The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 "relies on user space to close the device," which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries, unless the attacker can convince the victim to unplug the affected device.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix utrace dead_engine ops race

  - fix ptrace_attach leak

  - CVE-2007-5093: kernel PWC driver DoS

  - CVE-2007-6282: IPSec ESP kernel panics

  - CVE-2007-6712: kernel: infinite loop in highres timers     (kernel hang)

  - CVE-2008-1615: kernel: ptrace: Unprivileged crash on     x86_64 %cs corruption

  - CVE-2008-1294: kernel: setrlimit(RLIMIT_CPUINFO) with     zero value doesn't inherit properly across children

  - CVE-2008-2136: kernel: sit memory leak

  - CVE-2008-2812: kernel: NULL ptr dereference in multiple     network drivers due to missing checks in tty code

  - restore     linux-2.6-x86-clear-df-flag-for-signal-handlers.patch

  - restore linux-2.6-utrace.patch /     linux-2.6-xen-utrace.patch

  - Kernel security erratas for OVM 2.1.2 from bz#5932 :

  - CVE-2007-6063: isdn: fix possible isdn_net buffer     overflows

  - CVE-2007-3104 Null pointer to an inode in a dentry can     cause an oops in sysfs_readdir

  - CVE-2008-0598: write system call vulnerability

  - CVE-2008-1375: kernel: race condition in dnotify

  - CVE-2008-0001: kernel: filesystem corruption by     unprivileged user via directory truncation

  - CVE-2008-2358: dccp: sanity check feature length

  - CVE-2007-5938: NULL dereference in iwl driver

  - RHSA-2008:0508: kernel: [x86_64] The string instruction     version didn't zero the output on exception.

  - kernel: clear df flag for signal handlers

  - fs: missing dput in do_lookup error leaks dentries

  - sysfs: fix condition check in sysfs_drop_dentry

  - sysfs: fix race condition around sd->s_dentry

  - ieee80211: off-by-two integer underflow

From Red Hat Security Advisory 2008:0972 :

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* a flaw was found in the Linux kernel's Direct-IO implementation.
This could have allowed a local unprivileged user to cause a denial of service. (CVE-2007-6716, Important)

* when running ptrace in 31-bit mode on an IBM S/390 or IBM System z kernel, a local unprivileged user could cause a denial of service by reading from or writing into a padding area in the user_regs_struct32 structure. (CVE-2008-1514, Important)

* the do_truncate() and generic_file_splice_write() functions did not clear the setuid and setgid bits. This could have allowed a local unprivileged user to obtain access to privileged information.
(CVE-2008-4210, Important)

* Tobias Klein reported a missing check in the Linux kernel's Open Sound System (OSS) implementation. This deficiency could have led to an information leak. (CVE-2008-3272, Moderate)

* a potential denial of service attack was discovered in the Linux kernel's PWC USB video driver. A local unprivileged user could have used this flaw to bring the kernel USB subsystem into the busy-waiting state. (CVE-2007-5093, Low)

* the ext2 and ext3 file systems code failed to properly handle corrupted data structures, leading to a possible local denial of service issue when read or write operations were performed.
(CVE-2008-3528, Low)

In addition, these updated packages fix the following bugs :

* when using the CIFS 'forcedirectio' option, appending to an open file on a CIFS share resulted in that file being overwritten with the data to be appended.

* a kernel panic occurred when a device with PCI ID 8086:10c8 was present on a system with a loaded ixgbe driver.

* due to an aacraid driver regression, the kernel failed to boot when trying to load the aacraid driver and printed the following error message: 'aac_srb: aac_fib_send failed with status: 8195'.

* due to an mpt driver regression, when RAID 1 was configured on Primergy systems with an LSI SCSI IME 53C1020/1030 controller, the kernel panicked during boot.

* the mpt driver produced a large number of extraneous debugging messages when performing a 'Host reset' operation.

* due to a regression in the sym driver, the kernel panicked when a SCSI hot swap was performed using MCP18 hardware.

* all cores on a multi-core system now scale their frequencies in accordance with the policy set by the system's CPU frequency governor.

* the netdump subsystem suffered from several stability issues. These are addressed in this updated kernel.

* under certain conditions, the ext3 file system reported a negative count of used blocks.

* reading /proc/self/mem incorrectly returned 'Invalid argument' instead of 'input/output error' due to a regression.

