ID CVE-2006-4538
Summary Linux kernel 2.6.17 and earlier, when running on IA64 or SPARC platforms, allows local users to cause a denial of service (crash) via a malformed ELF file that triggers memory maps that cross region boundaries.
References
Vulnerable Configurations
  • Linux Kernel 2.6.0
    cpe:2.3:o:linux:linux_kernel:2.6.0
  • Linux Kernel 2.6.1
    cpe:2.3:o:linux:linux_kernel:2.6.1
  • Linux Kernel 2.6.1 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.1:rc1
  • Linux Kernel 2.6.1 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.1:rc2
  • Linux Kernel 2.6.1 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.1:rc3
  • Linux Kernel 2.6.2
    cpe:2.3:o:linux:linux_kernel:2.6.2
  • Linux Kernel 2.6.2 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.2:rc1
  • Linux Kernel 2.6.2 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.2:rc2
  • Linux Kernel 2.6.2 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.2:rc3
  • Linux Kernel 2.6.3
    cpe:2.3:o:linux:linux_kernel:2.6.3
  • Linux Kernel 2.6.3 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.3:rc1
  • Linux Kernel 2.6.3 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.3:rc2
  • Linux Kernel 2.6.3 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.3:rc3
  • Linux Kernel 2.6.3 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.3:rc4
  • Linux Kernel 2.6.4
    cpe:2.3:o:linux:linux_kernel:2.6.4
  • Linux Kernel 2.6.4 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.4:rc1
  • Linux Kernel 2.6.4 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.4:rc2
  • Linux Kernel 2.6.4 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.4:rc3
  • Linux Kernel 2.6.5
    cpe:2.3:o:linux:linux_kernel:2.6.5
  • Linux Kernel 2.6.5 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.5:rc1
  • Linux Kernel 2.6.5 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.5:rc2
  • Linux Kernel 2.6.5 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.5:rc3
  • Linux Kernel 2.6.6
    cpe:2.3:o:linux:linux_kernel:2.6.6
  • Linux Kernel 2.6.6 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.6:rc1
  • Linux Kernel 2.6.6 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.6:rc2
  • Linux Kernel 2.6.6 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.6:rc3
  • Linux Kernel 2.6.7
    cpe:2.3:o:linux:linux_kernel:2.6.7
  • Linux Kernel 2.6.7 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.7:rc1
  • Linux Kernel 2.6.7 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.7:rc2
  • Linux Kernel 2.6.7 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.7:rc3
  • Linux Kernel 2.6.8
    cpe:2.3:o:linux:linux_kernel:2.6.8
  • Linux Kernel 2.6.8 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.8:rc1
  • Linux Kernel 2.6.8 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.8:rc2
  • Linux Kernel 2.6.8 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.8:rc3
  • Linux Kernel 2.6.8 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.8:rc4
  • Linux Kernel 2.6.8.1
    cpe:2.3:o:linux:linux_kernel:2.6.8.1
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:386
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:386
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:686
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:686
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:686_smp
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:686_smp
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:amd64
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:amd64
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:amd64_k8
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:amd64_k8
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:amd64_k8_smp
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:amd64_k8_smp
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:amd64_xeon
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:amd64_xeon
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:k7
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:k7
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:k7_smp
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:k7_smp
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:power3
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:power3
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:power3_smp
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:power3_smp
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:power4
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:power4
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:power4_smp
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:power4_smp
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:powerpc
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:powerpc
  • cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:powerpc_smp
    cpe:2.3:o:linux:linux_kernel:2.6.8.1.5:-:powerpc_smp
  • Linux Kernel 2.6.9
    cpe:2.3:o:linux:linux_kernel:2.6.9
  • cpe:2.3:o:linux:linux_kernel:2.6.9:2.6.20
    cpe:2.3:o:linux:linux_kernel:2.6.9:2.6.20
  • Linux Kernel 2.6.9 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.9:rc1
  • Linux Kernel 2.6.9 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.9:rc2
  • Linux Kernel 2.6.9 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.9:rc3
  • Linux Kernel 2.6.9 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.9:rc4
  • Linux Kernel 2.6.10
    cpe:2.3:o:linux:linux_kernel:2.6.10
  • Linux Kernel 2.6.10 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.10:rc1
  • Linux Kernel 2.6.10 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.10:rc2
  • Linux Kernel 2.6.10 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.10:rc3
  • Linux Kernel 2.6.11
    cpe:2.3:o:linux:linux_kernel:2.6.11
  • cpe:2.3:o:linux:linux_kernel:2.6.11:-:x86_64
    cpe:2.3:o:linux:linux_kernel:2.6.11:-:x86_64
  • Linux Kernel 2.6.11 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc1
  • Linux Kernel 2.6.11 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc2
  • Linux Kernel 2.6.11 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc3
  • Linux Kernel 2.6.11 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc4
  • Linux Kernel 2.6.11 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.11:rc5
  • Linux Kernel 2.6.11.1
    cpe:2.3:o:linux:linux_kernel:2.6.11.1
  • Linux Kernel 2.6.11.2
    cpe:2.3:o:linux:linux_kernel:2.6.11.2
  • Linux Kernel 2.6.11.3
    cpe:2.3:o:linux:linux_kernel:2.6.11.3
  • Linux Kernel 2.6.11.4
    cpe:2.3:o:linux:linux_kernel:2.6.11.4
  • Linux Kernel 2.6.11.5
    cpe:2.3:o:linux:linux_kernel:2.6.11.5
  • Linux Kernel 2.6.11.6
    cpe:2.3:o:linux:linux_kernel:2.6.11.6
  • Linux Kernel 2.6.11.7
    cpe:2.3:o:linux:linux_kernel:2.6.11.7
  • Linux Kernel 2.6.11.8
    cpe:2.3:o:linux:linux_kernel:2.6.11.8
  • Linux Kernel 2.6.11.9
    cpe:2.3:o:linux:linux_kernel:2.6.11.9
  • Linux Kernel 2.6.11.10
    cpe:2.3:o:linux:linux_kernel:2.6.11.10
  • Linux Kernel 2.6.11.11
    cpe:2.3:o:linux:linux_kernel:2.6.11.11
