This update fixes the following security issues :

  - multiple flaws were found in the mmap and mremap     implementations. A local user could use these flaws to     cause a local denial of service or escalate their     privileges. (CVE-2010-0291, Important)

  - a NULL pointer dereference flaw was found in the Fast     Userspace Mutexes (futexes) implementation. The unlock     code path did not check if the futex value associated     with pi_state->owner had been modified. A local user     could use this flaw to modify the futex value, possibly     leading to a denial of service or privilege escalation     when the pi_state->owner pointer is dereferenced.
    (CVE-2010-0622, Important)

  - a NULL pointer dereference flaw was found in the Linux     kernel Network File System (NFS) implementation. A local     user on a system that has an NFS-mounted file system     could use this flaw to cause a denial of service or     escalate their privileges on that system.
    (CVE-2010-1087, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a flaw was found in the Linux kernel Transparent     Inter-Process Communication protocol (TIPC)     implementation. If a client application, on a local     system where the tipc module is not yet in network mode,     attempted to send a message to a remote TIPC node, it     would dereference a NULL pointer on the local system,     causing a kernel panic (denial of service).
    (CVE-2010-1187, Important)

  - a buffer overflow flaw was found in the Linux kernel     Global File System 2 (GFS2) implementation. In certain     cases, a quota could be written past the end of a memory     page, causing memory corruption, leaving the quota     stored on disk in an invalid state. A user with write     access to a GFS2 file system could trigger this flaw to     cause a kernel crash (denial of service) or escalate     their privileges on the GFS2 server. This issue can only     be triggered if the GFS2 file system is mounted with the     'quota=on' or 'quota=account' mount option.
    (CVE-2010-1436, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local user could use this     flaw to cause a kernel panic (denial of service) or     escalate their privileges. (CVE-2010-1437, Important)

  - a flaw was found in the link_path_walk() function in the     Linux kernel. Using the file descriptor returned by the     open() function with the O_NOFOLLOW flag on a     subordinate NFS-mounted file system, could result in a     NULL pointer dereference, causing a denial of service or     privilege escalation. (CVE-2010-1088, Moderate)

  - a missing permission check was found in the     gfs2_set_flags() function in the Linux kernel GFS2     implementation. A local user could use this flaw to     change certain file attributes of files, on a GFS2 file     system, that they do not own. (CVE-2010-1641, Low)

Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting CVE-2010-1641.

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0504 advisory.

    - [fs] gfs2: fix permissions checking for setflags ioctl (Steven Whitehouse) [595580 595399]     {CVE-2010-1641}
    - [misc] keys: do not find already freed keyrings (Vitaly Mayatskikh) [585099 585100] {CVE-2010-1437}
    - [misc] futex: handle futex value corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [misc] futex: handle user space corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [misc] futex: fix fault handling in futex_lock_pi (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [net] sctp: fix skb_over_panic w/too many unknown params (Neil Horman) [584657 584658] {CVE-2010-1173}
    - [mm] keep get_unmapped_area_prot functional (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] switch do_brk to get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] take arch_mmap_check into get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] get rid of open-coding in ia64_brk (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] unify sys_mmap* functions (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] kill ancient cruft in s390 compat mmap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix pgoff in have to relocate case of mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix the arch checks in MREMAP_FIXED case (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix checks for expand-in-place mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] add new vma_expandable helper function (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] move MREMAP_FIXED into its own header (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] move locating vma code and checks on it (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [net] tipc: fix various oopses in uninitialized code (Neil Horman) [578058 558693] {CVE-2010-1187}
    - [fs] vfs: fix LOOKUP_FOLLOW on automount symlinks (Jeff Layton) [567815 567816] {CVE-2010-1088}
    - [nfs] fix an oops when truncating a file (Jeff Layton) [567194 567195] {CVE-2010-1087}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

NOTE: This kernel update marks the final planned kernel security update for the 2.6.18 kernel in the Debian release 'etch'. Although security support for 'etch' officially ended on Feburary 15th, 2010, this update was already in preparation before that date. A final update that includes fixes for these issues in the 2.6.24 kernel is also in preparation and will be released shortly.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3080     Dave Jones reported an issue in the gdth SCSI driver. A     missing check for negative offsets in an ioctl call     could be exploited by local users to create a denial of     service or potentially gain elevated privileges.

