Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix utrace dead_engine ops race

  - fix ptrace_attach leak

  - CVE-2007-5093: kernel PWC driver DoS

  - CVE-2007-6282: IPSec ESP kernel panics

  - CVE-2007-6712: kernel: infinite loop in highres timers     (kernel hang)

  - CVE-2008-1615: kernel: ptrace: Unprivileged crash on     x86_64 %cs corruption

  - CVE-2008-1294: kernel: setrlimit(RLIMIT_CPUINFO) with     zero value doesn't inherit properly across children

  - CVE-2008-2136: kernel: sit memory leak

  - CVE-2008-2812: kernel: NULL ptr dereference in multiple     network drivers due to missing checks in tty code

  - restore     linux-2.6-x86-clear-df-flag-for-signal-handlers.patch

  - restore linux-2.6-utrace.patch /     linux-2.6-xen-utrace.patch

  - Kernel security erratas for OVM 2.1.2 from bz#5932 :

  - CVE-2007-6063: isdn: fix possible isdn_net buffer     overflows

  - CVE-2007-3104 Null pointer to an inode in a dentry can     cause an oops in sysfs_readdir

  - CVE-2008-0598: write system call vulnerability

  - CVE-2008-1375: kernel: race condition in dnotify

  - CVE-2008-0001: kernel: filesystem corruption by     unprivileged user via directory truncation

  - CVE-2008-2358: dccp: sanity check feature length

  - CVE-2007-5938: NULL dereference in iwl driver

  - RHSA-2008:0508: kernel: [x86_64] The string instruction     version didn't zero the output on exception.

  - kernel: clear df flag for signal handlers

  - fs: missing dput in do_lookup error leaks dentries

  - sysfs: fix condition check in sysfs_drop_dentry

  - sysfs: fix race condition around sd->s_dentry

  - ieee80211: off-by-two integer underflow

From Red Hat Security Advisory 2008:0237 :

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a flaw in the MOXA serial driver could allow a local unprivileged user to perform privileged operations, such as replacing firmware.
(CVE-2005-0504, Important)

As well, these updated packages fix the following bugs :

* multiple buffer overflows in the neofb driver have been resolved. It was not possible for an unprivileged user to exploit these issues, and as such, they have not been handled as security issues.

* a kernel panic, due to inconsistent detection of AGP aperture size, has been resolved.

* a race condition in UNIX domain sockets may have caused 'recv()' to return zero. In clustered configurations, this may have caused unexpected failovers.

* to prevent link storms, network link carrier events were delayed by up to one second, causing unnecessary packet loss. Now, link carrier events are scheduled immediately.

* a client-side race on blocking locks caused large time delays on NFS file systems.

* in certain situations, the libATA sata_nv driver may have sent commands with duplicate tags, which were rejected by SATA devices.
This may have caused infinite reboots.

* running the 'service network restart' command may have caused networking to fail.

* a bug in NFS caused cached information about directories to be stored for too long, causing wrong attributes to be read.

* on systems with a large highmem/lowmem ratio, NFS write performance may have been very slow when using small files.

* a bug, which caused network hangs when the system clock was wrapped around zero, has been resolved.

Red Hat Enterprise Linux 4 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0233 advisory.

    - Update: [fs] fix race condition in dnotify (Alexander Viro ) [439758] {CVE-2008-1375}
    - Update: [xen] ia64: ftp stress test fixes between HVM/Dom0 (Tetsu Yamamoto ) [427400] {CVE-2008-1619}
    - Update: [fs] fix race condition in dnotify (Alexander Viro ) [439758] {CVE-2008-1375}
    - [fs] fix race condition in dnotify (Alexander Viro ) [439758] {CVE-2008-1375}
    - [x86] clear df flag for signal handlers (Jason Baron ) [437316] {CVE-2008-1367}
    - [xen] ia64: ftp stress test fixes between HVM/Dom0 (Tetsu Yamamoto ) [427400] {CVE-2008-1619}
    - [xen] ia64: fix ssm_i emulation barrier and vdso pv (Tetsu Yamamoto ) [427400] {CVE-2008-1619}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2008:0211 :

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* a flaw was found when performing asynchronous input or output operations on a FIFO special file. A local unprivileged user could use this flaw to cause a kernel panic. (CVE-2007-5001, Important)

* a flaw was found in the way core dump files were created. If a local user could get a root-owned process to dump a core file into a directory, which the user has write access to, they could gain read access to that core file. This could potentially grant unauthorized access to sensitive information. (CVE-2007-6206, Moderate)

* a buffer overflow was found in the Linux kernel ISDN subsystem. A local unprivileged user could use this flaw to cause a denial of service. (CVE-2007-6151, Moderate)

* a race condition found in the mincore system core could allow a local user to cause a denial of service (system hang). (CVE-2006-4814, Moderate)

* it was discovered that the Linux kernel handled string operations in the opposite way to the GNU Compiler Collection (GCC). This could allow a local unprivileged user to cause memory corruption.
(CVE-2008-1367, Low)

As well, these updated packages fix the following bugs :

* a bug, which caused long delays when unmounting mounts containing a large number of unused dentries, has been resolved.

