did not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock (CVE-2006-4814).

An unspecified vulnerability in the listxattr system call, when a 'bad inode' is present, could allow a local user to cause a DoS (data corruption) and possibly gain privileges via unknown vectors (CVE-2006-5753).

The zlib_inflate function allows local users to cause a crash via a malformed filesystem that uses zlib compression that triggers memory corruption (CVE-2006-5823).

The ext3fs_dirhash function could allow local users to cause a DoS (crash) via an ext3 stream with malformed data structures (CVE-2006-6053).

When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056).

The key serial number collision avoidance code in the key_alloc_serial function in kernels 2.6.9 up to 2.6.20 allows local users to cause a crash via vectors thatr trigger a null dereference (CVE-2007-0006).

The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772).

A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - add PCI IDs for cciss driver (HP ML370G5 / DL360G5)

    - fixed a mssive SCSI reset on megasas (Dell PE2960)

    - increased port-reset completion delay for HP       controllers (HP ML350)

    - NUMA rnage fixes for x86_64

    - various netfilter fixes

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Updated kernel packages that fix two security issues and a bug in the Red Hat Enterprise Linux 4 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for two security issues :

* a flaw in the key serial number collision avoidance algorithm of the keyctl subsystem that allowed a local user to cause a denial of service (CVE-2007-0006, Important)

* a flaw in the file watch implementation of the audit subsystems that allowed a local user to cause a denial of service (panic). To exploit this flaw a privileged user must have previously created a watch for a file (CVE-2007-0001, Moderate)

In addition to the security issues described above, a fix for the SCTP subsystem to address a system crash which may be experienced in Telco environments has been included.

Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

A double free vulnerability in the squashfs module could allow a local user to cause a Denial of Service by mounting a crafted squashfs filesystem (CVE-2006-5701).

The zlib_inflate function allows local users to cause a crash via a malformed filesystem that uses zlib compression that triggers memory corruption (CVE-2006-5823).

The key serial number collision avoidance code in the key_alloc_serial function in kernels 2.6.9 up to 2.6.20 allows local users to cause a crash via vectors thatr trigger a null dereference (CVE-2007-0006).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - New drivers: nozomi, UVC

    - Fixed SiS SATA support for chips on 966/968 bridges

    - Fixed issues in squashfs by updating to 3.2 (#27008)

    - Added support for SiS968 bridgest to the sis190 bridge

    - Fixed JMicron cable detection

    - Added /proc/config.gz support and enabled kexec on       x86_64

    - Other minor fixes

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0085.

ID	Name	Product	Family	Severity
67456	Oracle Linux 4 : kernel (ELSA-2007-0085)	Nessus	Oracle Linux Local Security Checks	medium
28048	Ubuntu 6.06 LTS / 6.10 : linux-source-2.6.15/2.6.17 vulnerabilities (USN-451-1)	Nessus	Ubuntu Local Security Checks	high
27293	openSUSE 10 Security Update : kernel (kernel-2705)	Nessus	SuSE Local Security Checks	high
25319	RHEL 5 : kernel (RHSA-2007:0099)	Nessus	Red Hat Local Security Checks	medium
24810	Mandrake Linux Security Advisory : kernel (MDKSA-2007:060)	Nessus	Mandriva Local Security Checks	high
24727	CentOS 4 : kernel (CESA-2007:0085)	Nessus	CentOS Local Security Checks	medium
24724	RHEL 4 : kernel (RHSA-2007:0085)	Nessus	Red Hat Local Security Checks	medium
24689	Mandrake Linux Security Advisory : kernel (MDKSA-2007:047)	Nessus	Mandriva Local Security Checks	medium
801425	CentOS RHSA-2007-0085 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2007-0006

medium

Tenable Plugins

medium

high

high

medium

high

medium

medium

medium

high