Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."

From Red Hat Security Advisory 2009:0331 :

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update addresses the following security issues :

* a buffer overflow was found in the Linux kernel Partial Reliable Stream Control Transmission Protocol (PR-SCTP) implementation. This could, potentially, lead to a denial of service if a Forward-TSN chunk is received with a large stream ID. (CVE-2009-0065, Important)

* a memory leak was found in keyctl handling. A local, unprivileged user could use this flaw to deplete kernel memory, eventually leading to a denial of service. (CVE-2009-0031, Important)

* a deficiency was found in the Remote BIOS Update (RBU) driver for Dell systems. This could allow a local, unprivileged user to cause a denial of service by reading zero bytes from the image_type or packet_size file in '/sys/devices/platform/dell_rbu/'. (CVE-2009-0322, Important)

* a deficiency was found in the libATA implementation. This could, potentially, lead to a denial of service. Note: by default, '/dev/sg*' devices are accessible only to the root user. (CVE-2008-5700, Low)

This update also fixes the following bugs :

* when the hypervisor changed a page table entry (pte) mapping from read-only to writable via a make_writable hypercall, accessing the changed page immediately following the change caused a spurious page fault. When trying to install a para-virtualized Red Hat Enterprise Linux 4 guest on a Red Hat Enterprise Linux 5.3 dom0 host, this fault crashed the installer with a kernel backtrace. With this update, the 'spurious' page fault is handled properly. (BZ#483748)

* net_rx_action could detect its cpu poll_list as non-empty, but have that same list reduced to empty by the poll_napi path. This resulted in garbage data being returned when net_rx_action calls list_entry, which subsequently resulted in several possible crash conditions. The race condition in the network code which caused this has been fixed.
(BZ#475970, BZ#479681 & BZ#480741)

* a misplaced memory barrier at unlock_buffer() could lead to a concurrent h_refcounter update which produced a reference counter leak and, later, a double free in ext3_xattr_release_block(). Consequent to the double free, ext3 reported an error

ext3_free_blocks_sb: bit already cleared for block [block number]

and mounted itself as read-only. With this update, the memory barrier is now placed before the buffer head lock bit, forcing the write order and preventing the double free. (BZ#476533)

* when the iptables module was unloaded, it was assumed the correct entry for removal had been found if 'wrapper->ops->pf' matched the value passed in by 'reg->pf'. If several ops ranges were registered against the same protocol family, however, (which was likely if you had both ip_conntrack and ip_contrack_* loaded) this assumption could lead to NULL list pointers and cause a kernel panic. With this update, 'wrapper->ops' is matched to pointer values 'reg', which ensures the correct entry is removed and results in no NULL list pointers.
(BZ#477147)

* when the pidmap page (used for tracking process ids, pids) incremented to an even page (ie the second, fourth, sixth, etc. pidmap page), the alloc_pidmap() routine skipped the page. This resulted in 'holes' in the allocated pids. For example, after pid 32767, you would expect 32768 to be allocated. If the page skipping behavior presented, however, the pid allocated after 32767 was 65536. With this update, alloc_pidmap() no longer skips alternate pidmap pages and allocated pid holes no longer occur. This fix also corrects an error which allowed pid_max to be set higher than the pid_max limit has been corrected. (BZ#479182)

All Red Hat Enterprise Linux 4 users should upgrade to these updated packages, which contain backported patches to resolve these issues.
The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0264 advisory.

    - [security] introduce missing kfree (Jiri Pirko ) [480597 480598] {CVE-2009-0031}
    - [net] sctp: overflow with bad stream ID in FWD-TSN chunk (Eugene Teo ) [478804 478805] {CVE-2009-0065}
    - [net] add preemption point in qdisc_run (Jiri Pirko ) [477746 471398] {CVE-2008-5713}
    - [fs] hfsplus: fix buffer overflow with a corrupted image (Anton Arapov ) [469637 469638] {CVE-2008-4933}
    - [fs] hfsplus: check read_mapping_page return value (Anton Arapov ) [469644 469645] {CVE-2008-4934}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update addresses the following security issues :

  - a buffer overflow was found in the Linux kernel Partial     Reliable Stream Control Transmission Protocol (PR-SCTP)     implementation. This could, potentially, lead to a     denial of service if a Forward-TSN chunk is received     with a large stream ID. (CVE-2009-0065, Important)

  - a memory leak was found in keyctl handling. A local,     unprivileged user could use this flaw to deplete kernel     memory, eventually leading to a denial of service.
    (CVE-2009-0031, Important)

