arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects (vDSO) implementation in the Linux kernel before 2.6.21 does not properly check boundaries, which allows local users to gain privileges or cause a denial of service via unspecified vectors, related to the install_special_mapping, syscall, and syscall32_nopage functions.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0957 advisory.

    - [i386] vDSO: use install_special_mapping (Peter Zijlstra ) [460275 460276] {CVE-2008-3527}
    - [fs] remove SUID when splicing into an inode (Eric Sandeen ) [464451 464452] {CVE-2008-3833}
    - [fs] open() allows setgid bit when user is not in group (Eugene Teo ) [463867 463687] {CVE-2008-4210}
    - [xen] allow guests to hide the TSC from applications (Chris Lalancette ) [378471 378481] {CVE-2007-5907}
    - [x86_64] xen: local DOS due to NT bit leakage (Eugene Teo ) [457721 457722] {CVE-2006-5755}
    - [net] dccp_setsockopt_change integer overflow (Vitaly Mayatskikh ) [459232 459235] {CVE-2008-3276}
    - [mm] optimize ZERO_PAGE in 'get_user_pages' and fix XIP (Anton Arapov ) [452667 452668] {CVE-2008-2372}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- the Xen implementation did not prevent applications     running in a para-virtualized guest from modifying CR4     TSC. This could cause a local denial of service.
    (CVE-2007-5907, Important)

  - Tavis Ormandy reported missing boundary checks in the     Virtual Dynamic Shared Objects (vDSO) implementation.
    This could allow a local unprivileged user to cause a     denial of service or escalate privileges.
    (CVE-2008-3527, Important)

  - the do_truncate() and generic_file_splice_write()     functions did not clear the setuid and setgid bits. This     could allow a local unprivileged user to obtain access     to privileged information. (CVE-2008-4210,     CVE-2008-3833, Important)

  - a flaw was found in the Linux kernel splice     implementation. This could cause a local denial of     service when there is a certain failure in the     add_to_page_cache_lru() function. (CVE-2008-4302,     Important)

  - a flaw was found in the Linux kernel when running on     AMD64 systems. During a context switch, EFLAGS were     being neither saved nor restored. This could allow a     local unprivileged user to cause a denial of service.
    (CVE-2006-5755, Low)

  - a flaw was found in the Linux kernel virtual memory     implementation. This could allow a local unprivileged     user to cause a denial of service. (CVE-2008-2372, Low)

  - an integer overflow was discovered in the Linux kernel     Datagram Congestion Control Protocol (DCCP)     implementation. This could allow a remote attacker to     cause a denial of service. By default, remote DCCP is     blocked by SELinux. (CVE-2008-3276, Low)

In addition, these updated packages fix the following bugs :

  - random32() seeding has been improved.

  - in a multi-core environment, a race between the QP async     event-handler and the destro_qp() function could occur.
    This led to unpredictable results during invalid memory     access, which could lead to a kernel crash.

  - a format string was omitted in the call to the     request_module() function.

  - a stack overflow caused by an infinite recursion bug in     the binfmt_misc kernel module was corrected.

  - the ata_scsi_rbuf_get() and ata_scsi_rbuf_put()     functions now check for scatterlist usage before calling     kmap_atomic().

  - a sentinel NUL byte was added to the device_write()     function to ensure that lspace.name is NUL-terminated.

  - in the character device driver, a range_is_allowed()     check was added to the read_mem() and write_mem()     functions. It was possible for an illegitimate     application to bypass these checks, and access /dev/mem     beyond the 1M limit by calling mmap_mem() instead. Also,     the parameters of range_is_allowed() were changed to     cleanly handle greater than 32-bits of physical address     on 32-bit architectures.

  - some of the newer Nehalem-based systems declare their     CPU DSDT entries as type 'Alias'. During boot, this     caused an 'Error attaching device data' message to be     logged.

  - the evtchn event channel device lacked locks and memory     barriers. This has led to xenstore becoming unresponsive     on the Itanium&reg; architecture.