  • Linux Kernel 2.6.11.12
    cpe:2.3:o:linux:linux_kernel:2.6.11.12
  • cpe:2.3:o:linux:linux_kernel:2.6.11_rc1_bk6
    cpe:2.3:o:linux:linux_kernel:2.6.11_rc1_bk6
  • Linux Kernel 2.6.12
    cpe:2.3:o:linux:linux_kernel:2.6.12
  • Linux Kernel 2.6.12 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc1
  • Linux Kernel 2.6.12 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc2
  • Linux Kernel 2.6.12 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc3
  • Linux Kernel 2.6.12 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc4
  • Linux Kernel 2.6.12 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc5
  • Linux Kernel 2.6.12 Release Candidate 6
    cpe:2.3:o:linux:linux_kernel:2.6.12:rc6
  • Linux Kernel 2.6.12.1
    cpe:2.3:o:linux:linux_kernel:2.6.12.1
  • Linux Kernel 2.6.12.2
    cpe:2.3:o:linux:linux_kernel:2.6.12.2
  • Linux Kernel 2.6.12.3
    cpe:2.3:o:linux:linux_kernel:2.6.12.3
  • Linux Kernel 2.6.12.4
    cpe:2.3:o:linux:linux_kernel:2.6.12.4
  • Linux Kernel 2.6.12.5
    cpe:2.3:o:linux:linux_kernel:2.6.12.5
  • Linux Kernel 2.6.12.6
    cpe:2.3:o:linux:linux_kernel:2.6.12.6
  • Linux Kernel 2.6.13
    cpe:2.3:o:linux:linux_kernel:2.6.13
  • Linux Kernel 2.6.13 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc1
  • Linux Kernel 2.6.13 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc2
  • Linux Kernel 2.6.13 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc3
  • Linux Kernel 2.6.13 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc4
  • Linux Kernel 2.6.13 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc5
  • Linux Kernel 2.6.13 Release Candidate 6
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc6
  • Linux Kernel 2.6.13 Release Candidate 7
    cpe:2.3:o:linux:linux_kernel:2.6.13:rc7
  • Linux Kernel 2.6.13.1
    cpe:2.3:o:linux:linux_kernel:2.6.13.1
  • Linux Kernel 2.6.13.2
    cpe:2.3:o:linux:linux_kernel:2.6.13.2
  • Linux Kernel 2.6.13.3
    cpe:2.3:o:linux:linux_kernel:2.6.13.3
  • Linux Kernel 2.6.13.4
    cpe:2.3:o:linux:linux_kernel:2.6.13.4
  • Linux Kernel 2.6.14
    cpe:2.3:o:linux:linux_kernel:2.6.14
  • Linux Kernel 2.6.14 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc1
  • Linux Kernel 2.6.14 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc2
  • Linux Kernel 2.6.14 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc3
  • Linux Kernel 2.6.14 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc4
  • Linux Kernel 2.6.14 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.14:rc5
  • Linux Kernel 2.6.14.1
    cpe:2.3:o:linux:linux_kernel:2.6.14.1
  • Linux Kernel 2.6.14.2
    cpe:2.3:o:linux:linux_kernel:2.6.14.2
  • Linux Kernel 2.6.14.3
    cpe:2.3:o:linux:linux_kernel:2.6.14.3
  • Linux Kernel 2.6.14.4
    cpe:2.3:o:linux:linux_kernel:2.6.14.4
  • Linux Kernel 2.6.14.5
    cpe:2.3:o:linux:linux_kernel:2.6.14.5
  • Linux Kernel 2.6.14.6
    cpe:2.3:o:linux:linux_kernel:2.6.14.6
  • Linux Kernel 2.6.14.7
    cpe:2.3:o:linux:linux_kernel:2.6.14.7
  • Linux Kernel 2.6.15
    cpe:2.3:o:linux:linux_kernel:2.6.15
  • Linux Kernel 2.6.15 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc1
  • Linux Kernel 2.6.15 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc2
  • Linux Kernel 2.6.15 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc3
  • Linux Kernel 2.6.15 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc4
  • Linux Kernel 2.6.15 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc5
  • Linux Kernel 2.6.15 Release Candidate 6
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc6
  • Linux Kernel 2.6.15 Release Candidate 7
    cpe:2.3:o:linux:linux_kernel:2.6.15:rc7
  • Linux Kernel 2.6.15.1
    cpe:2.3:o:linux:linux_kernel:2.6.15.1
  • Linux Kernel 2.6.15.2
    cpe:2.3:o:linux:linux_kernel:2.6.15.2
  • Linux Kernel 2.6.15.3
    cpe:2.3:o:linux:linux_kernel:2.6.15.3
  • Linux Kernel 2.6.15.4
    cpe:2.3:o:linux:linux_kernel:2.6.15.4
  • Linux Kernel 2.6.15.5
    cpe:2.3:o:linux:linux_kernel:2.6.15.5
  • Linux Kernel 2.6.15.6
    cpe:2.3:o:linux:linux_kernel:2.6.15.6
  • Linux Kernel 2.6.15.7
    cpe:2.3:o:linux:linux_kernel:2.6.15.7
  • Linux Kernel 2.6.16
    cpe:2.3:o:linux:linux_kernel:2.6.16
  • Linux Kernel 2.6.16 Release Candidate 1
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc1
  • Linux Kernel 2.6.16 Release Candidate 2
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc2
  • Linux Kernel 2.6.16 Release Candidate 3
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc3
  • Linux Kernel 2.6.16 Release Candidate 4
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc4
  • Linux Kernel 2.6.16 Release Candidate 5
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc5
  • Linux Kernel 2.6.16 Release Candidate 6
    cpe:2.3:o:linux:linux_kernel:2.6.16:rc6
  • Linux Kernel 2.6.16.1
    cpe:2.3:o:linux:linux_kernel:2.6.16.1
  • Linux Kernel 2.6.16.2
    cpe:2.3:o:linux:linux_kernel:2.6.16.2
  • Linux Kernel 2.6.16.3
    cpe:2.3:o:linux:linux_kernel:2.6.16.3
  • Linux Kernel 2.6.16.4
    cpe:2.3:o:linux:linux_kernel:2.6.16.4
  • Linux Kernel 2.6.16.5
    cpe:2.3:o:linux:linux_kernel:2.6.16.5
  • Linux Kernel 2.6.16.6
    cpe:2.3:o:linux:linux_kernel:2.6.16.6
  • Linux Kernel 2.6.16.7
    cpe:2.3:o:linux:linux_kernel:2.6.16.7
  • Linux Kernel 2.6.16.8
    cpe:2.3:o:linux:linux_kernel:2.6.16.8
  • Linux Kernel 2.6.16.9
    cpe:2.3:o:linux:linux_kernel:2.6.16.9
  • Linux Kernel 2.6.16.10
    cpe:2.3:o:linux:linux_kernel:2.6.16.10
  • Linux Kernel 2.6.16.11
    cpe:2.3:o:linux:linux_kernel:2.6.16.11
  • Linux Kernel 2.6.16.12
    cpe:2.3:o:linux:linux_kernel:2.6.16.12
  • Linux Kernel 2.6.16.13
    cpe:2.3:o:linux:linux_kernel:2.6.16.13
  • Linux Kernel 2.6.16.14
    cpe:2.3:o:linux:linux_kernel:2.6.16.14
  • Linux Kernel 2.6.16.15
    cpe:2.3:o:linux:linux_kernel:2.6.16.15
  • Linux Kernel 2.6.16.16
    cpe:2.3:o:linux:linux_kernel:2.6.16.16
  • Linux Kernel 2.6.16.17
    cpe:2.3:o:linux:linux_kernel:2.6.16.17
  • Linux Kernel 2.6.16.18
    cpe:2.3:o:linux:linux_kernel:2.6.16.18
  • Linux Kernel 2.6.16.19
    cpe:2.3:o:linux:linux_kernel:2.6.16.19
  • Linux Kernel 2.6.16.20
    cpe:2.3:o:linux:linux_kernel:2.6.16.20
  • Linux Kernel 2.6.16.21
    cpe:2.3:o:linux:linux_kernel:2.6.16.21
  • Linux Kernel 2.6.16.22
    cpe:2.3:o:linux:linux_kernel:2.6.16.22
  • Linux Kernel 2.6.16.23
    cpe:2.3:o:linux:linux_kernel:2.6.16.23
  • Linux Kernel 2.6.16.24
    cpe:2.3:o:linux:linux_kernel:2.6.16.24
  • Linux Kernel 2.6.16.27
    cpe:2.3:o:linux:linux_kernel:2.6.16.27
  • cpe:2.3:o:linux:linux_kernel:2.6.16_rc7
    cpe:2.3:o:linux:linux_kernel:2.6.16_rc7
  • Linux Kernel 2.6.17
    cpe:2.3:o:linux:linux_kernel:2.6.17
CVSS
Base: 4.9 (as of 05-09-2006 - 15:38)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
nessus via4
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20071203_KERNEL_ON_SL3.NASL