  - a deficiency was found in the Remote BIOS Update (RBU)     driver for Dell systems. This could allow a local,     unprivileged user to cause a denial of service by     reading zero bytes from the image_type or packet_size     file in '/sys/devices/platform/dell_rbu/'.
    (CVE-2009-0322, Important)

  - a deficiency was found in the libATA implementation.
    This could, potentially, lead to a denial of service.
    Note: by default, '/dev/sg*' devices are accessible only     to the root user. (CVE-2008-5700, Low)

This update also fixes the following bugs :

  - when the hypervisor changed a page table entry (pte)     mapping from read-only to writable via a make_writable     hypercall, accessing the changed page immediately     following the change caused a spurious page fault. When     trying to install a para-virtualized Scientific Linux 4     guest on a Scientific Linux 5.3 dom0 host, this fault     crashed the installer with a kernel backtrace. With this     update, the 'spurious' page fault is handled properly.
    (BZ#483748)

  - net_rx_action could detect its cpu poll_list as     non-empty, but have that same list reduced to empty by     the poll_napi path. This resulted in garbage data being     returned when net_rx_action calls list_entry, which     subsequently resulted in several possible crash     conditions. The race condition in the network code which     caused this has been fixed. (BZ#475970, BZ#479681 &amp;
    BZ#480741)

  - a misplaced memory barrier at unlock_buffer() could lead     to a concurrent h_refcounter update which produced a     reference counter leak and, later, a double free in     ext3_xattr_release_block(). Consequent to the double     free, ext3 reported an error

    ext3_free_blocks_sb: bit already cleared for block     [block number]

    and mounted itself as read-only. With this update, the     memory barrier is now placed before the buffer head lock     bit, forcing the write order and preventing the double     free. (BZ#476533)

  - when the iptables module was unloaded, it was assumed     the correct entry for removal had been found if     'wrapper->ops->pf' matched the value passed in by     'reg->pf'. If several ops ranges were registered against     the same protocol family, however, (which was likely if     you had both ip_conntrack and ip_contrack_* loaded) this     assumption could lead to NULL list pointers and cause a     kernel panic. With this update, 'wrapper->ops' is     matched to pointer values 'reg', which ensures the     correct entry is removed and results in no NULL list     pointers. (BZ#477147)

  - when the pidmap page (used for tracking process ids,     pids) incremented to an even page (ie the second,     fourth, sixth, etc. pidmap page), the alloc_pidmap()     routine skipped the page. This resulted in 'holes' in     the allocated pids. For example, after pid 32767, you     would expect 32768 to be allocated. If the page skipping     behavior presented, however, the pid allocated after     32767 was 65536. With this update, alloc_pidmap() no     longer skips alternate pidmap pages and allocated pid     holes no longer occur. This fix also corrects an error     which allowed pid_max to be set higher than the pid_max     limit has been corrected. (BZ#479182)

The system must be rebooted for this update to take effect.

This update addresses the following security issues :

  - a memory leak in keyctl handling. A local user could use     this flaw to deplete kernel memory, eventually leading     to a denial of service. (CVE-2009-0031, Important)

  - a buffer overflow in the Linux kernel Partial Reliable     Stream Control Transmission Protocol (PR-SCTP)     implementation. This could, potentially, lead to a     denial of service if a Forward-TSN chunk is received     with a large stream ID. (CVE-2009-0065, Important)

  - a flaw when handling heavy network traffic on an SMP     system with many cores. An attacker who could send a     large amount of network traffic could create a denial of     service. (CVE-2008-5713, Important)

  - the code for the HFS and HFS Plus (HFS+) file systems     failed to properly handle corrupted data structures.
    This could, potentially, lead to a local denial of     service. (CVE-2008-4933, CVE-2008-5025, Low)

  - a flaw was found in the HFS Plus (HFS+) file system     implementation. This could, potentially, lead to a local     denial of service when write operations are performed.
    (CVE-2008-4934, Low)

  - when fput() was called to close a socket, the
    __scm_destroy() function in the Linux kernel could make     indirect recursive calls to itself. This could,     potentially, lead to a denial of service issue.
    (CVE-2008-5029, Important)

  - a flaw was found in the Asynchronous Transfer Mode (ATM)     subsystem. A local, unprivileged user could use the flaw     to listen on the same socket more than once, possibly     causing a denial of service. (CVE-2008-5079, Important)

  - a race condition was found in the Linux kernel 'inotify'     watch removal and umount implementation. This could     allow a local, unprivileged user to cause a privilege     escalation or a denial of service. (CVE-2008-5182,     Important)

** Bug fixes and enhancements are provided for :

  - support for specific NICs, including products from the     following manufacturers: Broadcom Chelsio Cisco Intel     Marvell NetXen Realtek Sun

  - Fiber Channel support, including support for Qlogic     qla2xxx, qla4xxx, and qla84xx HBAs and the FCoE, FCP,     and zFCP protocols.

