The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.

The SUSE Linux Enterprise Server 11 SP1 LTSS received a roll up update to fix several security and non-security issues.

The following security issues have been fixed :

  - CVE-2013-1860: Heap-based buffer overflow in the     wdm_in_callback function in drivers/usb/class/cdc-wdm.c     in the Linux kernel before 3.8.4 allows physically     proximate attackers to cause a denial of service (system     crash) or possibly execute arbitrary code via a crafted     cdc-wdm USB device. (bnc#806431)

  - CVE-2013-4162: The udp_v6_push_pending_frames function     in net/ipv6/udp.c in the IPv6 implementation in the     Linux kernel through 3.10.3 makes an incorrect function     call for pending data, which allows local users to cause     a denial of service (BUG and system crash) via a crafted     application that uses the UDP_CORK option in a     setsockopt system call. (bnc#831058)

  - CVE-2014-0203: The __do_follow_link function in     fs/namei.c in the Linux kernel before 2.6.33 does not     properly handle the last pathname component during use     of certain filesystems, which allows local users to     cause a denial of service (incorrect free operations and     system crash) via an open system call. (bnc#883526)

  - CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2)     BPF_S_ANC_NLATTR_NEST extension implementations in the     sk_run_filter function in net/core/filter.c in the Linux     kernel through 3.14.3 do not check whether a certain     length value is sufficiently large, which allows local     users to cause a denial of service (integer underflow     and system crash) via crafted BPF instructions. NOTE:
    the affected code was moved to the __skb_get_nlattr and
    __skb_get_nlattr_nest functions before the vulnerability     was announced. (bnc#877257)

  - CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension     implementation in the sk_run_filter function in     net/core/filter.c in the Linux kernel through 3.14.3     uses the reverse order in a certain subtraction, which     allows local users to cause a denial of service     (over-read and system crash) via crafted BPF     instructions. NOTE: the affected code was moved to the
    __skb_get_nlattr_nest function before the vulnerability     was announced. (bnc#877257)

  - CVE-2014-3917: kernel/auditsc.c in the Linux kernel     through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with     certain syscall rules, allows local users to obtain     potentially sensitive single-bit values from kernel     memory or cause a denial of service (OOPS) via a large     value of a syscall number. (bnc#880484)

  - CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux     kernel through 3.15.1 on 32-bit x86 platforms, when     syscall auditing is enabled and the sep CPU feature flag     is set, allows local users to cause a denial of service     (OOPS and system crash) via an invalid syscall number,     as demonstrated by number 1000. (bnc#883724)

  - CVE-2014-4652: Race condition in the tlv handler     functionality in the snd_ctl_elem_user_tlv function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 allows local users to     obtain sensitive information from kernel memory by     leveraging /dev/snd/controlCX access. (bnc#883795)

  - CVE-2014-4653: sound/core/control.c in the ALSA control     implementation in the Linux kernel before 3.15.2 does     not ensure possession of a read/write lock, which allows     local users to cause a denial of service     (use-after-free) and obtain sensitive information from     kernel memory by leveraging /dev/snd/controlCX access.
    (bnc#883795)

  - CVE-2014-4654: The snd_ctl_elem_add function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 does not check     authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands,     which allows local users to remove kernel controls and     cause a denial of service (use-after-free and system     crash) by leveraging /dev/snd/controlCX access for an     ioctl call. (bnc#883795)

  - CVE-2014-4655: The snd_ctl_elem_add function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 does not properly     maintain the user_ctl_count value, which allows local     users to cause a denial of service (integer overflow and     limit bypass) by leveraging /dev/snd/controlCX access     for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl     calls. (bnc#883795)

  - CVE-2014-4656: Multiple integer overflows in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 allow local users to     cause a denial of service by leveraging     /dev/snd/controlCX access, related to (1) index values     in the snd_ctl_add function and (2) numid values in the     snd_ctl_remove_numid_conflict function. (bnc#883795)

  - CVE-2014-4667: The sctp_association_free function in     net/sctp/associola.c in the Linux kernel before 3.15.2     does not properly manage a certain backlog value, which     allows remote attackers to cause a denial of service     (socket outage) via a crafted SCTP packet. (bnc#885422)

  - CVE-2014-4699: The Linux kernel before 3.15.4 on Intel     processors does not properly restrict use of a     non-canonical value for the saved RIP address in the     case of a system call that does not use IRET, which     allows local users to leverage a race condition and gain     privileges, or cause a denial of service (double fault),     via a crafted application that makes ptrace and fork     system calls. (bnc#885725)

  - CVE-2014-4943: The PPPoL2TP feature in     net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6     allows local users to gain privileges by leveraging     data-structure differences between an l2tp socket and an     inet socket. (bnc#887082)