* under certain conditions, the kernel panicked when a USB device was removed while the system was busy accessing the device.

* a race condition in the kernel could have led to a kernel crash during the creation of a new process.

All Red Hat Enterprise Linux 4 Users should upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2008:0275 :

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* on 64-bit architectures, the possibility of a timer-expiration value overflow was found in the Linux kernel high-resolution timers functionality, hrtimer. This could allow a local unprivileged user to setup a large interval value, forcing the timer expiry value to become negative, causing a denial of service (kernel hang). (CVE-2007-6712, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a potential denial of service attack was discovered in the Linux kernel PWC USB video driver. A local unprivileged user could use this flaw to bring the kernel USB subsystem into the busy-waiting state, causing a denial of service. (CVE-2007-5093, Low)

As well, these updated packages fix the following bugs :

* in certain situations, a kernel hang and a possible panic occurred when disabling the cpufreq daemon. This may have prevented system reboots from completing successfully.

* continual 'softlockup' messages, which occurred on the guest's console after a successful save and restore of a Red Hat Enterprise Linux 5 para-virtualized guest, have been resolved.

* in the previous kernel packages, the kernel may not have reclaimed NFS locks after a system reboot.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

- a flaw was found in the Linux kernel's Direct-IO     implementation. This could have allowed a local     unprivileged user to cause a denial of service.
    (CVE-2007-6716, Important)

  - when running ptrace in 31-bit mode on an IBM S/390 or     IBM System z kernel, a local unprivileged user could     cause a denial of service by reading from or writing     into a padding area in the user_regs_struct32 structure.
    (CVE-2008-1514, Important)

  - the do_truncate() and generic_file_splice_write()     functions did not clear the setuid and setgid bits. This     could have allowed a local unprivileged user to obtain     access to privileged information. (CVE-2008-4210,     Important)

  - Tobias Klein reported a missing check in the Linux     kernel's Open Sound System (OSS) implementation. This     deficiency could have led to an information leak.
    (CVE-2008-3272, Moderate)

  - a potential denial of service attack was discovered in     the Linux kernel's PWC USB video driver. A local     unprivileged user could have used this flaw to bring the     kernel USB subsystem into the busy-waiting state.
    (CVE-2007-5093, Low)

  - the ext2 and ext3 file systems code failed to properly     handle corrupted data structures, leading to a possible     local denial of service issue when read or write     operations were performed. (CVE-2008-3528, Low)

In addition, these updated packages fix the following bugs :

  - when using the CIFS 'forcedirectio' option, appending to     an open file on a CIFS share resulted in that file being     overwritten with the data to be appended.

  - a kernel panic occurred when a device with PCI ID     8086:10c8 was present on a system with a loaded ixgbe     driver.

  - due to an aacraid driver regression, the kernel failed     to boot when trying to load the aacraid driver and     printed the following error message: 'aac_srb:
    aac_fib_send failed with status: 8195'.

  - due to an mpt driver regression, when RAID 1 was     configured on Primergy systems with an LSI SCSI IME     53C1020/1030 controller, the kernel panicked during     boot.

  - the mpt driver produced a large number of extraneous     debugging messages when performing a 'Host reset'     operation.

  - due to a regression in the sym driver, the kernel     panicked when a SCSI hot swap was performed using MCP18     hardware.

  - all cores on a multi-core system now scale their     frequencies in accordance with the policy set by the     system's CPU frequency governor.

  - the netdump subsystem suffered from several stability     issues. These are addressed in this updated kernel.

  - under certain conditions, the ext3 file system reported     a negative count of used blocks.

  - reading /proc/self/mem incorrectly returned 'Invalid     argument' instead of 'input/output error' due to a     regression.

  - under certain conditions, the kernel panicked when a USB     device was removed while the system was busy accessing     the device.

  - a race condition in the kernel could have led to a     kernel crash during the creation of a new process.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* on 64-bit architectures, the possibility of a timer-expiration value overflow was found in the Linux kernel high-resolution timers functionality, hrtimer. This could allow a local unprivileged user to setup a large interval value, forcing the timer expiry value to become negative, causing a denial of service (kernel hang). (CVE-2007-6712, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a potential denial of service attack was discovered in the Linux kernel PWC USB video driver. A local unprivileged user could use this flaw to bring the kernel USB subsystem into the busy-waiting state, causing a denial of service. (CVE-2007-5093, Low)

As well, these updated packages fix the following bugs :

* in certain situations, a kernel hang and a possible panic occurred when disabling the cpufreq daemon. This may have prevented system reboots from completing successfully.