  - support for various CPUs, including: AMD Opteron     processors with 45 nm SOI ('Shanghai') AMD Turion Ultra     processors Cell processors Intel Core i7 processors

  - Xen support, including issues specific to the IA64     platform, systems using AMD processors, and Dell     Optiplex GX280 systems

  - ext3, ext4, GFS2, NFS, and SPUFS

  - Infiniband (including eHCA, eHEA, and IPoIB) support

  - common I/O (CIO), direct I/O (DIO), and queued direct     I/O (qdio) support

  - the kernel distributed lock manager (DLM)

  - hardware issues with: SCSI, IEEE 1394 (FireWire), RAID     (including issues specific to Adaptec controllers), SATA     (including NCQ), PCI, audio, serial connections,     tape-drives, and USB

  - ACPI, some of a general nature and some related to     specific hardware including: certain Lenovo Thinkpad     notebooks, HP DC7700 systems, and certain machines based     on Intel Centrino processor technology.

  - CIFS, including Kerberos support and a tech-preview of     DFS support

  - networking support, including IPv6, PPPoE, and IPSec

  - support for Intel chipsets, including: Intel Cantiga     chipsets Intel Eagle Lake chipsets Intel i915 chipsets     Intel i965 chipsets Intel Ibex Peak chipsets Intel     chipsets offering QuickPath Interconnects (QPI)

  - device mapping issues, including some in device mapper     itself

  - various issues specific to IA64 and PPC

  - CCISS, including support for Compaq SMART Array     controllers P711m and P712m and other new hardware

  - various issues affecting specific HP systems, including:
    DL785G5 XW4800 XW8600 XW8600 XW9400

  - IOMMU support, including specific issues with AMD and     IBM Calgary hardware

  - the audit subsystem

  - DASD support

  - iSCSI support, including issues specific to Chelsio T3     adapters

  - LVM issues

  - SCTP management information base (MIB) support

  - issues with: autofs, kdump, kobject_add, libata, lpar,     ptrace, and utrace

  - platforms using Intel Enhanced Error Handling (EEH)

  - EDAC issues for AMD K8 and Intel i5000

  - ALSA, including support for new hardware

  - futex support

  - hugepage support

  - Intelligent Platform Management Interface (IPMI) support

  - issues affecting NEC/Stratus servers

  - OFED support

  - SELinux

  - various Virtio issues

  - when using the nfsd daemon in a clustered setup, kernel     panics appeared seemingly at random. These panics were     caused by a race condition in the device-mapper mirror     target.

  - the clock_gettime(CLOCK_THREAD_CPUTIME_ID, ) syscall     returned a smaller timespec value than the result of     previous clock_gettime() function execution, which     resulted in a negative, and nonsensical, elapsed time     value.

  - nfs_create_rpc_client was called with a 'flavor'     parameter which was usually ignored and ended up     unconditionally creating the RPC client with an     AUTH_UNIX flavor. This caused problems on AUTH_GSS     mounts when the credentials needed to be refreshed. The     credops did not match the authorization type, which     resulted in the credops dereferencing an incorrect part     of the AUTH_UNIX rpc_auth struct.

  - when copy_user_c terminated prematurely due to reading     beyond the end of the user buffer and the kernel jumped     to the exception table entry, the rsi register was not     cleared. This resulted in exiting back to user code with     garbage in the rsi register.

  - the hexdump data in s390dbf traces was incomplete. The     length of the data traced was incorrect and the SAN     payload was read from a different place then it was     written to.

  - when using connected mode (CM) in IPoIB on ehca2     hardware, it was not possible to transmit any data.

  - when an application called fork() and pthread_create()     many times and, at some point, a thread forked a child     and then attempted to call the setpgid() function, then     this function failed and returned and ESRCH error value.

