This kernel update fixes the following security problems :

CVE-2008-1615: On x86_64 a denial of service attack could be used by local attackers to immediately panic / crash the machine.

CVE-2008-2358: A security problem in DCCP was fixed, which could be used by remote attackers to crash the machine.

CVE-2007-6206: An information leakage during coredumping of root processes was fixed.

CVE-2007-6712: A integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.

CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine.

CVE-2008-1669: Fixed a SMP ordering problem in fcntl_setlk could potentially allow local attackers to execute code by timing file locking.

CVE-2008-1367: Clear the 'direction' flag before calling signal handlers. For specific not yet identified programs under specific timing conditions this could potentially have caused memory corruption or code execution.

CVE-2008-1375: Fixed a dnotify race condition, which could be used by local attackers to potentially execute code.

CVE-2007-6282: A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets (default filtered by the firewall).

CVE-2007-5500: A ptrace bug could be used by local attackers to hang their own processes indefinitely.

CVE-2007-5904: A remote buffer overflow in CIFS was fixed which could be used by remote attackers to crash the machine or potentially execute code.

And the following bugs (numbers are https://bugzilla.novell.com/ references) :

  - patches.arch/x86-nosmp-implies-noapic.patch: When     booting with nosmp or maxcpus=0 on i386 or x86-64, we     must disable the I/O APIC, otherwise the system won't     boot in most cases (bnc#308540).

  - patches.arch/i386-at-sysinfo-ehdr: i386: make     AT_SYSINFO_EHDR consistent with AT_SYSINFO (bnc#289641).

  - patches.suse/bonding-workqueue: Update to fix a hang     when closing a bonding device (342994).

  - patches.fixes/mptspi-dv-renegotiate-oops: mptlinux     crashes on kernel 2.6.22 (bnc#271749).

The minix filesystem did not properly validate certain filesystem values. If a local attacker could trick the system into attempting to mount a corrupted minix filesystem, the kernel could be made to hang for long periods of time, resulting in a denial of service.
(CVE-2006-6058)

Alexander Schulze discovered that the skge driver does not properly use the spin_lock and spin_unlock functions. Remote attackers could exploit this by sending a flood of network traffic and cause a denial of service (crash). (CVE-2006-7229)

Hugh Dickins discovered that hugetlbfs performed certain prio_tree calculations using HPAGE_SIZE instead of PAGE_SIZE. A local user could exploit this and cause a denial of service via kernel panic.
(CVE-2007-4133)

Chris Evans discovered an issue with certain drivers that use the ieee80211_rx function. Remote attackers could send a crafted 802.11 frame and cause a denial of service via crash. (CVE-2007-4997)

Alex Smith discovered an issue with the pwc driver for certain webcam devices. A local user with physical access to the system could remove the device while a userspace application had it open and cause the USB subsystem to block. (CVE-2007-5093)

Scott James Remnant discovered a coding error in ptrace. Local users could exploit this and cause the kernel to enter an infinite loop.
(CVE-2007-5500)

Venustech AD-LAB discovered a buffer overflow in the isdn net subsystem. This issue is exploitable by local users via crafted input to the isdn_ioctl function. (CVE-2007-6063)

It was discovered that the isdn subsystem did not properly check for NULL termination when performing ioctl handling. A local user could exploit this to cause a denial of service. (CVE-2007-6151)

Blake Frantz discovered that when a root process overwrote an existing core file, the resulting core file retained the previous core file's ownership. Local users could exploit this to gain access to sensitive information. (CVE-2007-6206)

Hugh Dickins discovered the when using the tmpfs filesystem, under rare circumstances, a kernel page may be improperly cleared. A local user may be able to exploit this and read sensitive kernel data or cause a denial of service via crash. (CVE-2007-6417)

Bill Roman discovered that the VFS subsystem did not properly check access modes. A local user may be able to gain removal privileges on directories. (CVE-2008-0001).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-2731     infamous41md reported multiple integer overflows in the     Sbus PROM driver that would allow for a DoS (Denial of     Service) attack by a local user, and possibly the     execution of arbitrary code.

  - CVE-2006-4814     Doug Chapman discovered a potential local DoS (deadlock)     in the mincore function caused by improper lock     handling.

  - CVE-2006-5753     Eric Sandeen provided a fix for a local memory     corruption vulnerability resulting from a     misinterpretation of return values when operating on     inodes which have been marked bad.

  - CVE-2006-5823     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted cramfs filesystem.

  - CVE-2006-6053     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext3 filesystem.

  - CVE-2006-6054     LMH reported a potential local DoS which could be     exploited by a malicious user with the privileges to     mount and read a corrupted ext2 filesystem.

  - CVE-2006-6106     Marcel Holtman discovered multiple buffer overflows in     the Bluetooth subsystem which can be used to trigger a     remote DoS (crash) and potentially execute arbitrary     code.