* continual 'softlockup' messages, which occurred on the guest's console after a successful save and restore of a Red Hat Enterprise Linux 5 para-virtualized guest, have been resolved.

* in the previous kernel packages, the kernel may not have reclaimed NFS locks after a system reboot.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges. (CVE-2007-3740)

The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.
(CVE-2007-3851)

The (1) hugetlb_vmtruncate_list and (2) hugetlb_vmtruncate functions in fs/hugetlbfs/inode.c in the Linux kernel before 2.6.19-rc4 perform certain prio_tree calculations using HPAGE_SIZE instead of PAGE_SIZE units, which allows local users to cause a denial of service (panic) via unspecified vectors. (CVE-2007-4133)

The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register. This vulnerability is now being fixed in the Xen kernel too. (CVE-2007-4573)

Integer underflow in the ieee80211_rx function in net/ieee80211/ieee80211_rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service (crash) via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211_STYPE_QOS_DATA flag is set, aka an off-by-two error.
(CVE-2007-4997)

The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 relies on user space to close the device, which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries, unless the attacker can convince the victim to unplug the affected device. (CVE-2007-5093)

A race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors. (CVE-2008-1375)

The Linux kernel before 2.6.25.2 does not apply a certain protection mechanism for fcntl functionality, which allows local users to (1) execute code in parallel or (2) exploit a race condition to obtain re-ordered access to the descriptor table. (CVE-2008-1669)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* a flaw was found in the Linux kernel's Direct-IO implementation.
This could have allowed a local unprivileged user to cause a denial of service. (CVE-2007-6716, Important)

* when running ptrace in 31-bit mode on an IBM S/390 or IBM System z kernel, a local unprivileged user could cause a denial of service by reading from or writing into a padding area in the user_regs_struct32 structure. (CVE-2008-1514, Important)

* the do_truncate() and generic_file_splice_write() functions did not clear the setuid and setgid bits. This could have allowed a local unprivileged user to obtain access to privileged information.
(CVE-2008-4210, Important)

* Tobias Klein reported a missing check in the Linux kernel's Open Sound System (OSS) implementation. This deficiency could have led to an information leak. (CVE-2008-3272, Moderate)

* a potential denial of service attack was discovered in the Linux kernel's PWC USB video driver. A local unprivileged user could have used this flaw to bring the kernel USB subsystem into the busy-waiting state. (CVE-2007-5093, Low)

* the ext2 and ext3 file systems code failed to properly handle corrupted data structures, leading to a possible local denial of service issue when read or write operations were performed.
(CVE-2008-3528, Low)

In addition, these updated packages fix the following bugs :

* when using the CIFS 'forcedirectio' option, appending to an open file on a CIFS share resulted in that file being overwritten with the data to be appended.

* a kernel panic occurred when a device with PCI ID 8086:10c8 was present on a system with a loaded ixgbe driver.

* due to an aacraid driver regression, the kernel failed to boot when trying to load the aacraid driver and printed the following error message: 'aac_srb: aac_fib_send failed with status: 8195'.

* due to an mpt driver regression, when RAID 1 was configured on Primergy systems with an LSI SCSI IME 53C1020/1030 controller, the kernel panicked during boot.

* the mpt driver produced a large number of extraneous debugging messages when performing a 'Host reset' operation.

* due to a regression in the sym driver, the kernel panicked when a SCSI hot swap was performed using MCP18 hardware.

* all cores on a multi-core system now scale their frequencies in accordance with the policy set by the system's CPU frequency governor.

* the netdump subsystem suffered from several stability issues. These are addressed in this updated kernel.

* under certain conditions, the ext3 file system reported a negative count of used blocks.

* reading /proc/self/mem incorrectly returned 'Invalid argument' instead of 'input/output error' due to a regression.

* under certain conditions, the kernel panicked when a USB device was removed while the system was busy accessing the device.

* a race condition in the kernel could have led to a kernel crash during the creation of a new process.

All Red Hat Enterprise Linux 4 Users should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0972 advisory.