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update addresses the following security issues :

* a buffer overflow was found in the Linux kernel Partial Reliable Stream Control Transmission Protocol (PR-SCTP) implementation. This could, potentially, lead to a denial of service if a Forward-TSN chunk is received with a large stream ID. (CVE-2009-0065, Important)

* a memory leak was found in keyctl handling. A local, unprivileged user could use this flaw to deplete kernel memory, eventually leading to a denial of service. (CVE-2009-0031, Important)

* a deficiency was found in the Remote BIOS Update (RBU) driver for Dell systems. This could allow a local, unprivileged user to cause a denial of service by reading zero bytes from the image_type or packet_size file in '/sys/devices/platform/dell_rbu/'. (CVE-2009-0322, Important)

* a deficiency was found in the libATA implementation. This could, potentially, lead to a denial of service. Note: by default, '/dev/sg*' devices are accessible only to the root user. (CVE-2008-5700, Low)

This update also fixes the following bugs :

* when the hypervisor changed a page table entry (pte) mapping from read-only to writable via a make_writable hypercall, accessing the changed page immediately following the change caused a spurious page fault. When trying to install a para-virtualized Red Hat Enterprise Linux 4 guest on a Red Hat Enterprise Linux 5.3 dom0 host, this fault crashed the installer with a kernel backtrace. With this update, the 'spurious' page fault is handled properly. (BZ#483748)

* net_rx_action could detect its cpu poll_list as non-empty, but have that same list reduced to empty by the poll_napi path. This resulted in garbage data being returned when net_rx_action calls list_entry, which subsequently resulted in several possible crash conditions. The race condition in the network code which caused this has been fixed.
(BZ#475970, BZ#479681 & BZ#480741)

* a misplaced memory barrier at unlock_buffer() could lead to a concurrent h_refcounter update which produced a reference counter leak and, later, a double free in ext3_xattr_release_block(). Consequent to the double free, ext3 reported an error

ext3_free_blocks_sb: bit already cleared for block [block number]

and mounted itself as read-only. With this update, the memory barrier is now placed before the buffer head lock bit, forcing the write order and preventing the double free. (BZ#476533)

* when the iptables module was unloaded, it was assumed the correct entry for removal had been found if 'wrapper->ops->pf' matched the value passed in by 'reg->pf'. If several ops ranges were registered against the same protocol family, however, (which was likely if you had both ip_conntrack and ip_contrack_* loaded) this assumption could lead to NULL list pointers and cause a kernel panic. With this update, 'wrapper->ops' is matched to pointer values 'reg', which ensures the correct entry is removed and results in no NULL list pointers.
(BZ#477147)

* when the pidmap page (used for tracking process ids, pids) incremented to an even page (ie the second, fourth, sixth, etc. pidmap page), the alloc_pidmap() routine skipped the page. This resulted in 'holes' in the allocated pids. For example, after pid 32767, you would expect 32768 to be allocated. If the page skipping behavior presented, however, the pid allocated after 32767 was 65536. With this update, alloc_pidmap() no longer skips alternate pidmap pages and allocated pid holes no longer occur. This fix also corrects an error which allowed pid_max to be set higher than the pid_max limit has been corrected. (BZ#479182)

All Red Hat Enterprise Linux 4 users should upgrade to these updated packages, which contain backported patches to resolve these issues.
The system must be rebooted for this update to take effect.

Several vulnerabilities have been discovered in the Linux kernel that may lead to denial of service, privilege escalation, or information leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4307     Bryn M. Reeves reported a denial of service in the NFS     filesystem. Local users can trigger a kernel BUG() due     to a race condition in the do_setlk function.

  - CVE-2008-5395     Helge Deller discovered a denial of service condition     that allows local users on PA-RISC to crash the system     by attempting to unwind a stack containing userspace     addresses.

  - CVE-2008-5701     Vlad Malov reported an issue on 64-bit MIPS where a     local user could cause a system crash by crafting a     malicious binary which makes o32 syscalls with a number     less than 4000.

  - CVE-2008-5702     Zvonimir Rakamaric reported an off-by-one error in the     ib700wdt watchdog driver which allows local users to     cause a buffer underflow by making a specially crafted     WDIOC_SETTIMEOUT ioctl call.

  - CVE-2008-5713     Flavio Leitner discovered that a local user can cause a     denial of service by generating large amounts of traffic     on a large SMP system, resulting in soft lockups.

  - CVE-2009-0028     Chris Evans discovered a situation in which a child     process can send an arbitrary signal to its parent.

  - CVE-2009-0029     Christian Borntraeger discovered an issue effecting the     alpha, mips, powerpc, s390 and sparc64 architectures     that allows local users to cause a denial of service or     potentially gain elevated privileges.

  - CVE-2009-0031     Vegard Nossum discovered a memory leak in the keyctl     subsystem that allows local users to cause a denial of     service by consuming all available kernel memory.

  - CVE-2009-0065     Wei Yongjun discovered a memory overflow in the SCTP     implementation that can be triggered by remote users,     permitting remote code execution.