    description A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important) A flaw was found in the IPv4 forwarding base. This allowed a local user to cause a denial of service. (CVE-2007-2172, Important) A flaw was found where a corrupted executable file could cause cross-region memory mappings on Itanium systems. This allowed a local user to cause a denial of service. (CVE-2006-4538, Moderate) A flaw was found in the stack expansion when using the hugetlb kernel on PowerPC systems. This allowed a local user to cause a denial of service. (CVE-2007-3739, Moderate) A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver that should be restricted to privileged users. (CVE-2007-4308, Moderate) As well, these updated packages fix the following bug : - a bug in the TCP header prediction code may have caused 'TCP: Treason uncloaked!' messages to be logged. In certain situations this may have lead to TCP connections hanging or aborting.
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60321
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60321
    title Scientific Linux Security Update : kernel on SL3.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0014.NASL
    description From Red Hat Security Advisory 2007:0014 : Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the security issues described below : * a flaw in the get_fdb_entries function of the network bridging support that allowed a local user to cause a denial of service (crash) or allow a potential privilege escalation (CVE-2006-5751, Important) * an information leak in the _block_prepare_write function that allowed a local user to read kernel memory (CVE-2006-4813, Important) * an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read kernel memory (CVE-2006-5174, Important) * a flaw in the handling of /proc/net/ip6_flowlabel that allowed a local user to cause a denial of service (infinite loop) (CVE-2006-5619, Important) * a flaw in the AIO handling that allowed a local user to cause a denial of service (panic) (CVE-2006-5754, Important) * a race condition in the mincore system core that allowed a local user to cause a denial of service (system hang) (CVE-2006-4814, Moderate) * a flaw in the ELF handling on ia64 and sparc architectures which triggered a cross-region memory mapping and allowed a local user to cause a denial of service (CVE-2006-4538, Moderate) * a flaw in the dev_queue_xmit function of the network subsystem that allowed a local user to cause a denial of service (data corruption) (CVE-2006-6535, Moderate) * a flaw in the handling of CAPI messages over Bluetooth that allowed a remote system to cause a denial of service or potential code execution. This flaw is only exploitable if a privileged user establishes a connection to a malicious remote device (CVE-2006-6106, Moderate) * a flaw in the listxattr system call that allowed a local user to cause a denial of service (data corruption) or potential privilege escalation. To successfully exploit this flaw the existence of a bad inode is required first (CVE-2006-5753, Moderate) * a flaw in the __find_get_block_slow function that allowed a local privileged user to cause a denial of service (CVE-2006-5757, Low) * various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service (CVE-2006-5823, CVE-2006-6053, CVE-2006-6054, CVE-2006-6056, Low) In addition to the security issues described above, fixes for the following bugs were included : * initialization error of the tg3 driver with some BCM5703x network card * a memory leak in the audit subsystem * x86_64 nmi watchdog timeout is too short * ext2/3 directory reads fail intermittently Red Hat would like to thank Dmitriy Monakhov and Kostantin Khorenko for reporting issues fixed in this erratum. All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67438
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67438
    title Oracle Linux 4 : kernel (ELSA-2007-0014)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-2397.NASL
    description This kernel update fixes the following security problems : - CVE-2006-4145: A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226] - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - CVE-2006-4623: A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429] - CVE-2006-3741: A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269] - CVE-2006-4538: A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822] - CVE-2006-4997: A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383] CVE-2006-5757/ - CVE-2006-6060: A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384] - CVE-2006-5173: On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386] - CVE-2006-5174: On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880] - CVE-2006-5619: A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590] - CVE-2006-5648: On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295] - CVE-2006-5649: On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295] - CVE-2006-5823: A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237] - CVE-2006-6053: A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288] - CVE-2006-6056: Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230] - CVE-2006-4572: Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313] - CVE-2006-5751: An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656] Additionaly this kernel catches up to the SLE 10 state of the kernel, with massive additional fixes.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27291
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27291
    title openSUSE 10 Security Update : kernel (kernel-2397)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1233.NASL
    description Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-3741 Stephane Eranian discovered a local DoS (Denial of Service) vulnerability on the ia64 architecture. A local user could exhaust the available file descriptors by exploiting a counting error in the permonctl() system call. - CVE-2006-4538 Kirill Korotaev reported a local DoS (Denial of Service) vulnerability on the ia64 and sparc architectures. A user could cause the system to crash by executing a malformed ELF binary due to insufficient verification of the memory layout. - CVE-2006-4813 Dmitriy Monakhov reported a potential memory leak in the __block_prepare_write function. __block_prepare_write does not properly sanitize kernel buffers during error recovery, which could be exploited by local users to gain access to sensitive kernel memory. - CVE-2006-4997 ADLab Venustech Info Ltd reported a potential remote DoS (Denial of Service) vulnerability in the IP over ATM subsystem. A remote system could cause the system to crash by sending specially crafted packets that would trigger an attempt to free an already-freed pointer resulting in a system crash. - CVE-2006-5174 Martin Schwidefsky reported a potential leak of sensitive information on s390 systems. The copy_from_user function did not clear the remaining bytes of the kernel buffer after receiving a fault on the userspace address, resulting in a leak of uninitialized kernel memory. A local user could exploit this by appending to a file from a