  - kernel PWC driver DoS (CVE-2007-5093)

  - kernel: dio: zero struct dio with kzalloc instead of manually (CVE-2007-6716)

  - kernel: ptrace: Padding area write - unprivileged kernel crash (CVE-2008-1514)

  - kernel snd_seq_oss_synth_make_info leak (CVE-2008-3272)

  - Linux kernel ext[234] directory corruption denial of service (CVE-2008-3528)

  - kernel: open() call allows setgid bit when user is not in new file's group (CVE-2008-4210)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-5823     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted cramfs filesystem.

  - CVE-2006-6054     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext2 filesystem.

  - CVE-2006-6058     LMH reported an issue in the minix filesystem that     allows local users with mount privileges to create a DoS     (printk flood) by mounting a specially crafted corrupt     filesystem.

  - CVE-2006-7203     OpenVZ Linux kernel team reported an issue in the smbfs     filesystem which can be exploited by local users to     cause a DoS (oops) during mount.

  - CVE-2007-1353     Ilja van Sprundel discovered that kernel memory could be     leaked via the Bluetooth setsockopt call due to an     uninitialized stack buffer. This could be used by local     attackers to read the contents of sensitive kernel     memory.

  - CVE-2007-2172     Thomas Graf reported a typo in the DECnet protocol     handler that could be used by a local attacker to     overrun an array via crafted packets, potentially     resulting in a Denial of Service (system crash). A     similar issue exists in the IPV4 protocol handler and     will be fixed in a subsequent update.

  - CVE-2007-2525     Florian Zumbiehl discovered a memory leak in the PPPOE     subsystem caused by releasing a socket before     PPPIOCGCHAN is called upon it. This could be used by a     local user to DoS a system by consuming all available     memory.

  - CVE-2007-3105     The PaX Team discovered a potential buffer overflow in     the random number generator which may permit local users     to cause a denial of service or gain additional     privileges. This issue is not believed to effect default     Debian installations where only root has sufficient     privileges to exploit it.

  - CVE-2007-3739     Adam Litke reported a potential local denial of service     (oops) on powerpc platforms resulting from unchecked VMA     expansion into address space reserved for hugetlb pages.

  - CVE-2007-3740     Steve French reported that CIFS filesystems with     CAP_UNIX enabled were not honoring a process' umask     which may lead to unintentionally relaxed permissions.

  - CVE-2007-3848     Wojciech Purczynski discovered that pdeath_signal was     not being reset properly under certain conditions which     may allow local users to gain privileges by sending     arbitrary signals to suid binaries.

  - CVE-2007-4133     Hugh Dickins discovered a potential local DoS (panic) in     hugetlbfs. A misconversion of hugetlb_vmtruncate_list to     prio_tree may allow local users to trigger a BUG_ON()     call in exit_mmap.

  - CVE-2007-4308     Alan Cox reported an issue in the aacraid driver that     allows unprivileged local users to make ioctl calls     which should be restricted to admin privileges.

  - CVE-2007-4573     Wojciech Purczynski discovered a vulnerability that can     be exploited by a local user to obtain superuser     privileges on x86_64 systems. This resulted from     improper clearing of the high bits of registers during     ia32 system call emulation. This vulnerability is     relevant to the Debian amd64 port as well as users of     the i386 port who run the amd64 linux-image flavour.

  - CVE-2007-5093     Alex Smith discovered an issue with the pwc driver for     certain webcam devices. If the device is removed while a     userspace application has it open, the driver will wait     for userspace to close the device, resulting in a     blocked USB subsystem. This issue is of low security     impact as it requires the attacker to either have     physical access to the system or to convince a user with     local access to remove the device on their behalf.

  - CVE-2007-6063     Venustech AD-LAB discovered a a buffer overflow in the     isdn ioctl handling, exploitable by a local user.

  - CVE-2007-6151     ADLAB discovered a possible memory overrun in the ISDN     subsystem that may permit a local user to overwrite     kernel memory by issuing ioctls with unterminated data.

  - CVE-2007-6206     Blake Frantz discovered that when a core file owned by a     non-root user exists, and a root-owned process dumps     core over it, the core file retains its original     ownership. This could be used by a local user to gain     access to sensitive information.

  - CVE-2007-6694     Cyrill Gorcunov reported a NULL pointer dereference in     code specific to the CHRP PowerPC platforms. Local users     could exploit this issue to achieve a Denial of Service     (DoS).