  - CVE-2014-5077: The sctp_assoc_update function in     net/sctp/associola.c in the Linux kernel through 3.15.8,     when SCTP authentication is enabled, allows remote     attackers to cause a denial of service (NULL pointer     dereference and OOPS) by starting to establish an     association between two endpoints immediately after an     exchange of INIT and INIT ACK chunks to establish an     earlier association between these endpoints in the     opposite direction. (bnc#889173)

  - CVE-2013-7266: The mISDN_sock_recvmsg function in     drivers/isdn/mISDN/socket.c in the Linux kernel before     3.12.4 does not ensure that a certain length value is     consistent with the size of an associated data     structure, which allows local users to obtain sensitive     information from kernel memory via a (1) recvfrom, (2)     recvmmsg, or (3) recvmsg system call. (bnc#854722)

  - CVE-2013-7267: The atalk_recvmsg function in     net/appletalk/ddp.c in the Linux kernel before 3.12.4     updates a certain length value without ensuring that an     associated data structure has been initialized, which     allows local users to obtain sensitive information from     kernel memory via a (1) recvfrom, (2) recvmmsg, or (3)     recvmsg system call. (bnc#854722)

  - CVE-2013-7268: The ipx_recvmsg function in     net/ipx/af_ipx.c in the Linux kernel before 3.12.4     updates a certain length value without ensuring that an     associated data structure has been initialized, which     allows local users to obtain sensitive information from     kernel memory via a (1) recvfrom, (2) recvmmsg, or (3)     recvmsg system call. (bnc#854722)

  - CVE-2013-7269: The nr_recvmsg function in     net/netrom/af_netrom.c in the Linux kernel before 3.12.4     updates a certain length value without ensuring that an     associated data structure has been initialized, which     allows local users to obtain sensitive information from     kernel memory via a (1) recvfrom, (2) recvmmsg, or (3)     recvmsg system call. (bnc#854722)

  - CVE-2013-7270: The packet_recvmsg function in     net/packet/af_packet.c in the Linux kernel before 3.12.4     updates a certain length value before ensuring that an     associated data structure has been initialized, which     allows local users to obtain sensitive information from     kernel memory via a (1) recvfrom, (2) recvmmsg, or (3)     recvmsg system call. (bnc#854722)

  - CVE-2013-7271: The x25_recvmsg function in     net/x25/af_x25.c in the Linux kernel before 3.12.4     updates a certain length value without ensuring that an     associated data structure has been initialized, which     allows local users to obtain sensitive information from     kernel memory via a (1) recvfrom, (2) recvmmsg, or (3)     recvmsg system call. (bnc#854722)

The following bugs have been fixed :

  - mac80211: Fix AP powersave TX vs. wakeup race     (bnc#871797).

  - tcp: Allow to disable cwnd moderation in TCP_CA_Loss     state (bnc#879921).

  - tcp: Adapt selected parts of RFC 5682 and PRR logic     (bnc#879921).

  - flock: Fix allocation and BKL (bnc#882809).

  - sunrpc: Close a rare race in xs_tcp_setup_socket     (bnc#794824, bnc#884530).

  - isofs: Fix unbounded recursion when processing relocated     directories (bnc#892490).

  - bonding: Fix a race condition on cleanup in     bond_send_unsolicited_na() (bnc#856756).

  - block: Fix race between request completion and timeout     handling (bnc#881051).

  - Fix kABI breakage due to addition of user_ctl_lock     (bnc#883795).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug was discovered in the handling of pathname components when used with an autofs direct mount. A local user could exploit this flaw to cause a denial of service (system crash) via an open system call.
(CVE-2014-0203)

Toralf Forster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508)

An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-4652)

A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-4653)

A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service (remove kernel controls). (CVE-2014-4654)

A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and limit bypass). (CVE-2014-4655)

An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash).
(CVE-2014-4656)

An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a crafted SCTP packet. (CVE-2014-4667)

Jason Gunthorpe reported a flaw with SCTP authentication in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (NULL pointer dereference and OOPS). (CVE-2014-5077).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3043 advisory.

  - The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly     handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger     kfree operations and gain privileges by leveraging write access to a /dev/fd device. (CVE-2014-1737)

  - The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not     properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows     local users to obtain sensitive information from kernel heap memory by leveraging write access to a     /dev/fd device. (CVE-2014-1738)

  - The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through     3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-     length write operation. (CVE-2013-6378)

  - The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before     3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN     capability to set a zero-length security context. (CVE-2014-1874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-3153, Important)

* A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important)

* It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

* It was discovered that the proc_ns_follow_link() function did not properly return the LAST_BIND value in the last pathname component as is expected for procfs symbolic links, which could lead to excessive freeing of memory and consequent slab corruption. A local, unprivileged user could use this flaw to crash the system.
(CVE-2014-0203, Moderate)

