The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.32.4, when network namespaces are enabled, allows remote attackers to cause a denial of service (NULL pointer dereference) via an invalid IPv6 jumbogram, a related issue to CVE-2007-4567.

Security update: CVE-2010-0003 CVE-2010-0006 CVE-2010-0007

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

stable update for 2.6.31.12, includes fix for CVE-2010-0006 kernel:
ipv6: skb_dst() can be NULL in ipv6_hop_jumbo() (rhbz#555217)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux kernel for openSUSE 11.2 was updated to 2.6.31.12 to fix the following bugs and security issues :

  - The permission of the devtmpfs root directory was     incorrectly 1777 (instead of 755). If it was used, local     attackers could escalate privileges. (openSUSE 11.2 does     not use this filesystem by default). (CVE-2010-0299)

  - The poll_mode_io file for the megaraid_sas driver in the     Linux kernel 2.6.31.6 and earlier has world-writable     permissions, which allows local users to change the I/O     mode of the driver by modifying this file.
    (CVE-2009-3939)

  - ebtables was lacking a CAP_NET_ADMIN check, making it     possible for local unprivileged attackers to modify the     network bridge management. (CVE-2010-0007)

  - An information leakage on fatal signals on x86_64     machines was fixed. (CVE-2010-0003)

  - A race condition in fasync handling could be used by     local attackers to crash the machine or potentially     execute code. (CVE-2009-4141)

  - The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the     Linux kernel before 2.6.32.4, when network namespaces     are enabled, allows remote attackers to cause a denial     of service (NULL pointer dereference) via an invalid     IPv6 jumbogram. (CVE-2010-0006)

  - drivers/net/e1000/e1000_main.c in the e1000 driver in     the Linux kernel 2.6.32.3 and earlier handles Ethernet     frames that exceed the MTU by processing certain     trailing payload data as if it were a complete frame,     which allows remote attackers to bypass packet filters     via a large packet with a crafted payload.
    (CVE-2009-4536)

  - drivers/net/e1000e/netdev.c in the e1000e driver in the     Linux kernel 2.6.32.3 and earlier does not properly     check the size of an Ethernet frame that exceeds the     MTU, which allows remote attackers to have an     unspecified impact via crafted packets. (CVE-2009-4538)

Amerigo Wang and Eric Sesterhenn discovered that the HFS and ext4 filesystems did not correctly check certain disk structures. If a user were tricked into mounting a specially crafted filesystem, a remote attacker could crash the system or gain root privileges.
(CVE-2009-4020, CVE-2009-4308)

It was discovered that FUSE did not correctly check certain requests.
A local attacker with access to FUSE mounts could exploit this to crash the system or possibly gain root privileges. Ubuntu 9.10 was not affected. (CVE-2009-4021)

It was discovered that KVM did not correctly decode certain guest instructions. A local attacker in a guest could exploit this to trigger high scheduling latency in the host, leading to a denial of service. Ubuntu 6.06 was not affected. (CVE-2009-4031)

It was discovered that the OHCI fireware driver did not correctly handle certain ioctls. A local attacker could exploit this to crash the system, or possibly gain root privileges. Ubuntu 6.06 was not affected. (CVE-2009-4138)

Tavis Ormandy discovered that the kernel did not correctly handle O_ASYNC on locked files. A local attacker could exploit this to gain root privileges. Only Ubuntu 9.04 and 9.10 were affected.
(CVE-2009-4141)

Neil Horman and Eugene Teo discovered that the e1000 and e1000e network drivers did not correctly check the size of Ethernet frames.
An attacker on the local network could send specially crafted traffic to bypass packet filters, crash the system, or possibly gain root privileges. (CVE-2009-4536, CVE-2009-4538)

It was discovered that 'print-fatal-signals' reporting could show arbitrary kernel memory contents. A local attacker could exploit this, leading to a loss of privacy. By default this is disabled in Ubuntu and did not affect Ubuntu 6.06. (CVE-2010-0003)

Olli Jarva and Tuomo Untinen discovered that IPv6 did not correctly handle jumbo frames. A remote attacker could exploit this to crash the system, leading to a denial of service. Only Ubuntu 9.04 and 9.10 were affected. (CVE-2010-0006)

Florian Westphal discovered that bridging netfilter rules could be modified by unprivileged users. A local attacker could disrupt network traffic, leading to a denial of service. (CVE-2010-0007)

Al Viro discovered that certain mremap operations could leak kernel memory. A local attacker could exploit this to consume all available memory, leading to a denial of service. (CVE-2010-0291).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
47202	Fedora 11 : kernel-2.6.30.10-105.2.4.fc11 (2010-0919)	Nessus	Fedora Local Security Checks	high
47198	Fedora 12 : kernel-2.6.31.12-174.2.3.fc12 (2010-0823)	Nessus	Fedora Local Security Checks	high
44411	SuSE 11.2 Security Update: kernel (2010-01-28)	Nessus	SuSE Local Security Checks	critical
44399	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : linux, linux-source-2.6.15 vulnerabilities (USN-894-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2010-0006

high

Tenable Plugins

high

high

critical

critical