  - CVE-2008-0007     Nick Piggin of SuSE discovered a number of issues in     subsystems which register a fault handler for memory     mapped areas. This issue can be exploited by local users     to achieve a Denial of Service (DoS) and possibly     execute arbitrary code.

The following matrix lists additional packages that were rebuilt for compatibility with or to take advantage of this update :

                             Debian 3.1 (sarge)            kernel-image-2.6.8-alpha    2.6.8-17sarge1                kernel-image-2.6.8-amd64    2.6.8-17sarge1                kernel-image-2.6.8-hppa     2.6.8-7sarge1                 kernel-image-2.6.8-i386     2.6.8-17sarge1                kernel-image-2.6.8-ia64     2.6.8-15sarge1                kernel-image-2.6.8-m68k     2.6.8-5sarge1                 kernel-image-2.6.8-s390     2.6.8-6sarge1                 kernel-image-2.6.8-sparc    2.6.8-16sarge1                kernel-patch-powerpc-2.6.8  2.6.8-13sarge1                fai-kernels                 1.9.1sarge8

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-2731     infamous41md reported multiple integer overflows in the     Sbus PROM driver that would allow for a DoS (Denial of     Service) attack by a local user, and possibly the     execution of arbitrary code.

  - CVE-2006-4814     Doug Chapman discovered a potential local DoS (deadlock)     in the mincore function caused by improper lock     handling.

  - CVE-2006-5753     Eric Sandeen provided a fix for a local memory     corruption vulnerability resulting from a     misinterpretation of return values when operating on     inodes which have been marked bad.

  - CVE-2006-5823     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted cramfs filesystem.

  - CVE-2006-6053     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext3 filesystem.

  - CVE-2006-6054     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext2 filesystem.

  - CVE-2006-6106     Marcel Holtman discovered multiple buffer overflows in     the Bluetooth subsystem which can be used to trigger a     remote DoS (crash) and potentially execute arbitrary     code.

  - CVE-2007-1353     Ilja van Sprundel discovered that kernel memory could be     leaked via the Bluetooth setsockopt call due to an     uninitialized stack buffer. This could be used by local     attackers to read the contents of sensitive kernel     memory.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

  - CVE-2007-2172     Thomas Graf reported a typo in the DECnet protocol     handler that could be used by a local attacker to     overrun an array via crafted packets, potentially     resulting in a Denial of Service (system crash). A     similar issue exists in the IPV4 protocol handler and     will be fixed in a subsequent update.

  - CVE-2007-2525     Florian Zumbiehl discovered a memory leak in the PPPOE     subsystem caused by releasing a socket before     PPPIOCGCHAN is called upon it. This could be used by a     local user to DoS a system by consuming all available     memory.

  - CVE-2007-3848     Wojciech Purczynski discovered that pdeath_signal was     not being reset properly under certain conditions which     may allow local users to gain privileges by sending     arbitrary signals to suid binaries.

  - CVE-2007-4308     Alan Cox reported an issue in the aacraid driver that     allows unprivileged local users to make ioctl calls     which should be restricted to admin privileges.

  - CVE-2007-4311     PaX team discovered an issue in the random driver where     a defect in the reseeding code leads to a reduction in     entropy.

  - CVE-2007-5093     Alex Smith discovered an issue with the pwc driver for     certain webcam devices. If the device is removed while a     userspace application has it open, the driver will wait     for userspace to close the device, resulting in a     blocked USB subsystem. This issue is of low security     impact as it requires the attacker to either have     physical access to the system or to convince a user with     local access to remove the device on their behalf.

  - CVE-2007-6063     Venustech AD-LAB discovered a a buffer overflow in the     isdn ioctl handling, exploitable by a local user.

  - CVE-2007-6151     ADLAB discovered a possible memory overrun in the ISDN     subsystem that may permit a local user to overwrite     kernel memory by issuing ioctls with unterminated data.

  - CVE-2007-6206     Blake Frantz discovered that when a core file owned by a     non-root user exists, and a root-owned process dumps     core over it, the core file retains its original     ownership. This could be used by a local user to gain     access to sensitive information.

  - CVE-2007-6694     Cyrill Gorcunov reported a NULL pointer dereference in     code specific to the CHRP PowerPC platforms. Local users     could exploit this issue to achieve a Denial of Service     (DoS).