* in the previous kernel packages, the kernel was unable to handle certain floating point instructions on Itanium(R) architectures.

* on certain Intel CPUs, the Translation Lookaside Buffer (TLB) was not flushed correctly, which caused machine check errors.

Red Hat Enterprise Linux 3 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

These updated packages fix the following security issues :

  - the absence of a protection mechanism when attempting to     access a critical section of code has been found in the     Linux kernel open file descriptors control mechanism,     fcntl. This could allow a local unprivileged user to     simultaneously execute code, which would otherwise be     protected against parallel execution. As well, a race     condition when handling locks in the Linux kernel fcntl     functionality, may have allowed a process belonging to a     local unprivileged user to gain re-ordered access to the     descriptor table. (CVE-2008-1669, Important)

  - a possible hypervisor panic was found in the Linux     kernel. A privileged user of a fully virtualized guest     could initiate a stress-test File Transfer Protocol     (FTP) transfer between the guest and the hypervisor,     possibly leading to hypervisor panic. (CVE-2008-1619,     Important)

  - the absence of a protection mechanism when attempting to     access a critical section of code, as well as a race     condition, have been found in the Linux kernel file     system event notifier, dnotify. This could allow a local     unprivileged user to get inconsistent data, or to send     arbitrary signals to arbitrary system processes.
    (CVE-2008-1375, Important)

  - when accessing kernel memory locations, certain Linux     kernel drivers registering a fault handler did not     perform required range checks. A local unprivileged user     could use this flaw to gain read or write access to     arbitrary kernel memory, or possibly cause a kernel     crash. (CVE-2008-0007, Important)

  - the absence of sanity-checks was found in the hypervisor     block backend driver, when running 32-bit     paravirtualized guests on a 64-bit host. The number of     blocks to be processed per one request from guest to     host, or vice-versa, was not checked for its maximum     value, which could have allowed a local privileged user     of the guest operating system to cause a denial of     service. (CVE-2007-5498, Important)

  - it was discovered that the Linux kernel handled string     operations in the opposite way to the GNU Compiler     Collection (GCC). This could allow a local unprivileged     user to cause memory corruption. (CVE-2008-1367, Low)

As well, these updated packages fix the following bugs :

  - on IBM System z architectures, when running QIOASSIST     enabled QDIO devices in an IBM z/VM environment, the     output queue stalled under heavy load. This caused     network performance to degrade, possibly causing network     hangs and outages.

  - multiple buffer overflows were discovered in the neofb     video driver. It was not possible for an unprivileged     user to exploit these issues, and as such, they have not     been handled as security issues.

  - when running Microsoft Windows in a HVM, a bug in     vmalloc/vfree caused network performance to degrade.

  - on certain architectures, a bug in the libATA sata_nv     driver may have caused infinite reboots, and an 'ata1:
    CPB flags CMD err flags 0x11' error.

  - repeatedly hot-plugging a PCI Express card may have     caused 'Bad DLLP' errors.

  - a NULL pointer dereference in NFS, which may have caused     applications to crash, has been resolved.

  - when attempting to kexec reboot, either manually or via     a panic-triggered kdump, the Unisys ES7000/one hanged     after rebooting in the new kernel, after printing the     'Memory: 32839688k/33685504k available' line.

These updated packages fix the following security issues :

  - the absence of a protection mechanism when attempting to     access a critical section of code has been found in the     Linux kernel open file descriptors control mechanism,     fcntl. This could allow a local unprivileged user to     simultaneously execute code, which would otherwise be     protected against parallel execution. As well, a race     condition when handling locks in the Linux kernel fcntl     functionality, may have allowed a process belonging to a     local unprivileged user to gain re-ordered access to the     descriptor table. (CVE-2008-1669, Important)

  - on AMD64 architectures, the possibility of a kernel     crash was discovered by testing the Linux kernel     process-trace ability. This could allow a local     unprivileged user to cause a denial of service (kernel     crash). (CVE-2008-1615, Important)