bad address. - CVE-2006-5619 James Morris reported a potential local DoS (Denial of Service) vulnerability that could be used to hang or oops a system. The seqfile handling for /proc/net/ip6_flowlabel has a flaw that can be exploited to cause an infinite loop by reading this file after creating a flowlabel. - CVE-2006-5649 Fabio Massimo Di Nitto reported a potential remote DoS (Denial of Service) vulnerability on powerpc systems. The alignment exception only checked the exception table for -EFAULT, not for other errors. This can be exploited by a local user to cause a system crash (panic). - CVE-2006-5751 Eugene Teo reported a vulnerability in the get_fdb_entries function that could potentially be exploited to allow arbitrary code execution with escalated privileges. - CVE-2006-5871 Bill Allombert reported that various mount options are ignored by smbfs when UNIX extensions are enabled. This includes the uid, gid and mode options. Client systems would silently use the server-provided settings instead of honoring these options, changing the security model. This update includes a fix from Haroldo Gamal that forces the kernel to honor these mount options. Note that, since the current versions of smbmount always pass values for these options to the kernel, it is not currently possible to activate unix extensions by omitting mount options. However, this behavior is currently consistent with the current behavior of the next Debian release, 'etch'.
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 23846
    published 2006-12-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=23846
    title Debian DSA-1233-1 : kernel-source-2.6.8 - several vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-DEBUG-2393.NASL
    description This kernel update fixes the following security problems : - A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226]. (CVE-2006-4145) - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429]. (CVE-2006-4623) - A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269]. (CVE-2006-3741) - A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822]. (CVE-2006-4538) - A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383]. (CVE-2006-4997) CVE-2006-5757/ - A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384]. (CVE-2006-6060) - On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386]. (CVE-2006-5173) - On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880]. (CVE-2006-5174) - A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590]. (CVE-2006-5619) - On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295]. (CVE-2006-5648) - On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295]. (CVE-2006-5649) - A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237]. (CVE-2006-5823) - A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288]. (CVE-2006-6053) - Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230]. (CVE-2006-6056) - Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313]. (CVE-2006-4572) - An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656]. (CVE-2006-5751) and the following non security bugs : - patches.fixes/dm-bio_list_merge-fix.diff: device-mapper snapshot: bio_list fix [#117435] - patches.fixes/statd-refcount-fix: Fix refcounting problems in host management in lockd. [#148009] - patches.fixes/i8042-reentry: Prevents i8042_interrupt() from being reentered. [#167187] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - patches.arch/i386-profile-pc: i386: Account spinlocks to the caller during profiling for !FP kernels [#176770] - patches.arch/add-user-mode: i386/x86-64: Add user_mode checks to profile_pc for oprofile [#176770] - patches.drivers/aic7xxx-max-sectors-adjust: Adjust .max_sectors to 8192 for aic7xxx [#177059] - patches.xen/xen-x86-dcr-fallback: Add fallback when XENMEM_exchange fails to replace contiguous region [#181869] - patches.suse/lkcd-support-large-minor-number: LKCD should support minor numbers > 256 [#185125] - patches.fixes/scsi-scan-limit-luns-seqscan-16k: Limit sequential scan to 16k LUNs [#185164] - patches.drivers/powernow-ext-mask: Handle extended powernow vid mask properly [#185654] - patches.fixes/xfs-unlink-recovery-fix: [XFS] unlink recovery fix. ([#185796] - patches.suse/lkcd-dont-lose-one-page: Fix incorrect dumps on machines with memory holes [#186169] - patches.fixes/ieee80211-orinoco_ap_workaround.diff: ieee80211: workaround for broken Orinoco access points [#186879] - patches.fixes/sched-group-exclusive: Fix scheduler crash with exclusive cpusets [#188921] - patches.fixes/bdev-imapping-race.diff: Fix race between sync_single_inode() and iput() [#188950] - patches.fixes/scsi-scan-blist-update: Update blacklist entries for EMC Symmetrix and HP EVA [#191648] - patches.arch/ia64-mce-output: Save/restore oops_in_progress around printing machine checks [#191901] - patches.fixes/scsi-add-device-oops-during-eh: Fix Oops in scsi_add_device during EH [#195050] - Included a set of fixes for [#195940] - patches.fixes/dm-fix-alloc_dev-error_path.patch: call free_minor in alloc_dev error path. patches.fixes/dm-snapshot-fix-origin_write-pe-submission .patch: fix origin_write pending_exception submission. - patches.fixes/dm-snapshot-replace-sibling-list.patch: replace sibling list. - patches.fixes/dm-snapshot-fix-pending-pe-ref.patch: fix references to pending pe. - patches.fixes/dm-snapshot-fix-invalidation.patch: fix invalidation. - patches.fixes/dm-kcopyd-error-accumulation-fix.patch: kcopyd should accumulate errors. patches.fixes/dm-snapshot-fix-metadata-error-handling.patch: fix read_metadata error handling. patches.fixes/dm-snapshot-fix-metadata-writing-when-suspending.patch: fix metadata writing when suspending. - patches.fixes/nat-t-pskb-pull.patch: Fix NAT-T VPN with certain ethernet chips, in particular recent e1000 chips. [#196747] - patches.drivers/e1000-update: Update so that we no longer break the 'Disable Packet Split for PCI express adapters' driver option. - patches.fixes/e1000-no-packet-split: Discard, no longer needed. - patches.arch/acpi_T60_ultrabay.patch: Add T60 ACPI dock station path to ibm_acpi module [#196884] - patches.fixes/acpi_battery_hotplug_fix.patch: Workaround ACPI misdesign to recon dock station when booting undocked. - patches.fixes/acpi_ibm_dock_fix_not_present.patch: Workaround ACPI misdesign to recon dock station when booting undocked [#196884] - patches.arch/x86_64-monotonic-clock: Fix monotonic clock on x86-64 [#197548] - patches.fixes/nfs-truncate-race: Fix a race when truncating over NFS and writing via mmap [#198023] - patches.drivers/libata-no-spindown-on-shutdown: Don't spindown SCSI disks when rebooting [#198687] - patches.drivers/qla2xxx-reset-fix: allow reset for qla2xxx via sg_reset [#200325] - kabi/s390/symvers-default: Update kABI symbols [#202134] - patches.suse/bond_alb_deadlock_fix: bonding: fix deadlock on high loads in bond_alb_monitor(). [#202512] - patches.arch/i386-fix-tsc-selection: Fix TSC timer selection on i386 [#203713] - patches.drivers/aic94xx-remove-flash-manfid-reliance: Remove reliance on the FLASH MANFID [#203768] - patches.fixes/xfs-kern-205110-xfs_dio_locking: Fix ABBA deadlock between i_mutex and iolock [#205110] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - add patches.fixes/fix-incorrect-hugepage-interleaving.patch fix NUMA interleaving for huge pages [#205268] - patches.suse/bondalb-hashtbl.patch: fix hang in bonding ALB driver. [#206629] patches.drivers/usb-add-raritan-kvm-usb-dongle-to-the-hi d_quirk_noget-blacklist.patch: USB: add Raritan KVM USB Dongle to the HID_QUIRK_NOGET blacklist [#206932] - patches.arch/ia64-mca_asm-set_kernel_registers: [IA64] set ar.fpsr on MCA/INIT kernel entry. [#206967] - patches.fixes/md-bitmap-ffz: Use ffz instead of find_first_set to convert multiplier to shift. [#207679] - patches.fixes/md-bitmap-compat-ioctl: Allow SET_BITMAP_FILE to work on 64bit kernel with 32bit userspace. [#207688] - patches.drivers/mpt-rport-stall: Fix MPT oops during aborting commands [#207768] - patches.drivers/libata-jmicron-update: Fix handling of JMicron controller [#207939] - patches.arch/i386-mmconfig-flush: arch/i386/pci/mmconfig.c tlb flush fix [#208414] - patches.fixes/scsi-fix-req-page-count: scsi_lib.c: properly count the number of pages in scsi_req_map_sg() [#208782] - patches.fixes/fix-processor-placement.diff: sched: Fix longstanding load balancing bug in the scheduler [#209460]. - patches.arch/x86_64-fpu-corruption: Fix FPU corruption [#209903] - patches.drivers/qla1280-bus-reset-handling: performance slowdown after bus reset on qla12160 HBA [#213717] - patches.drivers/qla1280-scb-timeout: qla1280 times out on long operations such as tape rewind [#214695] - patches.fixes/slab-per-cpu-data: Make slab initialization use per cpu data of correction CPU [#216316] - patches.fixes/ocfs2-network-send-lock.diff: ocfs2: introduce sc->sc_send_lock to protect outbound network messages [#216912] - marked module megaraid_sas as supported - marked module jsm as supported [#218969] - patches.suse/ocfs2-13-fix-quorum-work.diff: ocfs2: outstanding scheduled work can oops when quorum is shut down [#220694] - patches.xen/xen-x86_64-agp: add missing header [#222174] [#224170] - patches.fixes/md-rebuild-fix: md: Fix bug where a rebuild of spares, when interrupted by a rebuild, doesn't always get properly completed once the system is back up, leading to filesystem corruption. [#224960]. - patches.fixes/scsi-sdev-initialisation-block-race: SCSI midlayer race: scan vs block/unblock deadlocks sdev [#225770]
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 59162
    published 2012-05-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59162
    title SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2393)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-060.NASL
    description Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The 2.6.17 kernel and earlier, when running on IA64 and SPARC platforms would allow a local user to cause a DoS (crash) via a malformed ELF file (CVE-2006-4538). The mincore function in the Linux kernel did not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock (CVE-2006-4814). An unspecified vulnerability in the listxattr system call, when a 'bad inode' is present, could allow a local user to cause a DoS (data corruption) and possibly gain privileges via unknown vectors (CVE-2006-5753). The zlib_inflate function allows local users to cause a crash via a malformed filesystem that uses zlib compression that triggers memory corruption (CVE-2006-5823). The ext3fs_dirhash function could allow local users to cause a DoS (crash) via an ext3 stream with malformed data structures (CVE-2006-6053). When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056). The key serial number collision avoidance code in the key_alloc_serial function in kernels 2.6.9 up to 2.6.20 allows local users to cause a crash via vectors thatr trigger a null dereference (CVE-2007-0006). The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772). A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958). The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes. In addition to these security fixes, other fixes have been included such as : - add PCI IDs for cciss driver (HP ML370G5 / DL360G5) - fixed a mssive SCSI reset on megasas (Dell PE2960) - increased port-reset completion delay for HP controllers (HP ML350) - NUMA rnage fixes for x86_64 - various netfilter fixes To update your kernel, please follow the directions located at : http://www.mandriva.com/en/security/kernelupdate
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 24810
    published 2007-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24810
    title Mandrake Linux Security Advisory : kernel (MDKSA-2007:060)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1237.NASL
    description Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4093 Olof Johansson reported a local DoS (Denial of Service) vulnerability on the PPC970 platform. Unprivileged users can hang the system by executing the 'attn' instruction, which was not being disabled at boot. - CVE-2006-4538 Kirill Korotaev reported a local DoS (Denial of Service) vulnerability on the ia64 and sparc architectures. A user could cause the system to crash by executing a malformed ELF binary due to insufficient verification of the memory layout. - CVE-2006-4997 ADLab Venustech Info Ltd reported a potential remote DoS (Denial of Service) vulnerability in the IP over ATM subsystem. A remote system could cause the system to crash by sending specially crafted packets that would trigger an attempt to free an already-freed pointer resulting in a system crash. - CVE-2006-5174 Martin Schwidefsky reported a potential leak of sensitive information on s390 systems. The copy_from_user function did not clear the remaining bytes of the kernel buffer after receiving a fault on the userspace address, resulting in a leak of uninitialized kernel memory. A local user could exploit this by appending to a file from a bad address. - CVE-2006-5649 Fabio Massimo Di Nitto reported a potential remote DoS (Denial of Service) vulnerability on powerpc systems. The alignment exception only checked the exception table for -EFAULT, not for other errors. This can be exploited by a local user to cause a system crash (panic). - CVE-2006-5871 Bill Allombert reported that various mount options are ignored by smbfs when UNIX extensions are enabled. This includes the uid, gid and mode options. Client systems would silently use the server-provided settings instead of honoring these options, changing the security model. This update includes a fix from Haroldo Gamal that forces the kernel to honor these mount options. Note that, since the current versions of smbmount always pass values for these options to the kernel, it is not currently possible to activate unix extensions by omitting mount options. However, this behavior is currently consistent with the current behavior of the next Debian release, 'etch'.