  - CVE-2009-0322     Pavel Roskin provided a fix for an issue in the dell_rbu     driver that allows a local user to cause a denial of     service (oops) by reading 0 bytes from a sysfs entry.

  - CVE-2009-0675     Roel Kluin discovered inverted logic in the skfddi     driver that permits local, unprivileged users to reset     the driver statistics.

  - CVE-2009-0676     Clement LECIGNE discovered a bug in the sock_getsockopt     function that may result in leaking sensitive kernel     memory.

  - CVE-2009-0834     Roland McGrath discovered an issue on amd64 kernels that     allows local users to circumvent system call audit     configurations which filter based on the syscall numbers     or argument details.

  - CVE-2009-0859     Jiri Olsa discovered that a local user can cause a     denial of service (system hang) using a SHM_INFO shmctl     call on kernels compiled with CONFIG_SHMEM disabled.
    This issue does not affect prebuilt Debian kernels.

  - CVE-2009-1192     Shaohua Li reported an issue in the AGP subsystem that     may allow local users to read sensitive kernel memory     due to a leak of uninitialized memory.

  - CVE-2009-1265     Thomas Pollet reported an overflow in the af_rose     implementation that allows remote attackers to retrieve     uninitialized kernel memory that may contain sensitive     data.

  - CVE-2009-1336     Trond Myklebust reported an issue in the encode_lookup()     function in the nfs server subsystem that allows local     users to cause a denial of service (oops in     encode_lookup()) by use of a long filename.

  - CVE-2009-1337     Oleg Nesterov discovered an issue in the exit_notify     function that allows local users to send an arbitrary     signal to a process by running a program that modifies     the exit_signal field and then uses an exec system call     to launch a setuid application.

  - CVE-2009-1439     Pavan Naregundi reported an issue in the CIFS filesystem     code that allows remote users to overwrite memory via a     long nativeFileSystem field in a Tree Connect response     during mount.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4307     Bryn M. Reeves reported a denial of service in the NFS     filesystem. Local users can trigger a kernel BUG() due     to a race condition in the do_setlk function.

  - CVE-2008-5079     Hugo Dias reported a DoS condition in the ATM subsystem     that can be triggered by a local user by calling the     svc_listen function twice on the same socket and reading     /proc/net/atm/*vc.

  - CVE-2008-5395     Helge Deller discovered a denial of service condition     that allows local users on PA-RISC systems to crash a     system by attempting to unwind a stack containing     userspace addresses.

  - CVE-2008-5700     Alan Cox discovered a lack of minimum timeouts on SG_IO     requests, which allows local users of systems using ATA     to cause a denial of service by forcing drives into PIO     mode.

  - CVE-2008-5701     Vlad Malov reported an issue on 64-bit MIPS systems     where a local user could cause a system crash by crafing     a malicious binary which makes o32 syscalls with a     number less than 4000.

  - CVE-2008-5702     Zvonimir Rakamaric reported an off-by-one error in the     ib700wdt watchdog driver which allows local users to     cause a buffer underflow by making a specially crafted     WDIOC_SETTIMEOUT ioctl call.

  - CVE-2009-0028     Chris Evans discovered a situation in which a child     process can send an arbitrary signal to its parent.

  - CVE-2009-0029     Christian Borntraeger discovered an issue effecting the     alpha, mips, powerpc, s390 and sparc64 architectures     that allows local users to cause a denial of service or     potentially gain elevated privileges.

  - CVE-2009-0031     Vegard Nossum discovered a memory leak in the keyctl     subsystem that allows local users to cause a denial of     service by consuming all of kernel memory.

  - CVE-2009-0065     Wei Yongjun discovered a memory overflow in the SCTP     implementation that can be triggered by remote users,     permitting remote code execution.

  - CVE-2009-0269     Duane Griffin provided a fix for an issue in the     eCryptfs subsystem which allows local users to cause a     denial of service (fault or memory corruption).

  - CVE-2009-0322     Pavel Roskin provided a fix for an issue in the dell_rbu     driver that allows a local user to cause a denial of     service (oops) by reading 0 bytes from a sysfs entry.

  - CVE-2009-0675     Roel Kluin discovered inverted logic in the skfddi     driver that permits local, unprivileged users to reset     the driver statistics.

  - CVE-2009-0676     Clement LECIGNE discovered a bug in the sock_getsockopt     function that may result in leaking sensitive kernel     memory.

  - CVE-2009-0745     Peter Kerwien discovered an issue in the ext4 filesystem     that allows local users to cause a denial of service     (kernel oops) during a resize operation.

