From Red Hat Security Advisory 2008:0237 :

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously execute code, which would otherwise be protected against parallel execution. As well, a race condition when handling locks in the Linux kernel fcntl functionality, may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. (CVE-2008-1669, Important)

* on AMD64 architectures, the possibility of a kernel crash was discovered by testing the Linux kernel process-trace ability. This could allow a local unprivileged user to cause a denial of service (kernel crash). (CVE-2008-1615, Important)

* the absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. This could allow a local unprivileged user to get inconsistent data, or to send arbitrary signals to arbitrary system processes. (CVE-2008-1375, Important)

Red Hat would like to thank Nick Piggin for responsibly disclosing the following issue :

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash.
(CVE-2008-0007, Important)

* the possibility of a kernel crash was found in the Linux kernel IPsec protocol implementation, due to improper handling of fragmented ESP packets. When an attacker controlling an intermediate router fragmented these packets into very small pieces, it would cause a kernel crash on the receiving node during packet reassembly.
(CVE-2007-6282, Important)

* a flaw in the MOXA serial driver could allow a local unprivileged user to perform privileged operations, such as replacing firmware.
(CVE-2005-0504, Important)

As well, these updated packages fix the following bugs :

* multiple buffer overflows in the neofb driver have been resolved. It was not possible for an unprivileged user to exploit these issues, and as such, they have not been handled as security issues.

* a kernel panic, due to inconsistent detection of AGP aperture size, has been resolved.

* a race condition in UNIX domain sockets may have caused 'recv()' to return zero. In clustered configurations, this may have caused unexpected failovers.

* to prevent link storms, network link carrier events were delayed by up to one second, causing unnecessary packet loss. Now, link carrier events are scheduled immediately.

* a client-side race on blocking locks caused large time delays on NFS file systems.

* in certain situations, the libATA sata_nv driver may have sent commands with duplicate tags, which were rejected by SATA devices.
This may have caused infinite reboots.

* running the 'service network restart' command may have caused networking to fail.

* a bug in NFS caused cached information about directories to be stored for too long, causing wrong attributes to be read.

* on systems with a large highmem/lowmem ratio, NFS write performance may have been very slow when using small files.

* a bug, which caused network hangs when the system clock was wrapped around zero, has been resolved.

Red Hat Enterprise Linux 4 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6694     Cyrill Gorcunov reported a NULL pointer dereference in     code specific to the CHRP PowerPC platforms. Local users     could exploit this issue to achieve a Denial of Service     (DoS).

  - CVE-2008-0007     Nick Piggin of SuSE discovered a number of issues in     subsystems which register a fault handler for memory     mapped areas. This issue can be exploited by local users     to achieve a Denial of Service (DoS) and possibly     execute arbitrary code.

  - CVE-2008-1294     David Peer discovered that users could escape     administrator imposed cpu time limitations (RLIMIT_CPU)     by setting a limit of 0.

  - CVE-2008-1375     Alexander Viro discovered a race condition in the     directory notification subsystem that allows local users     to cause a Denial of Service (oops) and possibly result     in an escalation of privileges.

This kernel update brings the kernel to version 2.6.22.16 and fixes the following security problems :

CVE-2008-0007: Insufficient range checks in certain fault handlers could be used by local attackers to potentially read or write kernel memory.

CVE-2008-0001: Incorrect access mode checks could be used by local attackers to corrupt directory contents and so cause denial of service attacks or potentially execute code.

CVE-2007-5966: Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value. NOTE: some of these details are obtained from third-party information.

CVE-2007-3843: The Linux kernel checked the wrong global variable for the CIFS sec mount option, which might allow remote attackers to spoof CIFS network traffic that the client configured for security signatures, as demonstrated by lack of signing despite sec=ntlmv2i in a SetupAndX request.

CVE-2007-6417: The shmem_getpage function (mm/shmem.c) in Linux kernel 2.6.11 through 2.6.23 does not properly clear allocated memory in some rare circumstances, which might allow local users to read sensitive kernel data or cause a denial of service (crash).

And the following bugs (numbers are https://bugzilla.novell.com/ references) :

  - patches.fixes/input-add-amilo-pro-v-to-nomux.patch: Add     Fujitsu-Siemens Amilo Pro 2010 to nomux list (345699).