  - CVE-2008-0007     Nick Piggin of SuSE discovered a number of issues in     subsystems which register a fault handler for memory     mapped areas. This issue can be exploited by local users     to achieve a Denial of Service (DoS) and possibly     execute arbitrary code.

The following matrix lists additional packages that were rebuilt for compatibility with or to take advantage of this update :

                              Debian 3.1 (sarge)             alsa-modules-i386            1.0.8+2sarge2                  kernel-image-2.4.27-arm      2.4.27-2sarge6                 kernel-image-2.4.27-m68k     2.4.27-3sarge6                 kernel-image-speakup-i386    2.4.27-1.1sarge5               kernel-image-2.4.27-alpha    2.4.27-10sarge6                kernel-image-2.4.27-s390     2.4.27-2sarge6                 kernel-image-2.4.27-sparc    2.4.27-9sarge6                 kernel-image-2.4.27-i386     2.4.27-10sarge6                kernel-image-2.4.27-ia64     2.4.27-10sarge6                kernel-patch-2.4.27-mips     2.4.27-10.sarge4.040815-3      kernel-patch-powerpc-2.4.27  2.4.27-10sarge6                kernel-latest-2.4-alpha      101sarge3                      kernel-latest-2.4-i386       101sarge2                      kernel-latest-2.4-s390       2.4.27-1sarge2                 kernel-latest-2.4-sparc      42sarge3                       i2c                          1:2.9.1-1sarge2                lm-sensors                   1:2.9.1-1sarge4                mindi-kernel                 2.4.27-2sarge5                 pcmcia-modules-2.4.27-i386   3.2.5+2sarge2                  hostap-modules-i386          1:0.3.7-1sarge3                systemimager                 3.2.3-6sarge5

The minix filesystem did not properly validate certain filesystem values. If a local attacker could trick the system into attempting to mount a corrupted minix filesystem, the kernel could be made to hang for long periods of time, resulting in a denial of service.
(CVE-2006-6058)

Alexander Schulze discovered that the skge driver does not properly use the spin_lock and spin_unlock functions. Remote attackers could exploit this by sending a flood of network traffic and cause a denial of service (crash). (CVE-2006-7229)

Hugh Dickins discovered that hugetlbfs performed certain prio_tree calculations using HPAGE_SIZE instead of PAGE_SIZE. A local user could exploit this and cause a denial of service via kernel panic.
(CVE-2007-4133)

Chris Evans discovered an issue with certain drivers that use the ieee80211_rx function. Remote attackers could send a crafted 802.11 frame and cause a denial of service via crash. (CVE-2007-4997)

Alex Smith discovered an issue with the pwc driver for certain webcam devices. A local user with physical access to the system could remove the device while a userspace application had it open and cause the USB subsystem to block. (CVE-2007-5093)

Scott James Remnant discovered a coding error in ptrace. Local users could exploit this and cause the kernel to enter an infinite loop.
(CVE-2007-5500)

Venustech AD-LAB discovered a buffer overflow in the isdn net subsystem. This issue is exploitable by local users via crafted input to the isdn_ioctl function. (CVE-2007-6063)

It was discovered that the isdn subsystem did not properly check for NULL termination when performing ioctl handling. A local user could exploit this to cause a denial of service. (CVE-2007-6151)

Blake Frantz discovered that when a root process overwrote an existing core file, the resulting core file retained the previous core file's ownership. Local users could exploit this to gain access to sensitive information. (CVE-2007-6206)

Hugh Dickins discovered the when using the tmpfs filesystem, under rare circumstances, a kernel page may be improperly cleared. A local user may be able to exploit this and read sensitive kernel data or cause a denial of service via crash. (CVE-2007-6417)

Bill Roman discovered that the VFS subsystem did not properly check access modes. A local user may be able to gain removal privileges on directories. (CVE-2008-0001).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The minix filesystem did not properly validate certain filesystem values. If a local attacker could trick the system into attempting to mount a corrupted minix filesystem, the kernel could be made to hang for long periods of time, resulting in a denial of service. This was only vulnerable in Ubuntu 7.04 and 7.10. (CVE-2006-6058)

The signal handling on PowerPC systems using HTX allowed local users to cause a denial of service via floating point corruption. This was only vulnerable in Ubuntu 6.10 and 7.04. (CVE-2007-3107)