  - CVE-2009-0834     Roland McGrath discovered an issue on amd64 kernels that     allows local users to circumvent system call audit     configurations which filter based on the syscall numbers     or argument details.

  - CVE-2009-0859     Jiri Olsa discovered that a local user can cause a     denial of service (system hang) using a SHM_INFO shmctl     call on kernels compiled with CONFIG_SHMEM disabled.
    This issue does not affect prebuilt Debian kernels.

  - CVE-2009-1046     Mikulas Patocka reported an issue in the console     subsystem that allows a local user to cause memory     corruption by selecting a small number of 3-byte UTF-8     characters.

  - CVE-2009-1192     Shaohua Li reported an issue in the AGP subsystem that     may allow local users to read sensitive kernel memory     due to a leak of uninitialized memory.

  - CVE-2009-1242     Benjamin Gilbert reported a local denial of service     vulnerability in the KVM VMX implementation that allows     local users to trigger an oops.

  - CVE-2009-1265     Thomas Pollet reported an overflow in the af_rose     implementation that allows remote attackers to retrieve     uninitialized kernel memory that may contain sensitive     data.

  - CVE-2009-1337     Oleg Nesterov discovered an issue in the exit_notify     function that allows local users to send an arbitrary     signal to a process by running a program that modifies     the exit_signal field and then uses an exec system call     to launch a setuid application.

  - CVE-2009-1338     Daniel Hokka Zakrisson discovered that a kill(-1) is     permitted to reach processes outside of the current     process namespace.

  - CVE-2009-1439     Pavan Naregundi reported an issue in the CIFS filesystem     code that allows remote users to overwrite memory via a     long nativeFileSystem field in a Tree Connect response     during mount.

NFS did not correctly handle races between fcntl and interrupts. A local attacker on an NFS mount could consume unlimited kernel memory, leading to a denial of service. Ubuntu 8.10 was not affected.
(CVE-2008-4307)

Sparc syscalls did not correctly check mmap regions. A local attacker could cause a system panic, leading to a denial of service. Ubuntu 8.10 was not affected. (CVE-2008-6107)

In certain situations, cloned processes were able to send signals to parent processes, crossing privilege boundaries. A local attacker could send arbitrary signals to parent processes, leading to a denial of service. (CVE-2009-0028)

The kernel keyring did not free memory correctly. A local attacker could consume unlimited kernel memory, leading to a denial of service.
(CVE-2009-0031)

The SCTP stack did not correctly validate FORWARD-TSN packets. A remote attacker could send specially crafted SCTP traffic causing a system crash, leading to a denial of service. (CVE-2009-0065)

The eCryptfs filesystem did not correctly handle certain VFS return codes. A local attacker with write-access to an eCryptfs filesystem could cause a system crash, leading to a denial of service.
(CVE-2009-0269)

The Dell platform device did not correctly validate user parameters. A local attacker could perform specially crafted reads to crash the system, leading to a denial of service. (CVE-2009-0322)

The page fault handler could consume stack memory. A local attacker could exploit this to crash the system or gain root privileges with a Kprobe registered. Only Ubuntu 8.10 was affected. (CVE-2009-0605)

Network interfaces statistics for the SysKonnect FDDI driver did not check capabilities. A local user could reset statistics, potentially interfering with packet accounting systems. (CVE-2009-0675)

The getsockopt function did not correctly clear certain parameters. A local attacker could read leaked kernel memory, leading to a loss of privacy. (CVE-2009-0676)

The ext4 filesystem did not correctly clear group descriptors when resizing. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2009-0745)

The ext4 filesystem did not correctly validate certain fields. A local attacker could mount a malicious ext4 filesystem, causing a system crash, leading to a denial of service. (CVE-2009-0746, CVE-2009-0747, CVE-2009-0748)

The syscall interface did not correctly validate parameters when crossing the 64-bit/32-bit boundary. A local attacker could bypass certain syscall restricts via crafted syscalls. (CVE-2009-0834, CVE-2009-0835)

The shared memory subsystem did not correctly handle certain shmctl calls when CONFIG_SHMEM was disabled. Ubuntu kernels were not vulnerable, since CONFIG_SHMEM is enabled by default. (CVE-2009-0859)

The virtual consoles did not correctly handle certain UTF-8 sequences.
A local attacker on the physical console could exploit this to cause a system crash, leading to a denial of service. (CVE-2009-1046).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0029     Christian Borntraeger discovered an issue effecting the     alpha, mips, powerpc, s390 and sparc64 architectures     that allows local users to cause a denial of service or     potentially gain elevated privileges.