  - sending of gratuitous ARP packets in the Xen frontend     network driver is now delayed until the backend signals     that its carrier status has been processed by the stack.

  - on forcedeth devices, whenever setting ethtool     parameters for link speed, the device could stop     receiving interrupts.

  - the CIFS 'forcedirectio' option did not allow text to be     appended to files.

  - the gettimeofday() function returned a backwards time on     Intel&reg; 64.

  - residual-count corrections during UNDERRUN handling were     added to the qla2xxx driver.

  - the fix for a small quirk was removed for certain     Adaptec controllers for which it caused problems.

  - the 'xm trigger init' command caused a domain panic if a     userland application was running on a guest on the     Intel&reg; 64 architecture.

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 12th November 2008] The original packages distributed with this errata had a bug which prevented the Xen kernel booting on older hardware. We have updated the packages to correct this bug.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* the Xen implementation did not prevent applications running in a para-virtualized guest from modifying CR4 TSC. This could cause a local denial of service. (CVE-2007-5907, Important)

* Tavis Ormandy reported missing boundary checks in the Virtual Dynamic Shared Objects (vDSO) implementation. This could allow a local unprivileged user to cause a denial of service or escalate privileges.
(CVE-2008-3527, Important)

* the do_truncate() and generic_file_splice_write() functions did not clear the setuid and setgid bits. This could allow a local unprivileged user to obtain access to privileged information.
(CVE-2008-4210, CVE-2008-3833, Important)

* a flaw was found in the Linux kernel splice implementation. This could cause a local denial of service when there is a certain failure in the add_to_page_cache_lru() function. (CVE-2008-4302, Important)

* a flaw was found in the Linux kernel when running on AMD64 systems.
During a context switch, EFLAGS were being neither saved nor restored.
This could allow a local unprivileged user to cause a denial of service. (CVE-2006-5755, Low)

* a flaw was found in the Linux kernel virtual memory implementation.
This could allow a local unprivileged user to cause a denial of service. (CVE-2008-2372, Low)

* an integer overflow was discovered in the Linux kernel Datagram Congestion Control Protocol (DCCP) implementation. This could allow a remote attacker to cause a denial of service. By default, remote DCCP is blocked by SELinux. (CVE-2008-3276, Low)

In addition, these updated packages fix the following bugs :

* random32() seeding has been improved.

* in a multi-core environment, a race between the QP async event-handler and the destro_qp() function could occur. This led to unpredictable results during invalid memory access, which could lead to a kernel crash.

* a format string was omitted in the call to the request_module() function.

* a stack overflow caused by an infinite recursion bug in the binfmt_misc kernel module was corrected.

* the ata_scsi_rbuf_get() and ata_scsi_rbuf_put() functions now check for scatterlist usage before calling kmap_atomic().

* a sentinel NUL byte was added to the device_write() function to ensure that lspace.name is NUL-terminated.

* in the character device driver, a range_is_allowed() check was added to the read_mem() and write_mem() functions. It was possible for an illegitimate application to bypass these checks, and access /dev/mem beyond the 1M limit by calling mmap_mem() instead. Also, the parameters of range_is_allowed() were changed to cleanly handle greater than 32-bits of physical address on 32-bit architectures.

* some of the newer Nehalem-based systems declare their CPU DSDT entries as type 'Alias'. During boot, this caused an 'Error attaching device data' message to be logged.

* the evtchn event channel device lacked locks and memory barriers.
This has led to xenstore becoming unresponsive on the Itanium(r) architecture.

* sending of gratuitous ARP packets in the Xen frontend network driver is now delayed until the backend signals that its carrier status has been processed by the stack.

* on forcedeth devices, whenever setting ethtool parameters for link speed, the device could stop receiving interrupts.

* the CIFS 'forcedirectio' option did not allow text to be appended to files.

* the gettimeofday() function returned a backwards time on Intel(r) 64.

* residual-count corrections during UNDERRUN handling were added to the qla2xxx driver.

* the fix for a small quirk was removed for certain Adaptec controllers for which it caused problems.