  - CVE-2009-3726     Trond Myklebust reported an issue where a malicious NFS     server could cause a denial of service condition on its     clients by returning incorrect attributes during an open     call.

  - CVE-2009-4005     Roel Kluin discovered an issue in the hfc_usb driver, an     ISDN driver for Colognechip HFC-S USB chip. A potential     read overflow exists which may allow remote users to     cause a denial of service condition (oops).

  - CVE-2009-4020     Amerigo Wang discovered an issue in the HFS filesystem     that would allow a denial of service by a local user who     has sufficient privileges to mount a specially crafted     filesystem.

  - CVE-2009-4021     Anana V. Avati discovered an issue in the fuse     subsystem. If the system is sufficiently low on memory,     a local user can cause the kernel to dereference an     invalid pointer resulting in a denial of service (oops)     and potentially an escalation of privileges.

  - CVE-2009-4536     Fabian Yamaguchi reported an issue in the e1000 driver     for Intel gigabit network adapters which allow remote     users to bypass packet filters using specially crafted     ethernet frames.

  - CVE-2010-0007     Florian Westphal reported a lack of capability checking     in the ebtables netfilter subsystem. If the ebtables     module is loaded, local users can add and modify     ebtables rules.

  - CVE-2010-0410     Sebastian Krahmer discovered an issue in the netlink     connector subsystem that permits local users to allocate     large amounts of system memory resulting in a denial of     service (out of memory).

  - CVE-2010-0415     Ramon de Carvalho Valle discovered an issue in the     sys_move_pages interface, limited to amd64, ia64 and     powerpc64 flavors in Debian. Local users can exploit     this issue to cause a denial of service (system crash)     or gain access to sensitive kernel memory.

  - CVE-2010-0622     Jerome Marchand reported an issue in the futex subsystem     that allows a local user to force an invalid futex state     which results in a denial of service (oops).

This update also fixes a regression introduced by a previous security update that caused problems booting on certain s390 systems.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount symlinks, which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW. (CVE-2010-1088)

The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. (CVE-2009-3228)

The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel node set. (CVE-2010-0415)

The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls. (CVE-2009-3620)

The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space. (CVE-2010-0622)

The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
(CVE-2009-2287)

The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level (CPL) before accessing a debug register, which allows guest OS users to cause a denial of service (trap) on the host OS via a crafted application. (CVE-2009-3722)

The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal. (CVE-2009-4308)

The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.
(CVE-2009-2846)

Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.
(CVE-2010-2521)

mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643. (CVE-2008-7256)

The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.
(CVE-2010-1162)

mm/shmem.c in the Linux kernel before 2.6.28-rc3, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. (CVE-2010-1643)

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. (CVE-2010-1173)

The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through 2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference. (CVE-2010-1187)

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. (CVE-2010-1173)

fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions. (CVE-2010-2248)

Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
(CVE-2010-2492)

The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.
(CVE-2010-2226)

The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c. (CVE-2010-2798)

The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server. (CVE-2010-2240)

The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount. (CVE-2010-2803)

Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic. (CVE-2010-2959)

Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device. (CVE-2010-3080)

A vulnerability in Linux kernel caused by insecure allocation of user space memory when translating system call inputs to 64-bit. A stack pointer underflow can occur when using the compat_alloc_user_space method with an arbitrary length input. (CVE-2010-3081)

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression. (CVE-2010-3301)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
60810	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
68056	Oracle Linux 5 : kernel (ELSA-2010-0504)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
44867	Debian DSA-2003-1 : linux-2.6 - privilege escalation/denial of service	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
49795	Mandriva Linux Security Advisory : kernel (MDVSA-2010:198)	Nessus	Mandriva Local Security Checks	2010/10/8	2021/1/6	critical

检测

插件搜索

high

high

high

critical