  - CVE-2009-0031     Vegard Nossum discovered a memory leak in the keyctl     subsystem that allows local users to cause a denial of     service by consuming all of kernel memory.

  - CVE-2009-0065     Wei Yongjun discovered a memory overflow in the SCTP     implementation that can be triggered by remote users.

  - CVE-2009-0269     Duane Griffin provided a fix for an issue in the     eCryptfs subsystem which allows local users to cause a     denial of service (fault or memory corruption).

  - CVE-2009-0322     Pavel Roskin provided a fix for an issue in the dell_rbu     driver that allows a local user to cause a denial of     service (oops) by reading 0 bytes from a sysfs entry.

  - CVE-2009-0676     Clement LECIGNE discovered a bug in the sock_getsockopt     function that may result in leaking sensitive kernel     memory.

  - CVE-2009-0675     Roel Kluin discovered inverted logic in the skfddi     driver that permits local, unprivileged users to reset     the driver statistics.

  - CVE-2009-0745     Peter Kerwien discovered an issue in the ext4 filesystem     that allows local users to cause a denial of service     (kernel oops) during a resize operation.

  - CVE-2009-0746     Sami Liedes reported an issue in the ext4 filesystem     that allows local users to cause a denial of service     (kernel oops) when accessing a specially crafted corrupt     filesystem.

  - CVE-2009-0747     David Maciejak reported an issue in the ext4 filesystem     that allows local users to cause a denial of service     (kernel oops) when mounting a specially crafted corrupt     filesystem.

  - CVE-2009-0748     David Maciejak reported an additional issue in the ext4     filesystem that allows local users to cause a denial of     service (kernel oops) when mounting a specially crafted     corrupt filesystem.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0331 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update addresses the following security issues:

    * a buffer overflow was found in the Linux kernel Partial Reliable Stream     Control Transmission Protocol (PR-SCTP) implementation. This could,     potentially, lead to a denial of service if a Forward-TSN chunk is received     with a large stream ID. (CVE-2009-0065, Important)

    * a memory leak was found in keyctl handling. A local, unprivileged user     could use this flaw to deplete kernel memory, eventually leading to a     denial of service. (CVE-2009-0031, Important)

    * a deficiency was found in the Remote BIOS Update (RBU) driver for Dell     systems. This could allow a local, unprivileged user to cause a denial of     service by reading zero bytes from the image_type or packet_size file in     /sys/devices/platform/dell_rbu/. (CVE-2009-0322, Important)

    * a deficiency was found in the libATA implementation. This could,     potentially, lead to a denial of service. Note: by default, /dev/sg*     devices are accessible only to the root user. (CVE-2008-5700, Low)

    This update also fixes the following bugs:

    * when the hypervisor changed a page table entry (pte) mapping from     read-only to writable via a make_writable hypercall, accessing the changed     page immediately following the change caused a spurious page fault. When     trying to install a para-virtualized Red Hat Enterprise Linux 4 guest on a     Red Hat Enterprise Linux 5.3 dom0 host, this fault crashed the installer     with a kernel backtrace. With this update, the spurious page fault is     handled properly. (BZ#483748)

    * net_rx_action could detect its cpu poll_list as non-empty, but have that     same list reduced to empty by the poll_napi path. This resulted in garbage     data being returned when net_rx_action calls list_entry, which subsequently     resulted in several possible crash conditions. The race condition in the     network code which caused this has been fixed. (BZ#475970, BZ#479681,     BZ#480741)

    * a misplaced memory barrier at unlock_buffer() could lead to a concurrent     h_refcounter update which produced a reference counter leak and, later, a     double free in ext3_xattr_release_block(). Consequent to the double free,     ext3 reported an error

        ext3_free_blocks_sb: bit already cleared for block [block number]

    and mounted itself as read-only. With this update, the memory barrier is     now placed before the buffer head lock bit, forcing the write order and     preventing the double free. (BZ#476533)

    * when the iptables module was unloaded, it was assumed the correct entry     for removal had been found if wrapper->ops->pf matched the value passed     in by reg->pf. If several ops ranges were registered against the same     protocol family, however, (which was likely if you had both ip_conntrack     and ip_contrack_* loaded) this assumption could lead to NULL list pointers     and cause a kernel panic. With this update, wrapper->ops is matched to     pointer values reg, which ensures the correct entry is removed and     results in no NULL list pointers. (BZ#477147)