  - the absence of a protection mechanism when attempting to     access a critical section of code, as well as a race     condition, have been found in the Linux kernel file     system event notifier, dnotify. This could allow a local     unprivileged user to get inconsistent data, or to send     arbitrary signals to arbitrary system processes.
    (CVE-2008-1375, Important)

  - when accessing kernel memory locations, certain Linux     kernel drivers registering a fault handler did not     perform required range checks. A local unprivileged user     could use this flaw to gain read or write access to     arbitrary kernel memory, or possibly cause a kernel     crash. (CVE-2008-0007, Important)

  - the possibility of a kernel crash was found in the Linux     kernel IPsec protocol implementation, due to improper     handling of fragmented ESP packets. When an attacker     controlling an intermediate router fragmented these     packets into very small pieces, it would cause a kernel     crash on the receiving node during packet reassembly.
    (CVE-2007-6282, Important)

  - a flaw in the MOXA serial driver could allow a local     unprivileged user to perform privileged operations, such     as replacing firmware. (CVE-2005-0504, Important)

As well, these updated packages fix the following bugs :

  - multiple buffer overflows in the neofb driver have been     resolved. It was not possible for an unprivileged user     to exploit these issues, and as such, they have not been     handled as security issues.

  - a kernel panic, due to inconsistent detection of AGP     aperture size, has been resolved.

  - a race condition in UNIX domain sockets may have caused     'recv()' to return zero. In clustered configurations,     this may have caused unexpected failovers.

  - to prevent link storms, network link carrier events were     delayed by up to one second, causing unnecessary packet     loss. Now, link carrier events are scheduled     immediately.

  - a client-side race on blocking locks caused large time     delays on NFS file systems.

  - in certain situations, the libATA sata_nv driver may     have sent commands with duplicate tags, which were     rejected by SATA devices. This may have caused infinite     reboots.

  - running the 'service network restart' command may have     caused networking to fail.

  - a bug in NFS caused cached information about directories     to be stored for too long, causing wrong attributes to     be read.

  - on systems with a large highmem/lowmem ratio, NFS write     performance may have been very slow when using small     files.

  - a bug, which caused network hangs when the system clock     was wrapped around zero, has been resolved.

These updated packages fix the following security issues :

  - the absence of a protection mechanism when attempting to     access a critical section of code has been found in the     Linux kernel open file descriptors control mechanism,     fcntl. This could allow a local unprivileged user to     simultaneously execute code, which would otherwise be     protected against parallel execution. As well, a race     condition when handling locks in the Linux kernel fcntl     functionality, may have allowed a process belonging to a     local unprivileged user to gain re-ordered access to the     descriptor table. (CVE-2008-1669, Important)

  - the absence of a protection mechanism when attempting to     access a critical section of code, as well as a race     condition, have been found in the Linux kernel file     system event notifier, dnotify. This could allow a local     unprivileged user to get inconsistent data, or to send     arbitrary signals to arbitrary system processes.
    (CVE-2008-1375, Important)

  - when accessing kernel memory locations, certain Linux     kernel drivers registering a fault handler did not     perform required range checks. A local unprivileged user     could use this flaw to gain read or write access to     arbitrary kernel memory, or possibly cause a kernel     crash. (CVE-2008-0007, Important)

  - a flaw was found when performing asynchronous input or     output operations on a FIFO special file. A local     unprivileged user could use this flaw to cause a kernel     panic. (CVE-2007-5001, Important)

  - a flaw was found in the way core dump files were     created. If a local user could get a root-owned process     to dump a core file into a directory, which the user has     write access to, they could gain read access to that     core file. This could potentially grant unauthorized     access to sensitive information. (CVE-2007-6206,     Moderate)

  - a buffer overflow was found in the Linux kernel ISDN     subsystem. A local unprivileged user could use this flaw     to cause a denial of service. (CVE-2007-6151, Moderate)

  - a race condition found in the mincore system core could     allow a local user to cause a denial of service (system     hang). (CVE-2006-4814, Moderate)

  - it was discovered that the Linux kernel handled string     operations in the opposite way to the GNU Compiler     Collection (GCC). This could allow a local unprivileged     user to cause memory corruption. (CVE-2008-1367, Low)

As well, these updated packages fix the following bugs :

  - a bug, which caused long delays when unmounting mounts     containing a large number of unused dentries, has been     resolved.

  - in the previous kernel packages, the kernel was unable     to handle certain floating point instructions on     Itanium(R) architectures.

  - on certain Intel CPUs, the Translation Lookaside Buffer     (TLB) was not flushed correctly, which caused machine     check errors.

