RHSA-2005:366 - Security Advisory

Topic

Updated kernel packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

[Updated 9 August 2005]
The advisory text has been updated to show that this update fixed the
security issue named CAN-2005-0210 but not CAN-2005-0209. The issue
CAN-2005-0209 was actually fixed by RHSA-2005:420. No changes have been
made to the packages associated with this advisory.

Description

The Linux kernel handles the basic functions of the operating system.

A flaw in the fib_seq_start function was discovered. A local user could use
this flaw to cause a denial of service (system crash) via /proc/net/route.
(CAN-2005-1041)

A flaw in the tmpfs file system was discovered. A local user could use this
flaw to cause a denial of service (system crash). (CAN-2005-0977)

An integer overflow flaw was found when writing to a sysfs file. A local
user could use this flaw to overwrite kernel memory, causing a denial of
service (system crash) or arbitrary code execution. (CAN-2005-0867)

Keith Owens reported a flaw in the Itanium unw_unwind_to_user function. A
local user could use this flaw to cause a denial of service (system crash)
on Itanium architectures. (CAN-2005-0135)

A flaw in the NFS client O_DIRECT error case handling was discovered. A
local user could use this flaw to cause a denial of service (system crash).
(CAN-2005-0207)

A small memory leak when defragmenting local packets was discovered that
affected the Linux 2.6 kernel netfilter subsystem. A local user could send
a large number of carefully crafted fragments leading to memory exhaustion
(CAN-2005-0210)

A flaw was discovered in the Linux PPP driver. On systems allowing remote
users to connect to a server using ppp, a remote client could cause a
denial of service (system crash). (CAN-2005-0384)

A flaw was discovered in the ext2 file system code. When a new directory is
created, the ext2 block written to disk is not initialized, which could
lead to an information leak if a disk image is made available to
unprivileged users. (CAN-2005-0400)

A flaw in fragment queuing was discovered that affected the Linux kernel
netfilter subsystem. On systems configured to filter or process network
packets (e.g. firewalling), a remote attacker could send a carefully
crafted set of fragmented packets to a machine and cause a denial of
service (system crash). In order to sucessfully exploit this flaw, the
attacker would need to know or guess some aspects of the firewall ruleset
on the target system. (CAN-2005-0449)

A number of flaws were found in the Linux 2.6 kernel. A local user could
use these flaws to read kernel memory or cause a denial of service (crash).
(CAN-2005-0529, CAN-2005-0530, CAN-2005-0531)

An integer overflow in sys_epoll_wait in eventpoll.c was discovered. A
local user could use this flaw to overwrite low kernel memory. This memory
is usually unused, not usually resulting in a security consequence.
(CAN-2005-0736)

A flaw when freeing a pointer in load_elf_library was discovered. A local
user could potentially use this flaw to cause a denial of service (crash).
(CAN-2005-0749)

A flaw was discovered in the bluetooth driver system. On systems where the
bluetooth modules are loaded, a local user could use this flaw to gain
elevated (root) privileges. (CAN-2005-0750)

A race condition was discovered that affected the Radeon DRI driver. A
local user who has DRI privileges on a Radeon graphics card may be able to
use this flaw to gain root privileges. (CAN-2005-0767)

Multiple range checking flaws were discovered in the iso9660 file system
handler. An attacker could create a malicious file system image which would
cause a denial or service or potentially execute arbitrary code if mounted.
(CAN-2005-0815)

A flaw was discovered when setting line discipline on a serial tty. A local
user may be able to use this flaw to inject mouse movements or keystrokes
when another user is logged in. (CAN-2005-0839)

Red Hat Enterprise Linux 4 users are advised to upgrade their kernels
to the packages associated with their machine architectures and
configurations as listed in this erratum.

Please note that

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 147468 - CAN-2005-0449 Possible remote Oops/firewall bypass - kABI breaker
• BZ - 148868 - CAN-2005-0135 ia64 local DoS
• BZ - 148878 - CAN-2005-0207 nfs client O_DIRECT oops
• BZ - 149466 - CAN-2005-0529 Sign handling issues on v2.6 (CAN-2005-0530 CAN-2005-0531)
• BZ - 149589 - CAN-2005-0209 netfilter SKB problem
• BZ - 151240 - CAN-2005-0384 pppd remote DoS
• BZ - 151249 - CAN-2005-0736 epoll overflow
• BZ - 151902 - CAN-2005-0767 drm race in radeon
• BZ - 152177 - CAN-2005-0750 bluetooth security flaw
• BZ - 152399 - CAN-2005-0400 ext2 mkdir() directory entry random kernel memory leak
• BZ - 152405 - CAN-2005-0815 isofs range checking flaws
• BZ - 152410 - CAN-2005-0749 load_elf_library possible DoS
• BZ - 152417 - CAN-2005-0839 N_MOUSE line discipline flaw
• BZ - 152561 - CAN-2005-0977 tmpfs truncate bug
• BZ - 154219 - CAN-2005-0867 sysfs signedness problem
• BZ - 154551 - CAN-2005-1041 crash while reading /proc/net/route

CVEs

• CVE-2005-0210
• CVE-2005-0400
• CVE-2005-0815
• CVE-2005-0749
• CVE-2005-0135
• CVE-2005-0207
• CVE-2005-0384
• CVE-2005-0449
• CVE-2005-0529
• CVE-2005-0530
• CVE-2005-0531
• CVE-2005-0736
• CVE-2005-0750
• CVE-2005-0767
• CVE-2005-0839
• CVE-2005-0867
• CVE-2005-0977
• CVE-2005-1041

References

(none)