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 23911
    published 2006-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=23911
    title Debian DSA-1237-1 : kernel-source-2.4.27 - several vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-BIGSMP-2399.NASL
    description This kernel update fixes the following security problems : - A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226]. (CVE-2006-4145) - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429]. (CVE-2006-4623) - A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269]. (CVE-2006-3741) - A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822]. (CVE-2006-4538) - A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383]. (CVE-2006-4997) CVE-2006-5757/ - A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384]. (CVE-2006-6060) - On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386]. (CVE-2006-5173) - On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880]. (CVE-2006-5174) - A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590]. (CVE-2006-5619) - On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295]. (CVE-2006-5648) - On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295]. (CVE-2006-5649) - A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237]. (CVE-2006-5823) - A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288]. (CVE-2006-6053) - Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230]. (CVE-2006-6056) - Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313]. (CVE-2006-4572) - An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656]. (CVE-2006-5751) and the following non security bugs : - patches.fixes/dm-bio_list_merge-fix.diff: device-mapper snapshot: bio_list fix [#117435] - patches.fixes/statd-refcount-fix: Fix refcounting problems in host management in lockd. [#148009] - patches.fixes/i8042-reentry: Prevents i8042_interrupt() from being reentered. [#167187] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - patches.arch/i386-profile-pc: i386: Account spinlocks to the caller during profiling for !FP kernels [#176770] - patches.arch/add-user-mode: i386/x86-64: Add user_mode checks to profile_pc for oprofile [#176770] - patches.drivers/aic7xxx-max-sectors-adjust: Adjust .max_sectors to 8192 for aic7xxx [#177059] - patches.xen/xen-x86-dcr-fallback: Add fallback when XENMEM_exchange fails to replace contiguous region [#181869] - patches.suse/lkcd-support-large-minor-number: LKCD should support minor numbers > 256 [#185125] - patches.fixes/scsi-scan-limit-luns-seqscan-16k: Limit sequential scan to 16k LUNs [#185164] - patches.drivers/powernow-ext-mask: Handle extended powernow vid mask properly [#185654] - patches.fixes/xfs-unlink-recovery-fix: [XFS] unlink recovery fix. ([#185796] - patches.suse/lkcd-dont-lose-one-page: Fix incorrect dumps on machines with memory holes [#186169] - patches.fixes/ieee80211-orinoco_ap_workaround.diff: ieee80211: workaround for broken Orinoco access points [#186879] - patches.fixes/sched-group-exclusive: Fix scheduler crash with exclusive cpusets [#188921] - patches.fixes/bdev-imapping-race.diff: Fix race between sync_single_inode() and iput() [#188950] - patches.fixes/scsi-scan-blist-update: Update blacklist entries for EMC Symmetrix and HP EVA [#191648] - patches.arch/ia64-mce-output: Save/restore oops_in_progress around printing machine checks [#191901] - patches.fixes/scsi-add-device-oops-during-eh: Fix Oops in scsi_add_device during EH [#195050] - Included a set of fixes for [#195940] - patches.fixes/dm-fix-alloc_dev-error_path.patch: call free_minor in alloc_dev error path. patches.fixes/dm-snapshot-fix-origin_write-pe-submission .patch: fix origin_write pending_exception submission. - patches.fixes/dm-snapshot-replace-sibling-list.patch: replace sibling list. - patches.fixes/dm-snapshot-fix-pending-pe-ref.patch: fix references to pending pe. - patches.fixes/dm-snapshot-fix-invalidation.patch: fix invalidation. - patches.fixes/dm-kcopyd-error-accumulation-fix.patch: kcopyd should accumulate errors. patches.fixes/dm-snapshot-fix-metadata-error-handling.patch: fix read_metadata error handling. patches.fixes/dm-snapshot-fix-metadata-writing-when-suspending.patch: fix metadata writing when suspending. - patches.fixes/nat-t-pskb-pull.patch: Fix NAT-T VPN with certain ethernet chips, in particular recent e1000 chips. [#196747] - patches.drivers/e1000-update: Update so that we no longer break the 'Disable Packet Split for PCI express adapters' driver option. - patches.fixes/e1000-no-packet-split: Discard, no longer needed. - patches.arch/acpi_T60_ultrabay.patch: Add T60 ACPI dock station path to ibm_acpi module [#196884] - patches.fixes/acpi_battery_hotplug_fix.patch: Workaround ACPI misdesign to recon dock station when booting undocked. - patches.fixes/acpi_ibm_dock_fix_not_present.patch: Workaround ACPI misdesign to recon dock station when booting undocked [#196884] - patches.arch/x86_64-monotonic-clock: Fix monotonic clock on x86-64 [#197548] - patches.fixes/nfs-truncate-race: Fix a race when truncating over NFS and writing via mmap [#198023] - patches.drivers/libata-no-spindown-on-shutdown: Don't spindown SCSI disks when rebooting [#198687] - patches.drivers/qla2xxx-reset-fix: allow reset for qla2xxx via sg_reset [#200325] - kabi/s390/symvers-default: Update kABI symbols [#202134] - patches.suse/bond_alb_deadlock_fix: bonding: fix deadlock on high loads in bond_alb_monitor(). [#202512] - patches.arch/i386-fix-tsc-selection: Fix TSC timer selection on i386 [#203713] - patches.drivers/aic94xx-remove-flash-manfid-reliance: Remove reliance on the FLASH MANFID [#203768] - patches.fixes/xfs-kern-205110-xfs_dio_locking: Fix ABBA deadlock between i_mutex and iolock [#205110] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - add patches.fixes/fix-incorrect-hugepage-interleaving.patch fix NUMA interleaving for huge pages [#205268] - patches.suse/bondalb-hashtbl.patch: fix hang in bonding ALB driver. [#206629] patches.drivers/usb-add-raritan-kvm-usb-dongle-to-the-hi d_quirk_noget-blacklist.patch: USB: add Raritan KVM USB Dongle to the HID_QUIRK_NOGET blacklist [#206932] - patches.arch/ia64-mca_asm-set_kernel_registers: [IA64] set ar.fpsr on MCA/INIT kernel entry. [#206967] - patches.fixes/md-bitmap-ffz: Use ffz instead of find_first_set to convert multiplier to shift. [#207679] - patches.fixes/md-bitmap-compat-ioctl: Allow SET_BITMAP_FILE to work on 64bit kernel with 32bit userspace. [#207688] - patches.drivers/mpt-rport-stall: Fix MPT oops during aborting commands [#207768] - patches.drivers/libata-jmicron-update: Fix handling of JMicron controller [#207939] - patches.arch/i386-mmconfig-flush: arch/i386/pci/mmconfig.c tlb flush fix [#208414] - patches.fixes/scsi-fix-req-page-count: scsi_lib.c: properly