This kernel update fixes quite a number of security problems :

  - A remote attacker could crash the IPSec/IPv6 stack by     sending a bad ESP packet. This requires the host to be     able to receive such packets (default filtered by the     firewall). (CVE-2007-6282)

  - A problem in SIT IPv6 tunnel handling could be used by     remote attackers to immediately crash the machine.
    (CVE-2008-2136)

  - On x86_64 a denial of service attack could be used by     local attackers to immediately panic / crash the     machine. (CVE-2008-1615)

  - An information leakage during coredumping of root     processes was fixed. (CVE-2007-6206)

  - Fixed a SMP ordering problem in fcntl_setlk could     potentially allow local attackers to execute code by     timing file locking. (CVE-2008-1669)

  - Fixed a dnotify race condition, which could be used by     local attackers to potentially execute code.
    (CVE-2008-1375)

  - A ptrace bug could be used by local attackers to hang     their own processes indefinitely. (CVE-2007-5500)

  - Clear the 'direction' flag before calling signal     handlers. For specific not yet identified programs under     specific timing conditions this could potentially have     caused memory corruption or code execution.
    (CVE-2008-1367)

  - The isdn_ioctl function in isdn_common.c allowed local     users to cause a denial of service via a crafted ioctl     struct in which ioctls is not null terminated, which     triggers a buffer overflow. (CVE-2007-6151)

Non security related changes :

OCFS2 was updated to version v1.2.9-1-r3100.

Also a huge number of bugs were fixed. Please refer to the RPM changelog for a detailed list.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a flaw in the MOXA serial driver could allow a local unprivileged user to perform privileged operations, such as replacing firmware.
(CVE-2005-0504, Important)

As well, these updated packages fix the following bugs :

* multiple buffer overflows in the neofb driver have been resolved. It was not possible for an unprivileged user to exploit these issues, and as such, they have not been handled as security issues.

* a kernel panic, due to inconsistent detection of AGP aperture size, has been resolved.

* a race condition in UNIX domain sockets may have caused 'recv()' to return zero. In clustered configurations, this may have caused unexpected failovers.

* to prevent link storms, network link carrier events were delayed by up to one second, causing unnecessary packet loss. Now, link carrier events are scheduled immediately.

* a client-side race on blocking locks caused large time delays on NFS file systems.

* in certain situations, the libATA sata_nv driver may have sent commands with duplicate tags, which were rejected by SATA devices.
This may have caused infinite reboots.

* running the 'service network restart' command may have caused networking to fail.

* a bug in NFS caused cached information about directories to be stored for too long, causing wrong attributes to be read.

* on systems with a large highmem/lowmem ratio, NFS write performance may have been very slow when using small files.

* a bug, which caused network hangs when the system clock was wrapped around zero, has been resolved.

Red Hat Enterprise Linux 4 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* a possible hypervisor panic was found in the Linux kernel. A privileged user of a fully virtualized guest could initiate a stress-test File Transfer Protocol (FTP) transfer between the guest and the hypervisor, possibly leading to hypervisor panic.
(CVE-2008-1619, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* the absence of sanity-checks was found in the hypervisor block backend driver, when running 32-bit paravirtualized guests on a 64-bit host. The number of blocks to be processed per one request from guest to host, or vice-versa, was not checked for its maximum value, which could have allowed a local privileged user of the guest operating system to cause a denial of service. (CVE-2007-5498, Important)

* it was discovered that the Linux kernel handled string operations in the opposite way to the GNU Compiler Collection (GCC). This could allow a local unprivileged user to cause memory corruption.
(CVE-2008-1367, Low)

As well, these updated packages fix the following bugs :

* on IBM System z architectures, when running QIOASSIST enabled QDIO devices in an IBM z/VM environment, the output queue stalled under heavy load. This caused network performance to degrade, possibly causing network hangs and outages.

* multiple buffer overflows were discovered in the neofb video driver.
It was not possible for an unprivileged user to exploit these issues, and as such, they have not been handled as security issues.

* when running Microsoft Windows in a HVM, a bug in vmalloc/vfree caused network performance to degrade.

* on certain architectures, a bug in the libATA sata_nv driver may have caused infinite reboots, and an 'ata1: CPB flags CMD err flags 0x11' error.

* repeatedly hot-plugging a PCI Express card may have caused 'Bad DLLP' errors.

* a NULL pointer dereference in NFS, which may have caused applications to crash, has been resolved.

