Linux kernel 2.6.17, and other versions before 2.6.22, does not check when a user attempts to set RLIMIT_CPU to 0 until after the change is made, which allows local users to bypass intended resource limits.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix utrace dead_engine ops race

  - fix ptrace_attach leak

  - CVE-2007-5093: kernel PWC driver DoS

  - CVE-2007-6282: IPSec ESP kernel panics

  - CVE-2007-6712: kernel: infinite loop in highres timers     (kernel hang)

  - CVE-2008-1615: kernel: ptrace: Unprivileged crash on     x86_64 %cs corruption

  - CVE-2008-1294: kernel: setrlimit(RLIMIT_CPUINFO) with     zero value doesn't inherit properly across children

  - CVE-2008-2136: kernel: sit memory leak

  - CVE-2008-2812: kernel: NULL ptr dereference in multiple     network drivers due to missing checks in tty code

  - restore     linux-2.6-x86-clear-df-flag-for-signal-handlers.patch

  - restore linux-2.6-utrace.patch /     linux-2.6-xen-utrace.patch

  - Kernel security erratas for OVM 2.1.2 from bz#5932 :

  - CVE-2007-6063: isdn: fix possible isdn_net buffer     overflows

  - CVE-2007-3104 Null pointer to an inode in a dentry can     cause an oops in sysfs_readdir

  - CVE-2008-0598: write system call vulnerability

  - CVE-2008-1375: kernel: race condition in dnotify

  - CVE-2008-0001: kernel: filesystem corruption by     unprivileged user via directory truncation

  - CVE-2008-2358: dccp: sanity check feature length

  - CVE-2007-5938: NULL dereference in iwl driver

  - RHSA-2008:0508: kernel: [x86_64] The string instruction     version didn't zero the output on exception.

  - kernel: clear df flag for signal handlers

  - fs: missing dput in do_lookup error leaks dentries

  - sysfs: fix condition check in sysfs_drop_dentry

  - sysfs: fix race condition around sd->s_dentry

  - ieee80211: off-by-two integer underflow

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0612 advisory.

    - [tty] add NULL pointer checks (Aristeu Rozanski ) [453425 453154] {CVE-2008-2812}
    - [net] sctp: make sure sctp_addr does not overflow (David S. Miller ) [452482 452483] {CVE-2008-2826}
    - [sys] sys_setrlimit: prevent setting RLIMIT_CPU to 0 (Neil Horman ) [437121 437122] {CVE-2008-1294}
    - [net] sit: exploitable remote memory leak (Jiri Pirko ) [446038 446039] {CVE-2008-2136}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

These updated packages fix the following security issues :

  - a possible kernel memory leak was found in the Linux     kernel Simple Internet Transition (SIT) INET6     implementation. This could allow a local unprivileged     user to cause a denial of service. (CVE-2008-2136,     Important)

  - a flaw was found in the Linux kernel setrlimit system     call, when setting RLIMIT_CPU to a certain value. This     could allow a local unprivileged user to bypass the CPU     time limit. (CVE-2008-1294, Moderate)

  - multiple NULL pointer dereferences were found in various     Linux kernel network drivers. These drivers were missing     checks for terminal validity, which could allow     privilege escalation. (CVE-2008-2812, Moderate)

These updated packages fix the following bugs :

  - the GNU libc stub resolver is a minimal resolver that     works with Domain Name System (DNS) servers to satisfy     requests from applications for names. The GNU libc stub     resolver did not specify a source UDP port, and     therefore used predictable port numbers. This could have     made DNS spoofing attacks easier.

The Linux kernel has been updated to implement random UDP source ports where none are specified by an application. This allows applications, such as those using the GNU libc stub resolver, to use random UDP source ports, helping to make DNS spoofing attacks harder.

  - when using certain hardware, a bug in UART_BUG_TXEN may     have caused incorrect hardware detection, causing data     flow to '/dev/ttyS1' to hang.

  - a 50-75% drop in NFS server rewrite performance,     compared to Red Hat Enterprise Linux 4.6, has been     resolved.

  - due a bug in the fast userspace mutex code, while one     thread fetched a pointer, another thread may have     removed it, causing the first thread to fetch the wrong     pointer, possibly causing a system crash.

  - on certain Hitachi hardware, removing the 'uhci_hcd'     module caused a kernel oops, and the following error :

BUG: warning at arch/ia64/kernel/iosapic.c:1001/iosapic_unregister_intr()

Even after the 'uhci_hcd' module was reloaded, there was no access to USB devices. As well, on systems that have legacy interrupts, 'acpi_unregister_gsi' incorrectly called 'iosapci_unregister_intr()', causing warning messages to be logged.