count the number of pages in scsi_req_map_sg() [#208782] - patches.fixes/fix-processor-placement.diff: sched: Fix longstanding load balancing bug in the scheduler [#209460]. - patches.arch/x86_64-fpu-corruption: Fix FPU corruption [#209903] - patches.drivers/qla1280-bus-reset-handling: performance slowdown after bus reset on qla12160 HBA [#213717] - patches.drivers/qla1280-scb-timeout: qla1280 times out on long operations such as tape rewind [#214695] - patches.fixes/slab-per-cpu-data: Make slab initialization use per cpu data of correction CPU [#216316] - patches.fixes/ocfs2-network-send-lock.diff: ocfs2: introduce sc->sc_send_lock to protect outbound network messages [#216912] - marked module megaraid_sas as supported - marked module jsm as supported [#218969] - patches.suse/ocfs2-13-fix-quorum-work.diff: ocfs2: outstanding scheduled work can oops when quorum is shut down [#220694] - patches.xen/xen-x86_64-agp: add missing header [#222174] [#224170] - patches.fixes/md-rebuild-fix: md: Fix bug where a rebuild of spares, when interrupted by a rebuild, doesn't always get properly completed once the system is back up, leading to filesystem corruption. [#224960]. - patches.fixes/scsi-sdev-initialisation-block-race: SCSI midlayer race: scan vs block/unblock deadlocks sdev [#225770]
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29490
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29490
    title SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2399)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-1049.NASL
    description From Red Hat Security Advisory 2007:1049 : Updated kernel packages that fix several security issues and a bug in the Red Hat Enterprise Linux 3 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important) A flaw was found in the IPv4 forwarding base. This allowed a local user to cause a denial of service. (CVE-2007-2172, Important) A flaw was found where a corrupted executable file could cause cross-region memory mappings on Itanium systems. This allowed a local user to cause a denial of service. (CVE-2006-4538, Moderate) A flaw was found in the stack expansion when using the hugetlb kernel on PowerPC systems. This allowed a local user to cause a denial of service. (CVE-2007-3739, Moderate) A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver that should be restricted to privileged users. (CVE-2007-4308, Moderate) As well, these updated packages fix the following bug : * a bug in the TCP header prediction code may have caused 'TCP: Treason uncloaked!' messages to be logged. In certain situations this may have lead to TCP connections hanging or aborting. Red Hat Enterprise Linux 3 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67609
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67609
    title Oracle Linux 3 : kernel (ELSA-2007-1049)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-347-1.NASL
    description Sridhar Samudrala discovered a local Denial of Service vulnerability in the handling of SCTP sockets. By opening such a socket with a special SO_LINGER value, a local attacker could exploit this to crash the kernel. (CVE-2006-4535) Kirill Korotaev discovered that the ELF loader on the ia64 and sparc platforms did not sufficiently verify the memory layout. By attempting to execute a specially crafted executable, a local user could exploit this to crash the kernel. (CVE-2006-4538). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 27927
    published 2007-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27927
    title Ubuntu 5.04 / 5.10 / 6.06 LTS : linux-source-2.6.10/-2.6.12/-2.6.15 vulnerabilities (USN-347-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0014.NASL
    description Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the security issues described below : * a flaw in the get_fdb_entries function of the network bridging support that allowed a local user to cause a denial of service (crash) or allow a potential privilege escalation (CVE-2006-5751, Important) * an information leak in the _block_prepare_write function that allowed a local user to read kernel memory (CVE-2006-4813, Important) * an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read kernel memory (CVE-2006-5174, Important) * a flaw in the handling of /proc/net/ip6_flowlabel that allowed a local user to cause a denial of service (infinite loop) (CVE-2006-5619, Important) * a flaw in the AIO handling that allowed a local user to cause a denial of service (panic) (CVE-2006-5754, Important) * a race condition in the mincore system core that allowed a local user to cause a denial of service (system hang) (CVE-2006-4814, Moderate) * a flaw in the ELF handling on ia64 and sparc architectures which triggered a cross-region memory mapping and allowed a local user to cause a denial of service (CVE-2006-4538, Moderate) * a flaw in the dev_queue_xmit function of the network subsystem that allowed a local user to cause a denial of service (data corruption) (CVE-2006-6535, Moderate) * a flaw in the handling of CAPI messages over Bluetooth that allowed a remote system to cause a denial of service or potential code execution. This flaw is only exploitable if a privileged user establishes a connection to a malicious remote device (CVE-2006-6106, Moderate) * a flaw in the listxattr system call that allowed a local user to cause a denial of service (data corruption) or potential privilege escalation. To successfully exploit this flaw the existence of a bad inode is required first (CVE-2006-5753, Moderate) * a flaw in the __find_get_block_slow function that allowed a local privileged user to cause a denial of service (CVE-2006-5757, Low) * various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service (CVE-2006-5823, CVE-2006-6053, CVE-2006-6054, CVE-2006-6056, Low) In addition to the security issues described above, fixes for the following bugs were included : * initialization error of the tg3 driver with some BCM5703x network card * a memory leak in the audit subsystem * x86_64 nmi watchdog timeout is too short * ext2/3 directory reads fail intermittently Red Hat would like to thank Dmitriy Monakhov and Kostantin Khorenko for reporting issues fixed in this erratum. All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 36838
    published 2009-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=36838
    title CentOS 4 : kernel (CESA-2007:0014)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0014.NASL