* when attempting to kexec reboot, either manually or via a panic-triggered kdump, the Unisys ES7000/one hanged after rebooting in the new kernel, after printing the 'Memory: 32839688k/33685504k available' line.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

I   Service Console rpm updates

 a.  Security Update to Service Console Kernel

   This fix upgrades service console kernel version to 2.4.21-57.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2007-5001, CVE-2007-6151, CVE-2007-6206,    CVE-2008-0007, CVE-2008-1367, CVE-2008-1375, CVE-2006-4814, and    CVE-2008-1669 to the security issues fixed in kernel-2.4.21-57.EL.

 b.  Samba Security Update

   This fix upgrades the service console rpm samba to version    3.0.9-1.3E.15vmw

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-1105 to this issue.

The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges. (CVE-2007-3740)

The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.
(CVE-2007-3851)

The (1) hugetlb_vmtruncate_list and (2) hugetlb_vmtruncate functions in fs/hugetlbfs/inode.c in the Linux kernel before 2.6.19-rc4 perform certain prio_tree calculations using HPAGE_SIZE instead of PAGE_SIZE units, which allows local users to cause a denial of service (panic) via unspecified vectors. (CVE-2007-4133)

The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register. This vulnerability is now being fixed in the Xen kernel too. (CVE-2007-4573)

Integer underflow in the ieee80211_rx function in net/ieee80211/ieee80211_rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service (crash) via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211_STYPE_QOS_DATA flag is set, aka an off-by-two error.
(CVE-2007-4997)

The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 relies on user space to close the device, which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries, unless the attacker can convince the victim to unplug the affected device. (CVE-2007-5093)

A race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors. (CVE-2008-1375)

The Linux kernel before 2.6.25.2 does not apply a certain protection mechanism for fcntl functionality, which allows local users to (1) execute code in parallel or (2) exploit a race condition to obtain re-ordered access to the descriptor table. (CVE-2008-1669)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

A race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors. (CVE-2008-1375)

The Linux kernel before 2.6.25.2 does not apply a certain protection mechanism for fcntl functionality, which allows local users to (1) execute code in parallel or (2) exploit a race condition to obtain re-ordered access to the descriptor table. (CVE-2008-1669)

Additionaly, the updated kernel for Mandriva Linux 2008.0 has bug fixes for sound on NEC S970 systems, an oops in module rt73, and the
-devel package fixes DKMS builds.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

Memory leak in the ipip6_rcv function in net/ipv6/sit.c in the Linux kernel before 2.6.25.3 allows remote attackers to cause a denial of service (memory consumption) via network traffic to a Simple Internet Transition (SIT) tunnel interface, related to the pskb_may_pull and kfree_skb functions, and management of an skb reference count.
(CVE-2008-2136)

The utimensat system call (sys_utimensat) in Linux kernel 2.6.22 and other versions before 2.6.25.3 does not check file permissions when certain UTIME_NOW and UTIME_OMIT combinations are used, which allows local users to modify file times of arbitrary files, possibly leading to a denial of service. (CVE-2008-2148)

Integer overflow in the dccp_feat_change function in net/dccp/feat.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow. (CVE-2008-2358)

The pppol2tp_recvmsg function in drivers/net/pppol2tp.c in the Linux kernel 2.6 before 2.6.26-rc6 allows remote attackers to cause a denial of service (kernel heap memory corruption and system crash) and possibly have unspecified other impact via a crafted PPPOL2TP packet that results in a large value for a certain length variable.
(CVE-2008-2750)

Linux kernel 2.6.18, and possibly other versions, when running on AMD64 architectures, allows local users to cause a denial of service (crash) via certain ptrace calls. (CVE-2008-1615)

Integer overflow in the sctp_getsockopt_local_addrs_old function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service (resource consumption and system outage) via vectors involving a large addr_num field in an sctp_getaddrs_old data structure. (CVE-2008-2826)

Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors. (CVE-2008-1375)

The bdx_ioctl_priv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory. (CVE-2008-1675)

Linux kernel before 2.6.25.2 does not apply a certain protection mechanism for fcntl functionality, which allows local users to (1) execute code in parallel or (2) exploit a race condition to obtain re-ordered access to the descriptor table. (CVE-2008-1669)

Additionaly, a number of fixes has been included for the rtc driver, Arima W651DI audio chipset, unionfs, as well as Tomoyolinux has been updated to 1.6.3, UDF 2.50 support was added, and a few things more.
Check the package changelog for more details.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

It was discovered that the ALSA /proc interface did not write the correct number of bytes when reporting memory allocations. A local attacker might be able to access sensitive kernel memory, leading to a loss of privacy. (CVE-2007-4571)