  - when a page was mapped with mmap(), and 'PROT_WRITE' was     the only 'prot' argument, the first read of that page     caused a segmentation fault. If the page was read after     it was written to, no fault occurred. This was     incompatible with the Red Hat Enterprise Linux 4     behavior.

  - due to a NULL pointer dereference in powernowk8_init(),     a panic may have occurred.

  - certain error conditions handled by the bonding sysfs     interface could have left rtnl_lock() unbalanced, either     by locking and returning without unlocking, or by     unlocking when it did not lock, possibly causing a     'kernel: RTNL: assertion failed at net/core/fib_rules.c'     error.

  - the kernel currently expects a maximum of six Machine     Check Exception (MCE) banks to be exposed by a CPU.
    Certain CPUs have 7 or more, which may have caused the     MCE to be incorrectly reported.

  - a race condition in UNIX domain sockets may have caused     recv() to return zero. For clusters, this may have     caused unexpected failovers.

  - msgrcv() frequently returned an incorrect     'ERESTARTNOHAND (514)' error number.

  - on certain Intel Itanium-based systems, when kdump was     configured to halt the system after a dump operation,     after the 'System halted.' output, the kernel continued     to output endless 'soft lockup' messages.

This Linux kernel update for SUSE Linux Enterprise 10 Service Pack 2 fixes various bugs and several security issues.

The following security issues were fixed: CVE-2009-0675: The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an 'inverted logic' issue.

  - The sock_getsockopt function in net/core/sock.c in the     Linux kernel does not initialize a certain structure     member, which allows local users to obtain potentially     sensitive information from kernel memory via an     SO_BSDCOMPAT getsockopt request. (CVE-2009-0676)

  - The clone system call in the Linux kernel allows local     users to send arbitrary signals to a parent process from     an unprivileged child process by launching an additional     child process with the CLONE_PARENT flag, and then     letting this new process exit. (CVE-2009-0028)

  - The Linux kernel does not check when a user attempts to     set RLIMIT_CPU to 0 until after the change is made,     which allows local users to bypass intended resource     limits. (CVE-2008-1294)

  - Buffer overflow in net/sctp/sm_statefuns.c in the Stream     Control Transmission Protocol (sctp) implementation in     the Linux kernel allows remote attackers to have an     unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk     with a large stream ID. (CVE-2009-0065)

  - The console selection feature in the Linux kernel when     the UTF-8 console is used, allows physically proximate     attackers to cause a denial of service (memory     corruption) by selecting a small number of 3-byte UTF-8     characters, which triggers an an off-by-two memory     error. It is is not clear if this can be exploited at     all. (CVE-2009-1046)

Also a huge number of regular bugs were fixed, please see the RPM changelog for full details.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* a possible kernel memory leak was found in the Linux kernel Simple Internet Transition (SIT) INET6 implementation. This could allow a local unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

* a flaw was found in the Linux kernel setrlimit system call, when setting RLIMIT_CPU to a certain value. This could allow a local unprivileged user to bypass the CPU time limit. (CVE-2008-1294, Moderate)

* multiple NULL pointer dereferences were found in various Linux kernel network drivers. These drivers were missing checks for terminal validity, which could allow privilege escalation. (CVE-2008-2812, Moderate)

These updated packages fix the following bugs :

* the GNU libc stub resolver is a minimal resolver that works with Domain Name System (DNS) servers to satisfy requests from applications for names. The GNU libc stub resolver did not specify a source UDP port, and therefore used predictable port numbers. This could have made DNS spoofing attacks easier.

The Linux kernel has been updated to implement random UDP source ports where none are specified by an application. This allows applications, such as those using the GNU libc stub resolver, to use random UDP source ports, helping to make DNS spoofing attacks harder.

* when using certain hardware, a bug in UART_BUG_TXEN may have caused incorrect hardware detection, causing data flow to '/dev/ttyS1' to hang.

* a 50-75% drop in NFS server rewrite performance, compared to Red Hat Enterprise Linux 4.6, has been resolved.

* due a bug in the fast userspace mutex code, while one thread fetched a pointer, another thread may have removed it, causing the first thread to fetch the wrong pointer, possibly causing a system crash.

* on certain Hitachi hardware, removing the 'uhci_hcd' module caused a kernel oops, and the following error :

BUG: warning at arch/ia64/kernel/iosapic.c:1001/iosapic_unregister_intr()

Even after the 'uhci_hcd' module was reloaded, there was no access to USB devices. As well, on systems that have legacy interrupts, 'acpi_unregister_gsi' incorrectly called 'iosapci_unregister_intr()', causing warning messages to be logged.

