The decode_choice function in net/netfilter/nf_conntrack_h323_asn1.c in the Linux kernel before 2.6.20.15, 2.6.21.x before 2.6.21.6, and before 2.6.22 allows remote attackers to cause a denial of service (crash) via an encoded, out-of-range index value for a choice field, which triggers a NULL pointer dereference.

A flaw was discovered in the PPP over Ethernet implementation. Local attackers could manipulate ioctls and cause kernel memory consumption leading to a denial of service. (CVE-2007-2525)

An integer underflow was discovered in the cpuset filesystem. If mounted, local attackers could obtain kernel memory using large file offsets while reading the tasks file. This could disclose sensitive data. (CVE-2007-2875)

Vilmos Nebehaj discovered that the SCTP netfilter code did not correctly validate certain states. A remote attacker could send a specially crafted packet causing a denial of service. (CVE-2007-2876)

Luca Tettamanti discovered a flaw in the VFAT compat ioctls on 64-bit systems. A local attacker could corrupt a kernel_dirent struct and cause a denial of service. (CVE-2007-2878)

A flaw in the sysfs_readdir function allowed a local user to cause a denial of service by dereferencing a NULL pointer. (CVE-2007-3104)

A buffer overflow was discovered in the random number generator. In environments with granular assignment of root privileges, a local attacker could gain additional privileges. (CVE-2007-3105)

A flaw was discovered in the usblcd driver. A local attacker could cause large amounts of kernel memory consumption, leading to a denial of service. (CVE-2007-3513)

Zhongling Wen discovered that the h323 conntrack handler did not correctly handle certain bitfields. A remote attacker could send a specially crafted packet and cause a denial of service.
(CVE-2007-3642)

A flaw was discovered in the CIFS mount security checking. Remote attackers could spoof CIFS network traffic, which could lead a client to trust the connection. (CVE-2007-3843)

It was discovered that certain setuid-root processes did not correctly reset process death signal handlers. A local user could manipulate this to send signals to processes they would not normally have access to. (CVE-2007-3848)

The Direct Rendering Manager for the i915 driver could be made to write to arbitrary memory locations. An attacker with access to a running X11 session could send a specially crafted buffer and gain root privileges. (CVE-2007-3851)

It was discovered that the aacraid SCSI driver did not correctly check permissions on certain ioctls. A local attacker could cause a denial of service or gain privileges. (CVE-2007-4308).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rebase kernel to 2.6.22.1:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.1

Includes the CFS scheduler from upstream kernel 2.6.23.

Users should update to the latest autofs package with this kernel or autofs will use excessive amounts of CPU time.

CVE-2007-3642: The decode_choice function in net/netfilter/bf_conntrack_h323_asn1.c in the Linux kernel before 2.6.22 allows remote attackers to cause a denial of service (crash) via an encoded, out-of-range index value for a choice field, which triggers a NULL pointer dereference.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

A stack-based buffer overflow in the random number generator could allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size (CVE-2007-3105).

The lcd_write function did not limit the amount of memory used by a caller, which allows local users to cause a denial of service (memory consumption) (CVE-2007-3513).

The decode_choice function allowed remote attackers to cause a denial of service (crash) via an encoded out-of-range index value for a choice field which triggered a NULL pointer dereference (CVE-2007-3642).

The Linux kernel allowed local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die which delivered an attacker-controlled parent process death signal (PR_SET_PDEATHSIG) (CVE-2007-3848).

The aac_cfg_openm and aac_compat_ioctl functions in the SCSI layer ioctl patch in aacraid did not check permissions for ioctls, which might allow local users to cause a denial of service or gain privileges (CVE-2007-4308).

The IA32 system call emulation functionality, when running on the x86_64 architecture, did not zero extend the eax register after the 32bit entry path to ptrace is used, which could allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register (CVE-2007-4573).

In addition to these security fixes, other fixes have been included such as :

  - More NVidia PCI ids wre added

    - The 3w-9xxx module was updated to version 2.26.02.010

    - Fixed the map entry for ICH8

    - Added the TG3 5786 PCI id

    - Reduced the log verbosity of cx88-mpeg

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1353     Ilja van Sprundel discovered that kernel memory could be     leaked via the Bluetooth setsockopt call due to an     uninitialized stack buffer. This could be used by local     attackers to read the contents of sensitive kernel     memory.

  - CVE-2007-2172     Thomas Graf reported a typo in the DECnet protocol     handler that could be used by a local attacker to     overrun an array via crafted packets, potentially     resulting in a Denial of Service (system crash). A     similar issue exists in the IPV4 protocol handler and     will be fixed in a subsequent update.

  - CVE-2007-2453     A couple of issues with random number generation were     discovered. Slightly less random numbers resulted from     hashing a subset of the available entropy. Zero-entropy     systems were seeded with the same inputs at boot time,     resulting in repeatable series of random numbers.

  - CVE-2007-2525     Florian Zumbiehl discovered a memory leak in the PPPOE     subsystem caused by releasing a socket before     PPPIOCGCHAN is called upon it. This could be used by a     local user to DoS a system by consuming all available     memory.

  - CVE-2007-2876     Vilmos Nebehaj discovered a NULL pointer dereference     condition in the netfilter subsystem. This allows remote     systems which communicate using the SCTP protocol to     crash a system by creating a connection with an unknown     chunk type.

  - CVE-2007-3513     Oliver Neukum reported an issue in the usblcd driver     which, by not limiting the size of write buffers,     permits local users with write access to trigger a DoS     by consuming all available memory.

  - CVE-2007-3642     Zhongling Wen reported an issue in nf_conntrack_h323     where the lack of range checking may lead to NULL     pointer dereferences. Remote attackers could exploit     this to create a DoS condition (system crash).

  - CVE-2007-3848     Wojciech Purczynski discovered that pdeath_signal was     not being reset properly under certain conditions which     may allow local users to gain privileges by sending     arbitrary signals to suid binaries.

  - CVE-2007-3851     Dave Airlie reported that Intel 965 and above chipsets     have relocated their batch buffer security bits. Local X     server users may exploit this to write user data to     arbitrary physical memory addresses.

These problems have been fixed in the stable distribution in version 2.6.18.dfsg.1-13etch1.

The following matrix lists additional packages that were rebuilt for compatibility with or to take advantage of this update :

                    Debian 4.0 (etch)    fai-kernels        1.17+etch4           user-mode-linux    2.6.18-1um-2etch3

ID	Name	Product	Family	Severity
28114	Ubuntu 7.04 : linux-source-2.6.20 vulnerabilities (USN-510-1)	Nessus	Ubuntu Local Security Checks	high
27691	Fedora 7 : kernel-2.6.22.1-27.fc7 (2007-1130)	Nessus	Fedora Local Security Checks	high
27561	Mandrake Linux Security Advisory : kernel (MDKSA-2007:195)	Nessus	Mandriva Local Security Checks	high
25909	Debian DSA-1356-1 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-3642

medium

Tenable Plugins

high

high

high

high