Multiple buffer overflows were discovered in the handling of CIFS filesystems. A malicious CIFS server could cause a client system crash or possibly execute arbitrary code with kernel privileges.
(CVE-2007-5904)

It was discovered that PowerPC kernels did not correctly handle reporting certain system details. By requesting a specific set of information, a local attacker could cause a system crash resulting in a denial of service. (CVE-2007-6694)

It was discovered that some device driver fault handlers did not correctly verify memory ranges. A local attacker could exploit this to access sensitive kernel memory, possibly leading to a loss of privacy.
(CVE-2008-0007)

It was discovered that CPU resource limits could be bypassed. A malicious local user could exploit this to avoid administratively imposed resource limits. (CVE-2008-1294)

A race condition was discovered between dnotify fcntl() and close() in the kernel. If a local attacker performed malicious dnotify requests, they could cause memory consumption leading to a denial of service, or possibly send arbitrary signals to any process. (CVE-2008-1375)

On SMP systems, a race condition existed in fcntl(). Local attackers could perform malicious locks, causing system crashes and leading to a denial of service. (CVE-2008-1669).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This kernel update fixes the following security problems:
CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine.

CVE-2008-1615: On x86_64 a denial of service attack could be used by local attackers to immediately panic / crash the machine.

CVE-2008-2148: The permission checking in sys_utimensat was incorrect and local attackers could change the filetimes of files they do not own to the current time.

CVE-2008-1669: Fixed a SMP ordering problem in fcntl_setlk could potentially allow local attackers to execute code by timing file locking.

CVE-2008-1375: Fixed a dnotify race condition, which could be used by local attackers to potentially execute code.

CVE-2007-6282: A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets (default filtered by the firewall).

CVE-2008-1367: Clear the 'direction' flag before calling signal handlers. For specific not yet identified programs under specific timing conditions this could potentially have caused memory corruption or code execution.

And the following bugs (numbers are https://bugzilla.novell.com/ references) :

  - patches.fixes/input-add-amilo-pro-v-to-nomux.patch:
    Update the patch to include also 2030 model to nomux     list (bnc#389169).

  - patches.apparmor/fix-net.diff: AppArmor: fix Oops in     apparmor_socket_getpeersec_dgram() (bnc#378608).

  - patches.fixes/input-alps-update.patch: Input: fix the     AlpsPS2 driver (bnc#357881).

- patches.arch/cpufreq_fix_acpi_driver_on_BIOS_changes.patch: CPUFREQ:
Check against freq changes from the BIOS (334378).

- patches.fixes/ieee1394-limit-early-node-speed-to-host-interf ace-speed: ieee1394: limit early node speed to host interface speed (381304).

  - patches.fixes/forcedeth_realtec_phy_fix: Fix a     regression to the GA kernel for some forcedeth cards     (bnc#379478)

  - pci-revert-SMBus-unhide-on-nx6110.patch: Do not unhide     the SMBus on the HP Compaq nx6110, it's unsafe.

  - patches.drivers/e1000-disable-l1aspm.patch: Disable L1     ASPM power savings for 82573 mobile variants, it's     broken (bnc#254713, LTC34077).

  - patches.drivers/libata-improve-hpa-error-handling:
    libata: improve HPA error handling (365534).

  - rpm/kernel-binary.spec.in: Added Conflicts:
    libc.so.6()(64bit) to i386 arch (364433).

- patches.drivers/libata-disallow-sysfs-read-access-to-force-p aram:
libata: don't allow sysfs read access to force param (362599).

  - patches.suse/bonding-workqueue: Update to fix a hang     when closing a bonding device (342994).

  - patches.fixes/mptspi-dv-renegotiate-oops: mptlinux     crashes on kernel 2.6.22 (bnc#271749).

- patches.drivers/usb-update-sierra-and-option-device-ids-from

  -2.6.25-rc3.patch: USB: update sierra and option device   ids from 2.6.25-rc3 (343167).

  - patches.arch/x86-nvidia-timer-quirk: Disable again     (#302327) The PCI ID lists are not complete enough and     let's have the same crap as mainline for this for now.

  - patches.fixes/input-add-lenovo-3000-n100-to-nomux.patch:
    Input: add Lenovo 3000 N100 to nomux blacklist     (bnc#284013).

  - patches.suse/bonding-bh-locking: Add missing chunks. The     SLES10 SP1 version of the patch was updated in May 2007     but the openSuse 10.3 version was forgotten (260069).

