The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0940 advisory.

    [2.6.18-8.1.15.0.1.el5]
     - Fix bonding primary=ethX (Bert Barbe) [IT 101532] [ORA 5136660]
     - Add entropy module option to e1000/bnx2 (John Sobecki) [ORA 6045759]

     [2.6.18-8.1.15.el5]
     - [dlm] A TCP connection to DLM port blocks DLM operations (Patrick      Caulfield ) [245922] {CVE-2007-3380}
     - [ppc] 4k page mapping support for userspace in 64k kernels (Scott      Moser ) [275841] {CVE-2007-3850}
     - [ptrace] NULL pointer dereference triggered by ptrace (Anton Arapov )      [275981] {CVE-2007-3731}
     - [fs] hugetlb: fix prio_tree unit (Konrad Rzeszutek ) [253929]      {CVE-2007-4133}
     - [x86_64] Don't leak NT bit into next task (Dave Anderson ) [298151]      {CVE-2007-4574}
     - [fs] Reset current->pdeath_signal on SUID binary execution (Peter      Zijlstra ) [252307] {CVE-2007-3848}
     - [misc] Bounds check ordering issue in random driver (Anton Arapov )      [275961] {CVE-2007-3105}
     - [usb] usblcd: Locally triggerable memory consumption (Anton Arapov )      [276001] {CVE-2007-3513}
     - [net] igmp: check for NULL when allocating GFP_ATOMIC skbs (Neil      Horman ) [303281]
     - [scsi] aacraid: Missing ioctl() permission checks (Vitaly Mayatskikh )      [298371] {CVE-2007-4308}
     - [xen] Guest access to MSR may cause system crash/data corruption      (Bhavana Nagendra ) [253312] {CVE-2007-3733}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

These new kernel packages contain fixes for the following security issues :

  - A flaw was found in the backported stack unwinder fixes     in Red Hat Enterprise Linux 5. On AMD64 and Intel 64     platforms, a local user could trigger this flaw and     cause a denial of service. (CVE-2007-4574, Important)

  - A flaw was found in the handling of process death     signals. This allowed a local user to send arbitrary     signals to the suid-process executed by that user. A     successful exploitation of this flaw depends on the     structure of the suid-program and its signal handling.
    (CVE-2007-3848, Important)

  - A flaw was found in the Distributed Lock Manager (DLM)     in the cluster manager. This allowed a remote user who     is able to connect to the DLM port to cause a denial of     service. (CVE-2007-3380, Important)

  - A flaw was found in the aacraid SCSI driver. This     allowed a local user to make ioctl calls to the driver     which should otherwise be restricted to privileged     users. (CVE-2007-4308, Moderate)

  - A flaw was found in the prio_tree handling of the     hugetlb support that allowed a local user to cause a     denial of service. This only affected kernels with     hugetlb support. (CVE-2007-4133, Moderate)

  - A flaw was found in the eHCA driver on PowerPC     architectures that allowed a local user to access 60k of     physical address space. This address space could contain     sensitive information. (CVE-2007-3850, Moderate)

  - A flaw was found in ptrace support that allowed a local     user to cause a denial of service via a NULL pointer     dereference. (CVE-2007-3731, Moderate)

  - A flaw was found in the usblcd driver that allowed a     local user to cause a denial of service by writing data     to the device node. To exploit this issue, write access     to the device node was needed. (CVE-2007-3513, Moderate)

  - A flaw was found in the random number generator     implementation that allowed a local user to cause a     denial of service or possibly gain privileges. If the     root user raised the default wakeup threshold over the     size of the output pool, this flaw could be exploited.
    (CVE-2007-3105, Low)

In addition to the security issues described above, several bug fixes preventing possible system crashes and data corruption were also included.

Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 5 kernel are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the following security issues :

* A flaw was found in the backported stack unwinder fixes in Red Hat Enterprise Linux 5. On AMD64 and Intel 64 platforms, a local user could trigger this flaw and cause a denial of service. (CVE-2007-4574, Important)

* A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling.
(CVE-2007-3848, Important)

* A flaw was found in the Distributed Lock Manager (DLM) in the cluster manager. This allowed a remote user who is able to connect to the DLM port to cause a denial of service. (CVE-2007-3380, Important)

* A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver which should otherwise be restricted to privileged users. (CVE-2007-4308, Moderate)

* A flaw was found in the prio_tree handling of the hugetlb support that allowed a local user to cause a denial of service. This only affected kernels with hugetlb support. (CVE-2007-4133, Moderate)

* A flaw was found in the eHCA driver on PowerPC architectures that allowed a local user to access 60k of physical address space. This address space could contain sensitive information. (CVE-2007-3850, Moderate)

* A flaw was found in ptrace support that allowed a local user to cause a denial of service via a NULL pointer dereference.
(CVE-2007-3731, Moderate)

* A flaw was found in the usblcd driver that allowed a local user to cause a denial of service by writing data to the device node. To exploit this issue, write access to the device node was needed.
(CVE-2007-3513, Moderate)

* A flaw was found in the random number generator implementation that allowed a local user to cause a denial of service or possibly gain privileges. If the root user raised the default wakeup threshold over the size of the output pool, this flaw could be exploited.
(CVE-2007-3105, Low)

In addition to the security issues described above, several bug fixes preventing possible system crashes and data corruption were also included.

Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to resolve these issues.

Evan Teran discovered that the Linux kernel ptrace routines did not correctly handle certain requests robustly. Local attackers could exploit this to crash the system, causing a denial of service.
(CVE-2007-3731)

It was discovered that hugetlb kernels on PowerPC systems did not prevent the stack from colliding with reserved kernel memory. Local attackers could exploit this and crash the system, causing a denial of service. (CVE-2007-3739)

It was discovered that certain CIFS filesystem actions did not honor the umask of a process. Local attackers could exploit this to gain additional privileges. (CVE-2007-3740)

Wojciech Purczynski discovered that the Linux kernel ia32 syscall emulation in x86_64 kernels did not correctly clear the high bits of registers. Local attackers could exploit this to gain root privileges.
(CVE-2007-4573).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3731     Evan Teran discovered a potential local denial of     service (oops) in the handling of PTRACE_SETREGS and     PTRACE_SINGLESTEP requests.

  - CVE-2007-3739     Adam Litke reported a potential local denial of service     (oops) on powerpc platforms resulting from unchecked VMA     expansion into address space reserved for hugetlb pages.

  - CVE-2007-3740     Matt Keenan reported that CIFS filesystems with CAP_UNIX     enabled were not honoring a process' umask which may     lead to unintentionally relaxed permissions.

  - CVE-2007-4573     Wojciech Purczynski discovered a vulnerability that can     be exploited by a local user to obtain superuser     privileges on x86_64 systems. This resulted from     improper clearing of the high bits of registers during     ia32 system call emulation. This vulnerability is     relevant to the Debian amd64 port as well as users of     the i386 port who run the amd64 linux-image flavour.

  - CVE-2007-4849     Michael Stone reported an issue with the JFFS2     filesystem. Legacy modes for inodes that were created     with POSIX ACL support enabled were not being written     out to the medium, resulting in incorrect permissions     upon remount.

These problems have been fixed in the stable distribution in version 2.6.18.dfsg.1-13etch3.

This advisory has been updated to include a build for the arm architecture, which was not yet available at the time of DSA-1378-1.

The following matrix lists additional packages that were rebuilt for compatibility with or to take advantage of this update :

                           Debian 4.0 (etch)           fai-kernels               1.17+etch.13etch3           user-mode-linux           2.6.18-1um-2etch.13etch3

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0940.

ID	Name	Product	Family	Severity
67581	Oracle Linux 5 : Important:kernel (ELSA-2007-0940)	Nessus	Oracle Linux Local Security Checks	medium
60272	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43654	CentOS 5 : kernel (CESA-2007:0940)	Nessus	CentOS Local Security Checks	medium
28123	Ubuntu 6.06 LTS / 6.10 / 7.04 : linux-source-2.6.15, linux-source-2.6.17, linux-source-2.6.20 vulnerabilities (USN-518-1)	Nessus	Ubuntu Local Security Checks	high
27565	RHEL 5 : kernel (RHSA-2007:0940)	Nessus	Red Hat Local Security Checks	medium
26208	Debian DSA-1378-2 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	high
801440	CentOS RHSA-2007-0940 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2007-3731

medium

Tenable Plugins

medium

medium

medium

high

medium

high

high