  - patches.arch/acpica-psd.patch: Changed resolution of     named references in packages     (https://bugzilla.novell.com/show_bug.cgi?id=346831).

  - patches.fixes/acpica_sizeof.patch: SizeOf operator ACPI     interpreter fix     (http://bugzilla.kernel.org/show_bug.cgi?id=9558).

  - patches.drivers/libata-sata_sis-fix-scr-access:
    sata_sis: fix SCR access (331610).

  - patches.drivers/libata-tape-fix: libata: backport tape     support fixes (345438).

  - patches.arch/powernowk8_family_freq_from_fiddid.patch:
    To find the frequency given the fid and did is family     dependent. (#332722).

  - patches.drivers/libata-force-cable-type: libata:
    implement libata.force_cbl parameter (337610).

  - patches.drivers/libata-sata_nv-disable-ADMA: sata_nv:
    disable ADMA by default (346508).

  - patches.fixes/via-velocity-dont-oops-on-mtu-change-1:
    [VIA_VELOCITY]: Don't oops on MTU change. (341537).

  - patches.fixes/via-velocity-dont-oops-on-mtu-change-2:
    via-velocity: don't oops on MTU change while down     (341537).

- patches.fixes/sony-laptop-call-sonypi_compat_init-earlier: s ony-laptop: call sonypi_compat_init earlier (343483).

  - Updated kABI symbols for 2.6.22.15 changes, and Xen     x86_64 changes.

  - series.conf file cleanup: group together latency tracing     patches.

  - Fix a memory leak and a panic in drivers/block/cciss.c     patches.drivers/cciss-panic-in-blk_rq_map_sg: Panic in     blk_rq_map_sg() from CCISS driver.

  - patches.drivers/cciss-fix_memory_leak :

  - Address missed-interrupt issues discovered upstream.

  - Update to 2.6.22.15

  - fixes CVE-2007-5966

  - lots of libata fixes, which cause the following to be     removed :

    -     patches.drivers/libata-add-NCQ-spurious-completion-horka     ges

    -     patches.drivers/libata-add-ST9120822AS-to-NCQ-blacklist

    -     patches.drivers/libata-disable-NCQ-for-ST9160821AS-3.ALD

  - removed patches already in this release :

    -     patches.fixes/i4l-avoid-copying-an-overly-long-string.pa     tch :

  - patches.fixes/ramdisk-2.6.23-corruption_fix.diff

  - patches.fixes/microtek_hal.diff: Delete.

  - fixed previous poweroff regression from 2.6.22.10

  - lots of other fixes and some new pci ids.

  - Thousands of changes in patches.rt/ for the kernel-rt*     kernels.

  - patches.fixes/usb_336850.diff: fix missing quirk leading     to a device disconnecting under load (336850).

  - patches.fixes/nfs-unmount-leak.patch: NFSv2/v3: Fix a     memory leak when using -onolock (336253).

  - add xenfb-module-param patch to make Xen virtual frame     buffer configurable in the guest domains, instead of a     fixed resolution of 800x600.

  - patches.xen/xen3-aux-at_vector_size.patch: Also include     x86-64 (310037).

  - patches.xen/xen3-patch-2.6.18: Fix system lockup     (335121).

  - patches.fixes/acpi_autoload_baydock.patch: autloading of     dock module (302482). Fixed a general bug with linux     specific hids there.

  - patches.xen/xen3-patch-2.6.22.11-12: Linux 2.6.22.12.

  - patches.xen/xen3-fixup-arch-i386: Fix CONFIG_APM=m     issue.

  - patches.xen/xen-x86-no-lapic: Re-diff.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
67685	Oracle Linux 4 : kernel (ELSA-2008-0237)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
32127	Debian DSA-1565-1 : linux-2.6 - several vulnerabilities	Nessus	Debian Local Security Checks	2008/5/2	2021/1/4	high
30144	openSUSE 10 Security Update : kernel (kernel-4943)	Nessus	SuSE Local Security Checks	2008/2/1	2021/1/14	high

检测

插件搜索

high

high

high