- patches.fixes/knfsd-Allow-NFSv2-3-WRITE-calls-to-succeed-whe n-krb.patch: knfsd: Allow NFSv2/3 WRITE calls to succeed when krb5i etc is used. (348737).

- patches.fixes/md-fix-an-occasional-deadlock-in-raid5.patch: md: fix an occasional deadlock in raid5 (357088).

  - patches.drivers/libata-quirk_amd_ide_mode: PCI: modify     SATA IDE mode quirk (345124).

  - Fix section mismatch build failure w/ gcc 4.1.2. bug     #361086.

  - patches.drivers/libata-implement-force-parameter:
    libata: implement libata.force module parameter     (337610).

Lots of XEN Fixes (not detailed listed). Lots of RT Fixes (not detailed listed).

  - Update to 2.6.22.18

  - removes upstreamed patch :

  - patches.fixes/vmsplice-pipe-exploit (CVE-2008-0600)

This kernel update fixes the following security problems :

CVE-2008-1615: On x86_64 a denial of service attack could be used by local attackers to immediately panic / crash the machine.

CVE-2008-2358: A security problem in DCCP was fixed, which could be used by remote attackers to crash the machine.

CVE-2007-6206: An information leakage during coredumping of root processes was fixed.

CVE-2007-6712: A integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.

CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine.

CVE-2008-1669: Fixed a SMP ordering problem in fcntl_setlk could potentially allow local attackers to execute code by timing file locking.

CVE-2008-1367: Clear the 'direction' flag before calling signal handlers. For specific not yet identified programs under specific timing conditions this could potentially have caused memory corruption or code execution.

CVE-2008-1375: Fixed a dnotify race condition, which could be used by local attackers to potentially execute code.

CVE-2007-6282: A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets (default filtered by the firewall).

CVE-2007-5500: A ptrace bug could be used by local attackers to hang their own processes indefinitely.

CVE-2007-5904: A remote buffer overflow in CIFS was fixed which could be used by remote attackers to crash the machine or potentially execute code.

And the following bugs (numbers are https://bugzilla.novell.com/ references) :

  - patches.arch/x86-nosmp-implies-noapic.patch: When     booting with nosmp or maxcpus=0 on i386 or x86-64, we     must disable the I/O APIC, otherwise the system won't     boot in most cases (bnc#308540).

  - patches.arch/i386-at-sysinfo-ehdr: i386: make     AT_SYSINFO_EHDR consistent with AT_SYSINFO (bnc#289641).

  - patches.suse/bonding-workqueue: Update to fix a hang     when closing a bonding device (342994).

  - patches.fixes/mptspi-dv-renegotiate-oops: mptlinux     crashes on kernel 2.6.22 (bnc#271749).

It was discovered that PowerPC kernels did not correctly handle reporting certain system details. By requesting a specific set of information, a local attacker could cause a system crash resulting in a denial of service. (CVE-2007-6694)

A race condition was discovered between dnotify fcntl() and close() in the kernel. If a local attacker performed malicious dnotify requests, they could cause memory consumption leading to a denial of service, or possibly send arbitrary signals to any process. (CVE-2008-1375)

On SMP systems, a race condition existed in fcntl(). Local attackers could perform malicious locks, causing system crashes and leading to a denial of service. (CVE-2008-1669)

The tehuti network driver did not correctly handle certain IO functions. A local attacker could perform malicious requests to the driver, potentially accessing kernel memory, leading to privilege escalation or access to private system information. (CVE-2008-1675).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Linux kernel verion 2.6.24.6, 2.6.24.7:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.24.6 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.24.7 Security fixes: CVE-2008-1375 (2.6.24.6) - dnotify/close race CVE-2008-1675 (2.6.24.6)

  - tehuti driver permissions and register size check issues     CVE-2008-1669 (2.6.24.7) - SMP ordering hole in     fcntl_setlk() Wireless driver bug fixes. Fix access     permissions on /proc/kcore (#241362) Re-enable machine     check exception handler.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* a flaw was found when performing asynchronous input or output operations on a FIFO special file. A local unprivileged user could use this flaw to cause a kernel panic. (CVE-2007-5001, Important)

* a flaw was found in the way core dump files were created. If a local user could get a root-owned process to dump a core file into a directory, which the user has write access to, they could gain read access to that core file. This could potentially grant unauthorized access to sensitive information. (CVE-2007-6206, Moderate)

* a buffer overflow was found in the Linux kernel ISDN subsystem. A local unprivileged user could use this flaw to cause a denial of service. (CVE-2007-6151, Moderate)

* a race condition found in the mincore system core could allow a local user to cause a denial of service (system hang). (CVE-2006-4814, Moderate)

* it was discovered that the Linux kernel handled string operations in the opposite way to the GNU Compiler Collection (GCC). This could allow a local unprivileged user to cause memory corruption.
(CVE-2008-1367, Low)

As well, these updated packages fix the following bugs :

* a bug, which caused long delays when unmounting mounts containing a large number of unused dentries, has been resolved.