* when a page was mapped with mmap(), and 'PROT_WRITE' was the only 'prot' argument, the first read of that page caused a segmentation fault. If the page was read after it was written to, no fault occurred. This was incompatible with the Red Hat Enterprise Linux 4 behavior.

* due to a NULL pointer dereference in powernowk8_init(), a panic may have occurred.

* certain error conditions handled by the bonding sysfs interface could have left rtnl_lock() unbalanced, either by locking and returning without unlocking, or by unlocking when it did not lock, possibly causing a 'kernel: RTNL: assertion failed at net/core/fib_rules.c' error.

* the kernel currently expects a maximum of six Machine Check Exception (MCE) banks to be exposed by a CPU. Certain CPUs have 7 or more, which may have caused the MCE to be incorrectly reported.

* a race condition in UNIX domain sockets may have caused recv() to return zero. For clusters, this may have caused unexpected failovers.

* msgrcv() frequently returned an incorrect 'ERESTARTNOHAND (514)' error number.

* on certain Intel Itanium-based systems, when kdump was configured to halt the system after a dump operation, after the 'System halted.' output, the kernel continued to output endless 'soft lockup' messages.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

It was discovered that the ALSA /proc interface did not write the correct number of bytes when reporting memory allocations. A local attacker might be able to access sensitive kernel memory, leading to a loss of privacy. (CVE-2007-4571)

Multiple buffer overflows were discovered in the handling of CIFS filesystems. A malicious CIFS server could cause a client system crash or possibly execute arbitrary code with kernel privileges.
(CVE-2007-5904)

It was discovered that PowerPC kernels did not correctly handle reporting certain system details. By requesting a specific set of information, a local attacker could cause a system crash resulting in a denial of service. (CVE-2007-6694)

It was discovered that some device driver fault handlers did not correctly verify memory ranges. A local attacker could exploit this to access sensitive kernel memory, possibly leading to a loss of privacy.
(CVE-2008-0007)

It was discovered that CPU resource limits could be bypassed. A malicious local user could exploit this to avoid administratively imposed resource limits. (CVE-2008-1294)

A race condition was discovered between dnotify fcntl() and close() in the kernel. If a local attacker performed malicious dnotify requests, they could cause memory consumption leading to a denial of service, or possibly send arbitrary signals to any process. (CVE-2008-1375)

On SMP systems, a race condition existed in fcntl(). Local attackers could perform malicious locks, causing system crashes and leading to a denial of service. (CVE-2008-1669).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6694     Cyrill Gorcunov reported a NULL pointer dereference in     code specific to the CHRP PowerPC platforms. Local users     could exploit this issue to achieve a Denial of Service     (DoS).

  - CVE-2008-0007     Nick Piggin of SuSE discovered a number of issues in     subsystems which register a fault handler for memory     mapped areas. This issue can be exploited by local users     to achieve a Denial of Service (DoS) and possibly     execute arbitrary code.

  - CVE-2008-1294     David Peer discovered that users could escape     administrator imposed cpu time limitations (RLIMIT_CPU)     by setting a limit of 0.

  - CVE-2008-1375     Alexander Viro discovered a race condition in the     directory notification subsystem that allows local users     to cause a Denial of Service (oops) and possibly result     in an escalation of privileges.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0612.

ID	Name	Product	Family	Severity
79447	OracleVM 2.1 : kernel (OVMSA-2008-2005)	Nessus	OracleVM Local Security Checks	high
67730	Oracle Linux 5 : kernel (ELSA-2008-0612)	Nessus	Oracle Linux Local Security Checks	high
60459	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
59136	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 6113)	Nessus	SuSE Local Security Checks	critical
43701	CentOS 5 : kernel (CESA-2008:0612)	Nessus	CentOS Local Security Checks	high
41538	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 6109)	Nessus	SuSE Local Security Checks	critical
33830	RHEL 5 : kernel (RHSA-2008:0612)	Nessus	Red Hat Local Security Checks	high
33255	Ubuntu 6.06 LTS / 7.04 / 7.10 : linux-source-2.6.15/20/22 vulnerabilities (USN-618-1)	Nessus	Ubuntu Local Security Checks	high
32127	Debian DSA-1565-1 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	high
801456	CentOS RHSA-2008-0612 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2008-1294

medium

Tenable Plugins

high

high

high

critical

high

critical

high

high

high

high