* A flaw was found in the way the Linux kernel handled exceptions when user-space applications attempted to use the linkage stack. On IBM S/390 systems, a local, unprivileged user could use this flaw to crash the system. (CVE-2014-2039, Moderate)

* An invalid pointer dereference flaw was found in the Marvell 8xxx Libertas WLAN (libertas) driver in the Linux kernel. A local user able to write to a file that is provided by the libertas driver and located on the debug file system (debugfs) could use this flaw to crash the system. Note: The debugfs file system must be mounted locally to exploit this issue. It is not mounted by default. (CVE-2013-6378, Low)

* A denial of service flaw was discovered in the way the Linux kernel's SELinux implementation handled files with an empty SELinux security context. A local user who has the CAP_MAC_ADMIN capability could use this flaw to crash the system. (CVE-2014-1874, Low)

Red Hat would like to thank Kees Cook of Google for reporting CVE-2014-3153, Matthew Daley for reporting CVE-2014-1737 and CVE-2014-1738, and Vladimir Davydov of Parallels for reporting CVE-2014-0203. Google acknowledges Pinkie Pie as the original reporter of CVE-2014-3153.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

* A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-3153, Important)

* A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important)

* It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

* It was discovered that the proc_ns_follow_link() function did not properly return the LAST_BIND value in the last pathname component as is expected for procfs symbolic links, which could lead to excessive freeing of memory and consequent slab corruption. A local, unprivileged user could use this flaw to crash the system.
(CVE-2014-0203, Moderate)

* A flaw was found in the way the Linux kernel handled exceptions when user-space applications attempted to use the linkage stack. On IBM S/390 systems, a local, unprivileged user could use this flaw to crash the system. (CVE-2014-2039, Moderate)

* An invalid pointer dereference flaw was found in the Marvell 8xxx Libertas WLAN (libertas) driver in the Linux kernel. A local user able to write to a file that is provided by the libertas driver and located on the debug file system (debugfs) could use this flaw to crash the system. Note: The debugfs file system must be mounted locally to exploit this issue. It is not mounted by default. (CVE-2013-6378, Low)

* A denial of service flaw was discovered in the way the Linux kernel's SELinux implementation handled files with an empty SELinux security context. A local user who has the CAP_MAC_ADMIN capability could use this flaw to crash the system. (CVE-2014-1874, Low)

The system must be rebooted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0771 advisory.

    - [kernel] futex: Make lookup_pi_state more robust (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
    - [kernel] futex: Always cleanup owner tid in unlock_pi (Jerome Marchand) [1104516 1104517]     {CVE-2014-3153}
    - [kernel] futex: Validate atomic acquisition in futex_lock_pi_atomic() (Jerome Marchand) [1104516     1104517] {CVE-2014-3153}
    - [kernel] futex: prevent requeue pi on same futex (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
    - [block] floppy: don't write kernel-only members to FDRAWCMD ioctl output (Denys Vlasenko) [1094308     1094310] {CVE-2014-1738 CVE-2014-1737}
    - [block] floppy: ignore kernel-only members in FDRAWCMD ioctl input (Denys Vlasenko) [1094308 1094310]     {CVE-2014-1738 CVE-2014-1737}
    - [fs] vfs: fix autofs/afs/etc magic mountpoint breakage (Frantisek Hrbata) [1094370 1079347]     {CVE-2014-0203}
    - [char] n_tty: Fix n_tty_write crash when echoing in raw mode (Aristeu Rozanski) [1094236 1094237]     {CVE-2014-0196}
    - [security] selinux: Fix kernel BUG on empty security contexts (Paul Moore) [1062502 1064545]     {CVE-2014-1874}
    - [netdrv] libertas: potential oops in debugfs (Denys Vlasenko) [1034176 1034177] {CVE-2013-6378}
    - [s390] fix kernel crash due to linkage stack instructions (Hendrik Brueckner) [1067678 1067679]     {CVE-2014-2039}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
83640	SUSE SLES11 Security Update : kernel (SUSE-SU-2014:1138-1)	Nessus	SuSE Local Security Checks	medium
77489	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2333-1)	Nessus	Ubuntu Local Security Checks	medium
77488	Ubuntu 10.04 LTS : linux vulnerabilities (USN-2332-1)	Nessus	Ubuntu Local Security Checks	medium
76186	Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2014-3043)	Nessus	Oracle Linux Local Security Checks	medium
76170	CentOS 6 : kernel (CESA-2014:0771)	Nessus	CentOS Local Security Checks	medium
76157	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20140619)	Nessus	Scientific Linux Local Security Checks	medium
76156	RHEL 6 : kernel (RHSA-2014:0771)	Nessus	Red Hat Local Security Checks	medium
76155	Oracle Linux 6 : kernel (ELSA-2014-0771)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2014-0203

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high