* in the previous kernel packages, the kernel was unable to handle certain floating point instructions on Itanium(R) architectures.

* on certain Intel CPUs, the Translation Lookaside Buffer (TLB) was not flushed correctly, which caused machine check errors.

Red Hat Enterprise Linux 3 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6694     Cyrill Gorcunov reported a NULL pointer dereference in     code specific to the CHRP PowerPC platforms. Local users     could exploit this issue to achieve a Denial of Service     (DoS).

  - CVE-2008-0007     Nick Piggin of SuSE discovered a number of issues in     subsystems which register a fault handler for memory     mapped areas. This issue can be exploited by local users     to achieve a Denial of Service (DoS) and possibly     execute arbitrary code.

  - CVE-2008-1294     David Peer discovered that users could escape     administrator imposed cpu time limitations (RLIMIT_CPU)     by setting a limit of 0.

  - CVE-2008-1375     Alexander Viro discovered a race condition in the     directory notification subsystem that allows local users     to cause a Denial of Service (oops) and possibly result     in an escalation of privileges.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0237.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0233.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0211.

ID	Name	Product	Family	Severity
79447	OracleVM 2.1 : kernel (OVMSA-2008-2005)	Nessus	OracleVM Local Security Checks	high
67685	Oracle Linux 4 : kernel (ELSA-2008-0237)	Nessus	Oracle Linux Local Security Checks	high
67683	Oracle Linux 5 : kernel (ELSA-2008-0233)	Nessus	Oracle Linux Local Security Checks	high
67678	Oracle Linux 3 : kernel (ELSA-2008-0211)	Nessus	Oracle Linux Local Security Checks	high
60395	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60394	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60393	Scientific Linux Security Update : kernel on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
59128	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5370)	Nessus	SuSE Local Security Checks	high
43682	CentOS 4 : kernel (CESA-2008:0237)	Nessus	CentOS Local Security Checks	high
43681	CentOS 5 : kernel (CESA-2008:0233)	Nessus	CentOS Local Security Checks	high
40380	VMSA-2008-0011 : Updated ESX service console packages for Samba and vmnix	Nessus	VMware ESX Local Security Checks	high
37772	Mandriva Linux Security Advisory : kernel (MDVSA-2008:105)	Nessus	Mandriva Local Security Checks	high
37544	Mandriva Linux Security Advisory : kernel (MDVSA-2008:104)	Nessus	Mandriva Local Security Checks	medium
36653	Mandriva Linux Security Advisory : kernel (MDVSA-2008:167)	Nessus	Mandriva Local Security Checks	high
33432	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5375)	Nessus	SuSE Local Security Checks	high
33255	Ubuntu 6.06 LTS / 7.04 / 7.10 : linux-source-2.6.15/20/22 vulnerabilities (USN-618-1)	Nessus	Ubuntu Local Security Checks	high
33253	openSUSE 10 Security Update : kernel (kernel-5339)	Nessus	SuSE Local Security Checks	high
33252	openSUSE 10 Security Update : kernel (kernel-5336)	Nessus	SuSE Local Security Checks	high
33093	Ubuntu 8.04 LTS : linux vulnerabilities (USN-614-1)	Nessus	Ubuntu Local Security Checks	high
32335	Fedora 8 : kernel-2.6.24.7-92.fc8 (2008-3873)	Nessus	Fedora Local Security Checks	high
32162	RHEL 4 : kernel (RHSA-2008:0237)	Nessus	Red Hat Local Security Checks	high
32161	RHEL 5 : kernel (RHSA-2008:0233)	Nessus	Red Hat Local Security Checks	high
32160	RHEL 3 : kernel (RHSA-2008:0211)	Nessus	Red Hat Local Security Checks	high
32139	CentOS 3 : kernel (CESA-2008:0211)	Nessus	CentOS Local Security Checks	high
32127	Debian DSA-1565-1 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	high
801451	CentOS RHSA-2008-0237 Security Check	Log Correlation Engine	Generic	high
801450	CentOS RHSA-2008-0233 Security Check	Log Correlation Engine	Generic	high
801449	CentOS RHSA-2008-0211 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2008-1375

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high