    * when the pidmap page (used for tracking process ids, pids) incremented to     an even page (ie the second, fourth, sixth, etc. pidmap page), the     alloc_pidmap() routine skipped the page. This resulted in holes in the     allocated pids. For example, after pid 32767, you would expect 32768 to be     allocated. If the page skipping behavior presented, however, the pid     allocated after 32767 was 65536. With this update, alloc_pidmap() no longer     skips alternate pidmap pages and allocated pid holes no longer occur. This     fix also corrects an error which allowed pid_max to be set higher than the     pid_max limit has been corrected. (BZ#479182)

    All Red Hat Enterprise Linux 4 users should upgrade to these updated     packages, which contain backported patches to resolve these issues. The     system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that resolve several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update addresses the following security issues :

* a memory leak in keyctl handling. A local user could use this flaw to deplete kernel memory, eventually leading to a denial of service.
(CVE-2009-0031, Important)

* a buffer overflow in the Linux kernel Partial Reliable Stream Control Transmission Protocol (PR-SCTP) implementation. This could, potentially, lead to a denial of service if a Forward-TSN chunk is received with a large stream ID. (CVE-2009-0065, Important)

* a flaw when handling heavy network traffic on an SMP system with many cores. An attacker who could send a large amount of network traffic could create a denial of service. (CVE-2008-5713, Important)

* the code for the HFS and HFS Plus (HFS+) file systems failed to properly handle corrupted data structures. This could, potentially, lead to a local denial of service. (CVE-2008-4933, CVE-2008-5025, Low)

* a flaw was found in the HFS Plus (HFS+) file system implementation.
This could, potentially, lead to a local denial of service when write operations are performed. (CVE-2008-4934, Low)

In addition, these updated packages fix the following bugs :

* when using the nfsd daemon in a clustered setup, kernel panics appeared seemingly at random. These panics were caused by a race condition in the device-mapper mirror target.

* the clock_gettime(CLOCK_THREAD_CPUTIME_ID, ) syscall returned a smaller timespec value than the result of previous clock_gettime() function execution, which resulted in a negative, and nonsensical, elapsed time value.

* nfs_create_rpc_client was called with a 'flavor' parameter which was usually ignored and ended up unconditionally creating the RPC client with an AUTH_UNIX flavor. This caused problems on AUTH_GSS mounts when the credentials needed to be refreshed. The credops did not match the authorization type, which resulted in the credops dereferencing an incorrect part of the AUTH_UNIX rpc_auth struct.

* when copy_user_c terminated prematurely due to reading beyond the end of the user buffer and the kernel jumped to the exception table entry, the rsi register was not cleared. This resulted in exiting back to user code with garbage in the rsi register.

* the hexdump data in s390dbf traces was incomplete. The length of the data traced was incorrect and the SAN payload was read from a different place then it was written to.

* when using connected mode (CM) in IPoIB on ehca2 hardware, it was not possible to transmit any data.

* when an application called fork() and pthread_create() many times and, at some point, a thread forked a child and then attempted to call the setpgid() function, then this function failed and returned and ESRCH error value.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. Note: for this update to take effect, the system must be rebooted.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2009-0331.

ID	Name	Product	Family	Severity
67814	Oracle Linux 4 : kernel (ELSA-2009-0331)	Nessus	Oracle Linux Local Security Checks	critical
67800	Oracle Linux 5 : kernel (ELSA-2009-0264)	Nessus	Oracle Linux Local Security Checks	medium
60543	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
60532	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43730	CentOS 4 : kernel (CESA-2009:0331)	Nessus	CentOS Local Security Checks	critical
38722	Debian DSA-1794-1 : linux-2.6 - denial of service/privilege escalation/information leak	Nessus	Debian Local Security Checks	critical
38668	Debian DSA-1787-1 : linux-2.6.24 - denial of service/privilege escalation/information leak	Nessus	Debian Local Security Checks	critical
37337	Ubuntu 7.10 / 8.04 LTS / 8.10 : linux, linux-source-2.6.22 vulnerabilities (USN-751-1)	Nessus	Ubuntu Local Security Checks	critical
35987	Debian DSA-1749-1 : linux-2.6 - denial of service/privilege escalation/sensitive memory leak	Nessus	Debian Local Security Checks	critical
35919	RHEL 4 : kernel (RHSA-2009:0331)	Nessus	Red Hat Local Security Checks	medium
35645	RHEL 5 : kernel (RHSA-2009:0264)	Nessus	Red Hat Local Security Checks	critical
801467	CentOS RHSA-2009-0331 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2009-0031

medium

Tenable Plugins

critical

medium

critical

critical

critical

critical

critical

critical

critical

medium

critical

high