The Linux kernel did not properly validate the hop-by-hop IPv6 extended header. Remote attackers could send a crafted IPv6 packet and cause a denial of service via kernel panic. This was only vulnerable in Ubuntu 7.04. (CVE-2007-4567)

The JFFS2 filesystem with ACL support enabled did not properly store permissions during inode creation and ACL setting. Local users could possibly access restricted files after a remount. This was only vulnerable in Ubuntu 7.04 and 7.10. (CVE-2007-4849)

Chris Evans discovered an issue with certain drivers that use the ieee80211_rx function. Remote attackers could send a crafted 802.11 frame and cause a denial of service via crash. This was only vulnerable in Ubuntu 7.04 and 7.10. (CVE-2007-4997)

Alex Smith discovered an issue with the pwc driver for certain webcam devices. A local user with physical access to the system could remove the device while a userspace application had it open and cause the USB subsystem to block. This was only vulnerable in Ubuntu 7.04.
(CVE-2007-5093)

Scott James Remnant discovered a coding error in ptrace. Local users could exploit this and cause the kernel to enter an infinite loop.
This was only vulnerable in Ubuntu 7.04 and 7.10. (CVE-2007-5500)

It was discovered that the Linux kernel could dereference a NULL pointer when processing certain IPv4 TCP packets. A remote attacker could send a crafted TCP ACK response and cause a denial of service via crash. This was only vulnerable in Ubuntu 7.10. (CVE-2007-5501)

Warren Togami discovered that the hrtimer subsystem did not properly check for large relative timeouts. A local user could exploit this and cause a denial of service via soft lockup. (CVE-2007-5966)

Venustech AD-LAB discovered a buffer overflow in the isdn net subsystem. This issue is exploitable by local users via crafted input to the isdn_ioctl function. (CVE-2007-6063)

It was discovered that the isdn subsystem did not properly check for NULL termination when performing ioctl handling. A local user could exploit this to cause a denial of service. (CVE-2007-6151)

Blake Frantz discovered that when a root process overwrote an existing core file, the resulting core file retained the previous core file's ownership. Local users could exploit this to gain access to sensitive information. (CVE-2007-6206)

Hugh Dickins discovered the when using the tmpfs filesystem, under rare circumstances, a kernel page may be improperly cleared. A local user may be able to exploit this and read sensitive kernel data or cause a denial of service via crash. (CVE-2007-6417)

Bill Roman discovered that the VFS subsystem did not properly check access modes. A local user may be able to gain removal privileges on directories. (CVE-2008-0001).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The minix filesystem did not properly validate certain filesystem values. If a local attacker could trick the system into attempting to mount a corrupted minix filesystem, the kernel could be made to hang for long periods of time, resulting in a denial of service.
(CVE-2006-6058)

Certain calculations in the hugetlb code were not correct. A local attacker could exploit this to cause a kernel panic, leading to a denial of service. (CVE-2007-4133)

Eric Sesterhenn and Victor Julien discovered that the hop-by-hop IPv6 extended header was not correctly validated. If a system was configured for IPv6, a remote attacker could send a specially crafted IPv6 packet and cause the kernel to panic, leading to a denial of service. This was only vulnerable in Ubuntu 7.04. (CVE-2007-4567)

Permissions were not correctly stored on JFFS2 ACLs. For systems using ACLs on JFFS2, a local attacker may gain access to private files.
(CVE-2007-4849)

Chris Evans discovered that the 802.11 network stack did not correctly handle certain QOS frames. A remote attacker on the local wireless network could send specially crafted packets that would panic the kernel, resulting in a denial of service. (CVE-2007-4997)

The Philips USB Webcam driver did not correctly handle disconnects. If a local attacker tricked another user into disconnecting a webcam unsafely, the kernel could hang or consume CPU resources, leading to a denial of service. (CVE-2007-5093)

Scott James Remnant discovered that the waitid function could be made to hang the system. A local attacker could execute a specially crafted program which would leave the system unresponsive, resulting in a denial of service. (CVE-2007-5500)

Ilpo Jarvinen discovered that it might be possible for the TCP stack to panic the kernel when receiving a crafted ACK response. Only Ubuntu 7.10 contained the vulnerable code, and it is believed not to have been exploitable. (CVE-2007-5501)

When mounting the same remote NFS share to separate local locations, the first location's mount options would apply to all subsequent mounts of the same NFS share. In some configurations, this could lead to incorrectly configured permissions, allowing local users to gain additional access to the mounted share.
(https://launchpad.net/bugs/164231)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-5755     The NT bit maybe leaked into the next task which can     make it possible for local attackers to cause a Denial     of Service (crash) on systems which run the amd64     flavour kernel. The stable distribution ('etch') was not     believed to be vulnerable to this issue at the time of     release, however Bastian Blank discovered that this     issue still applied to the xen-amd64 and     xen-vserver-amd64 flavours, and is resolved by this DSA.