* the 'xm trigger init' command caused a domain panic if a userland application was running on a guest on the Intel(r) 64 architecture.

Users of kernel should upgrade to these updated packages, which contain backported patches to correct these issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-3527     Tavis Ormandy reported a local DoS and potential     privilege escalation in the Virtual Dynamic Shared     Objects (vDSO) implementation.

  - CVE-2008-3528     Eugene Teo reported a local DoS issue in the ext2 and     ext3 filesystems. Local users who have been granted the     privileges necessary to mount a filesystem would be able     to craft a corrupted filesystem that causes the kernel     to output error messages in an infinite loop.

  - CVE-2008-4554     Milos Szeredi reported that the usage of splice() on     files opened with O_APPEND allows users to write to the     file at arbitrary offsets, enabling a bypass of possible     assumed semantics of the O_APPEND flag.

  - CVE-2008-4576     Vlad Yasevich reported an issue in the SCTP subsystem     that may allow remote users to cause a local DoS by     triggering a kernel oops.

  - CVE-2008-4933     Eric Sesterhenn reported a local DoS issue in the     hfsplus filesystem. Local users who have been granted     the privileges necessary to mount a filesystem would be     able to craft a corrupted filesystem that causes the     kernel to overrun a buffer, resulting in a system oops     or memory corruption.

  - CVE-2008-4934     Eric Sesterhenn reported a local DoS issue in the     hfsplus filesystem. Local users who have been granted     the privileges necessary to mount a filesystem would be     able to craft a corrupted filesystem that results in a     kernel oops due to an unchecked return value.

  - CVE-2008-5025     Eric Sesterhenn reported a local DoS issue in the hfs     filesystem. Local users who have been granted the     privileges necessary to mount a filesystem would be able     to craft a filesystem with a corrupted catalog name     length, resulting in a system oops or memory corruption.

  - CVE-2008-5029     Andrea Bittau reported a DoS issue in the unix socket     subsystem that allows a local user to cause memory     corruption, resulting in a kernel panic.

  - CVE-2008-5079     Hugo Dias reported a DoS condition in the ATM subsystem     that can be triggered by a local user by calling the     svc_listen function twice on the same socket and reading     /proc/net/atm/*vc.

  - CVE-2008-5182     Al Viro reported race conditions in the inotify     subsystem that may allow local users to acquire elevated     privileges.

  - CVE-2008-5300     Dann Frazier reported a DoS condition that allows local     users to cause the out of memory handler to kill off     privileged processes or trigger soft lockups due to a     starvation issue in the unix socket subsystem.

This kernel update fixes various bugs and also several security issues :

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP AUTH availability. This might be exploited remotely for a denial of service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c in the Linux kernel does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by splicing into an inode in order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle corrupted data structures. With a mounted filesystem image or partition that have corrupted dir->i_size and dir->i_blocks, a user performing either a read or write operation on the mounted image or partition can lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel did not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op functions, which might have been used by local attackers to execute code. We think that this affects only devices openable by root, so the impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not properly check boundaries, which allows local users to gain privileges or cause a denial of service via unspecified vectors, related to the install_special_mapping, syscall, and syscall32_nopage functions.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0957.

ID	Name	Product	Family	Severity
67758	Oracle Linux 5 : kernel (ELSA-2008-0957)	Nessus	Oracle Linux Local Security Checks	medium
60488	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43713	CentOS 5 : kernel (CESA-2008:0957)	Nessus	CentOS Local Security Checks	high
35174	Debian DSA-1687-1 : linux-2.6 - denial of service/privilege escalation	Nessus	Debian Local Security Checks	high
34755	openSUSE 10 Security Update : kernel (kernel-5751)	Nessus	SuSE Local Security Checks	critical
34690	RHEL 5 : kernel (RHSA-2008:0957)	Nessus	Red Hat Local Security Checks	high
801458	CentOS RHSA-2008-0957 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2008-3527

high

Tenable Plugins

medium

high

high

high

critical

high

high