  - CVE-2007-1353     Ilja van Sprundel discovered that kernel memory could be     leaked via the Bluetooth setsockopt call due to an     uninitialized stack buffer. This could be used by local     attackers to read the contents of sensitive kernel     memory.

  - CVE-2007-1592     Masayuki Nakagawa discovered that flow labels were     inadvertently being shared between listening sockets and     child sockets. This defect can be exploited by local     users to cause a DoS (Oops).

  - CVE-2007-2172     Thomas Graf reported a typo in the DECnet protocol     handler that could be used by a local attacker to     overrun an array via crafted packets, potentially     resulting in a Denial of Service (system crash). A     similar issue exists in the IPV4 protocol handler and     will be fixed in a subsequent update.

  - CVE-2007-2525     Florian Zumbiehl discovered a memory leak in the PPPOE     subsystem caused by releasing a socket before     PPPIOCGCHAN is called upon it. This could be used by a     local user to DoS a system by consuming all available     memory.

  - CVE-2007-3848     Wojciech Purczynski discovered that pdeath_signal was     not being reset properly under certain conditions which     may allow local users to gain privileges by sending     arbitrary signals to suid binaries.

  - CVE-2007-4308     Alan Cox reported an issue in the aacraid driver that     allows unprivileged local users to make ioctl calls     which should be restricted to admin privileges.

  - CVE-2007-4311     PaX team discovered an issue in the random driver where     a defect in the reseeding code leads to a reduction in     entropy.

  - CVE-2007-5093     Alex Smith discovered an issue with the pwc driver for     certain webcam devices. If the device is removed while a     userspace application has it open, the driver will wait     for userspace to close the device, resulting in a     blocked USB subsystem. This issue is of low security     impact as it requires the attacker to either have     physical access to the system or to convince a user with     local access to remove the device on their behalf.

  - CVE-2007-6063     Venustech AD-LAB discovered a a buffer overflow in the     isdn ioctl handling, exploitable by a local user.

  - CVE-2007-6151     ADLAB discovered a possible memory overrun in the ISDN     subsystem that may permit a local user to overwrite     kernel memory by issuing ioctls with unterminated data.

  - CVE-2007-6206     Blake Frantz discovered that when a core file owned by a     non-root user exists, and a root-owned process dumps     core over it, the core file retains its original     ownership. This could be used by a local user to gain     access to sensitive information.

  - CVE-2007-6694     Cyrill Gorcunov reported a NULL pointer dereference in     code specific to the CHRP PowerPC platforms. Local users     could exploit this issue to achieve a Denial of Service     (DoS).

  - CVE-2008-0007     Nick Piggin of SuSE discovered a number of issues in     subsystems which register a fault handler for memory     mapped areas. This issue can be exploited by local users     to achieve a Denial of Service (DoS) and possibly     execute arbitrary code.

The following matrix lists additional packages that were rebuilt for compatibility with or to take advantage of this update :

                              Debian 3.1 (sarge)             alsa-modules-i386            1.0.8+2sarge2                  kernel-image-2.4.27-arm      2.4.27-2sarge6                 kernel-image-2.4.27-m68k     2.4.27-3sarge6                 kernel-image-speakup-i386    2.4.27-1.1sarge5               kernel-image-2.4.27-alpha    2.4.27-10sarge6                kernel-image-2.4.27-s390     2.4.27-2sarge6                 kernel-image-2.4.27-sparc    2.4.27-9sarge6                 kernel-image-2.4.27-i386     2.4.27-10sarge6                kernel-image-2.4.27-ia64     2.4.27-10sarge6                kernel-patch-2.4.27-mips     2.4.27-10.sarge4.040815-3      kernel-patch-powerpc-2.4.27  2.4.27-10sarge6                kernel-latest-2.4-alpha      101sarge3                      kernel-latest-2.4-i386       101sarge2                      kernel-latest-2.4-s390       2.4.27-1sarge2                 kernel-latest-2.4-sparc      42sarge3                       i2c                          1:2.9.1-1sarge2                lm-sensors                   1:2.9.1-1sarge4                mindi-kernel                 2.4.27-2sarge5                 pcmcia-modules-2.4.27-i386   3.2.5+2sarge2                  hostap-modules-i386          1:0.3.7-1sarge3                systemimager                 3.2.3-6sarge5

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
33252	openSUSE 10 Security Update : kernel (kernel-5336)	Nessus	SuSE Local Security Checks	2008/6/24	2021/1/14	high
31093	Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerabilities (USN-578-1)	Nessus	Ubuntu Local Security Checks	2008/2/14	2021/1/19	high
31147	Debian DSA-1503-1 : kernel-source-2.4.27 - several vulnerabilities	Nessus	Debian Local Security Checks	2008/2/25	2021/1/4	high

检测

插件搜索

high

high

high