  - CVE-2007-4133     Hugh Dickins discovered a potential local DoS (panic) in     hugetlbfs. A misconversion of hugetlb_vmtruncate_list to     prio_tree may allow local users to trigger a BUG_ON()     call in exit_mmap.

  - CVE-2007-4573     Wojciech Purczynski discovered a vulnerability that can     be exploited by a local user to obtain superuser     privileges on x86_64 systems. This resulted from     improper clearing of the high bits of registers during     ia32 system call emulation. This vulnerability is     relevant to the Debian amd64 port as well as users of     the i386 port who run the amd64 linux-image flavour.

      DSA-1378 resolved this problem for the amd64 flavour kernels,       but Tim Wickberg and Ralf Hemmenstadt reported an outstanding       issue with the xen-amd64 and xen-vserver-amd64 flavours that is       resolved by this DSA.

  - CVE-2007-5093     Alex Smith discovered an issue with the pwc driver for     certain webcam devices. If the device is removed while a     userspace application has it open, the driver will wait     for userspace to close the device, resulting in a     blocked USB subsystem. This issue is of low security     impact as it requires the attacker to either have     physical access to the system or to convince users with     local access to remove the device on their behalf.

These problems have been fixed in the stable distribution in version 2.6.18.dfsg.1-13etch4.

This is an update to DSA-1381-1 which included only amd64 binaries for linux-2.6. Builds for all other architectures are now available, as well as rebuilds of ancillary packages that make use of the included linux source.

The following matrix lists additional packages that were rebuilt for compatibility with or to take advantage of this update :

                           Debian 4.0 (etch)           fai-kernels               1.17+etch.13etch4           kernel-patch-openvz       028.18.1etch5               user-mode-linux           2.6.18-1um-2etch.13etch4

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0972.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0275.

ID	Name	Product	Family	Severity
79447	OracleVM 2.1 : kernel (OVMSA-2008-2005)	Nessus	OracleVM Local Security Checks	high
67762	Oracle Linux 4 : kernel (ELSA-2008-0972)	Nessus	Oracle Linux Local Security Checks	medium
67691	Oracle Linux 5 : kernel (ELSA-2008-0275)	Nessus	Oracle Linux Local Security Checks	high
60497	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43685	CentOS 5 : kernel (CESA-2008:0275)	Nessus	CentOS Local Security Checks	high
37772	Mandriva Linux Security Advisory : kernel (MDVSA-2008:105)	Nessus	Mandriva Local Security Checks	high
37341	CentOS 4 : kernel (CESA-2008:0972)	Nessus	CentOS Local Security Checks	medium
34841	RHEL 4 : kernel (RHSA-2008:0972)	Nessus	Red Hat Local Security Checks	medium
32391	RHEL 5 : kernel (RHSA-2008:0275)	Nessus	Red Hat Local Security Checks	high
31148	Debian DSA-1504-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	high
31147	Debian DSA-1503-1 : kernel-source-2.4.27 - several vulnerabilities	Nessus	Debian Local Security Checks	high
31093	Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerabilities (USN-578-1)	Nessus	Ubuntu Local Security Checks	high
30183	Ubuntu 6.10 / 7.04 / 7.10 : linux-source-2.6.17/20/22 vulnerabilities (USN-574-1)	Nessus	Ubuntu Local Security Checks	high
29740	Ubuntu 6.10 / 7.04 / 7.10 : linux-source-2.6.17/20/22 vulnerabilities (USN-558-1)	Nessus	Ubuntu Local Security Checks	high
26211	Debian DSA-1381-2 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	high
801459	CentOS RHSA-2008-0972 Security Check	Log Correlation Engine	Generic	high
801452	CentOS RHSA-2008-0275 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2007-5093

medium

Tenable Plugins

high

medium

high

medium

high

high

medium

medium

high

high

high

high

high

high

high

high

high