    description Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the security issues described below : * a flaw in the get_fdb_entries function of the network bridging support that allowed a local user to cause a denial of service (crash) or allow a potential privilege escalation (CVE-2006-5751, Important) * an information leak in the _block_prepare_write function that allowed a local user to read kernel memory (CVE-2006-4813, Important) * an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read kernel memory (CVE-2006-5174, Important) * a flaw in the handling of /proc/net/ip6_flowlabel that allowed a local user to cause a denial of service (infinite loop) (CVE-2006-5619, Important) * a flaw in the AIO handling that allowed a local user to cause a denial of service (panic) (CVE-2006-5754, Important) * a race condition in the mincore system core that allowed a local user to cause a denial of service (system hang) (CVE-2006-4814, Moderate) * a flaw in the ELF handling on ia64 and sparc architectures which triggered a cross-region memory mapping and allowed a local user to cause a denial of service (CVE-2006-4538, Moderate) * a flaw in the dev_queue_xmit function of the network subsystem that allowed a local user to cause a denial of service (data corruption) (CVE-2006-6535, Moderate) * a flaw in the handling of CAPI messages over Bluetooth that allowed a remote system to cause a denial of service or potential code execution. This flaw is only exploitable if a privileged user establishes a connection to a malicious remote device (CVE-2006-6106, Moderate) * a flaw in the listxattr system call that allowed a local user to cause a denial of service (data corruption) or potential privilege escalation. To successfully exploit this flaw the existence of a bad inode is required first (CVE-2006-5753, Moderate) * a flaw in the __find_get_block_slow function that allowed a local privileged user to cause a denial of service (CVE-2006-5757, Low) * various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service (CVE-2006-5823, CVE-2006-6053, CVE-2006-6054, CVE-2006-6056, Low) In addition to the security issues described above, fixes for the following bugs were included : * initialization error of the tg3 driver with some BCM5703x network card * a memory leak in the audit subsystem * x86_64 nmi watchdog timeout is too short * ext2/3 directory reads fail intermittently Red Hat would like to thank Dmitriy Monakhov and Kostantin Khorenko for reporting issues fixed in this erratum. All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 24315
    published 2007-02-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24315
    title RHEL 4 : kernel (RHSA-2007:0014)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-1049.NASL
    description Updated kernel packages that fix several security issues and a bug in the Red Hat Enterprise Linux 3 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important) A flaw was found in the IPv4 forwarding base. This allowed a local user to cause a denial of service. (CVE-2007-2172, Important) A flaw was found where a corrupted executable file could cause cross-region memory mappings on Itanium systems. This allowed a local user to cause a denial of service. (CVE-2006-4538, Moderate) A flaw was found in the stack expansion when using the hugetlb kernel on PowerPC systems. This allowed a local user to cause a denial of service. (CVE-2007-3739, Moderate) A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver that should be restricted to privileged users. (CVE-2007-4308, Moderate) As well, these updated packages fix the following bug : * a bug in the TCP header prediction code may have caused 'TCP: Treason uncloaked!' messages to be logged. In certain situations this may have lead to TCP connections hanging or aborting. Red Hat Enterprise Linux 3 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 29203
    published 2007-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29203
    title RHEL 3 : kernel (RHSA-2007:1049)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-1049.NASL
    description Updated kernel packages that fix several security issues and a bug in the Red Hat Enterprise Linux 3 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important) A flaw was found in the IPv4 forwarding base. This allowed a local user to cause a denial of service. (CVE-2007-2172, Important) A flaw was found where a corrupted executable file could cause cross-region memory mappings on Itanium systems. This allowed a local user to cause a denial of service. (CVE-2006-4538, Moderate) A flaw was found in the stack expansion when using the hugetlb kernel on PowerPC systems. This allowed a local user to cause a denial of service. (CVE-2007-3739, Moderate) A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver that should be restricted to privileged users. (CVE-2007-4308, Moderate) As well, these updated packages fix the following bug : * a bug in the TCP header prediction code may have caused 'TCP: Treason uncloaked!' messages to be logged. In certain situations this may have lead to TCP connections hanging or aborting. Red Hat Enterprise Linux 3 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 29190
    published 2007-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29190
    title CentOS 3 : kernel (CESA-2007:1049)
oval via4
accepted 2013-04-29T04:04:25.354-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Linux kernel 2.6.17 and earlier, when running on IA64 or SPARC platforms, allows local users to cause a denial of service (crash) via a malformed ELF file that triggers memory maps that cross region boundaries.
family unix
id oval:org.mitre.oval:def:10301
status accepted
submitted 2010-07-09T03:56:16-04:00
title Linux kernel 2.6.17 and earlier, when running on IA64 or SPARC platforms, allows local users to cause a denial of service (crash) via a malformed ELF file that triggers memory maps that cross region boundaries.
version 23
redhat via4
advisories
  • rhsa
    id RHSA-2007:0014
  • rhsa
    id RHSA-2007:1049
  • rhsa
    id RHSA-2008:0787
rpms
  • kernel-0:2.6.9-42.0.8.EL
  • kernel-devel-0:2.6.9-42.0.8.EL
  • kernel-doc-0:2.6.9-42.0.8.EL
  • kernel-hugemem-0:2.6.9-42.0.8.EL
  • kernel-hugemem-devel-0:2.6.9-42.0.8.EL
  • kernel-largesmp-0:2.6.9-42.0.8.EL
  • kernel-largesmp-devel-0:2.6.9-42.0.8.EL
  • kernel-smp-0:2.6.9-42.0.8.EL
  • kernel-smp-devel-0:2.6.9-42.0.8.EL
  • kernel-0:2.4.21-53.EL
  • kernel-BOOT-0:2.4.21-53.EL
  • kernel-doc-0:2.4.21-53.EL
  • kernel-hugemem-0:2.4.21-53.EL
  • kernel-hugemem-unsupported-0:2.4.21-53.EL
  • kernel-smp-0:2.4.21-53.EL
  • kernel-smp-unsupported-0:2.4.21-53.EL
  • kernel-source-0:2.4.21-53.EL
  • kernel-unsupported-0:2.4.21-53.EL
refmap via4
bid 19702
confirm
debian
  • DSA-1233
  • DSA-1237
mandriva MDKSA-2007:060
secunia
  • 21967
  • 21999
  • 23370
  • 23395
  • 23474
  • 23997
  • 24206
  • 24482
  • 27913
  • 33280
suse SUSE-SA:2006:079
ubuntu USN-347-1
vupen ADV-2006-3670
Last major update 12-07-2013 - 01:03
Published 05-09-2006 - 15:04
Last modified 30-10-2018 - 12:26
Back to Top