ID CVE-2006-4623
Summary The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.
References
Vulnerable Configurations
  • Linux Kernel 2.6.17.8
    cpe:2.3:o:linux:linux_kernel:2.6.17.8
CVSS
Base: 7.8 (as of 12-09-2006 - 09:53)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
nessus via4
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2006-0617.NASL
    description Updated kernel packages that fix security issues are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the security issues described below : From Red Hat Security Advisory 2006-0617 : * a flaw in the proc file system that allowed a local user to use a suid-wrapper for scripts to gain root privileges (CVE-2006-3626, Important) * a flaw in the SCTP implementation that allowed a local user to cause a denial of service (panic) or to possibly gain root privileges (CVE-2006-3745, Important) * a flaw in NFS exported ext2/ext3 partitions when handling invalid inodes that allowed a remote authenticated user to cause a denial of service (filesystem panic) (CVE-2006-3468, Important) * a flaw in the restore_all code path of the 4/4GB split support of non-hugemem kernels that allowed a local user to cause a denial of service (panic) (CVE-2006-2932, Important) * a flaw in IPv4 netfilter handling for the unlikely use of SNMP NAT processing that allowed a remote user to cause a denial of service (crash) or potential memory corruption (CVE-2006-2444, Moderate) * a flaw in the DVD handling of the CDROM driver that could be used together with a custom built USB device to gain root privileges (CVE-2006-2935, Moderate) * a flaw in the handling of O_DIRECT writes that allowed a local user to cause a denial of service (memory consumption) (CVE-2004-2660, Low) * a flaw in the SCTP chunk length handling that allowed a remote user to cause a denial of service (crash) (CVE-2006-1858, Low) * a flaw in the input handling of the ftdi_sio driver that allowed a local user to cause a denial of service (memory consumption) (CVE-2006-2936, Low) In addition a bugfix was added to enable a clean reboot for the IBM Pizzaro machines. Red Hat would like to thank Wei Wang of McAfee Avert Labs and Kirill Korotaev for reporting issues fixed in this erratum. From Red Hat Security Advisory ELSA-2006-0689 : * a flaw in the SCTP support that allowed a local user to cause a denial of service (crash) with a specific SO_LINGER value. (CVE-2006-4535, Important) * a flaw in the hugepage table support that allowed a local user to cause a denial of service (crash). (CVE-2005-4811, Important) * a flaw in the mprotect system call that allowed setting write permission for a read-only attachment of shared memory. (CVE-2006-2071, Moderate) * a flaw in HID0[31] (en_attn) register handling on PowerPC 970 systems that allowed a local user to cause a denial of service. (crash) (CVE-2006-4093, Moderate) * a flaw in the perfmon support of Itanium systems that allowed a local user to cause a denial of service by consuming all file descriptors. (CVE-2006-3741, Moderate) * a flaw in the ATM subsystem. On systems with installed ATM hardware and configured ATM support, a remote user could cause a denial of service (panic) by accessing socket buffers memory after freeing them. (CVE-2006-4997, Moderate) * a flaw in the DVB subsystem. On systems with installed DVB hardware and configured DVB support, a remote user could cause a denial of service (panic) by sending a ULE SNDU packet with length of 0. (CVE-2006-4623, Low) * an information leak in the network subsystem that possibly allowed a local user to read sensitive data from kernel memory. (CVE-2006-0039, Low) In addition, two bugfixes for the IPW-2200 wireless driver were included. The first one ensures that wireless management applications correctly identify IPW-2200 controlled devices, while the second fix ensures that DHCP requests using the IPW-2200 operate correctly. Red Hat would like to thank Olof Johansson, Stephane Eranian and Solar Designer for reporting issues fixed in this erratum.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67401
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67401
    title Oracle Linux 4 : kernel (ELSA-2006-0617 / ELSA-2006-0689)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2006-0689.NASL
    description Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the security issues described below : * a flaw in the SCTP support that allowed a local user to cause a denial of service (crash) with a specific SO_LINGER value. (CVE-2006-4535, Important) * a flaw in the hugepage table support that allowed a local user to cause a denial of service (crash). (CVE-2005-4811, Important) * a flaw in the mprotect system call that allowed setting write permission for a read-only attachment of shared memory. (CVE-2006-2071, Moderate) * a flaw in HID0[31] (en_attn) register handling on PowerPC 970 systems that allowed a local user to cause a denial of service. (crash) (CVE-2006-4093, Moderate) * a flaw in the perfmon support of Itanium systems that allowed a local user to cause a denial of service by consuming all file descriptors. (CVE-2006-3741, Moderate) * a flaw in the ATM subsystem. On systems with installed ATM hardware and configured ATM support, a remote user could cause a denial of service (panic) by accessing socket buffers memory after freeing them. (CVE-2006-4997, Moderate) * a flaw in the DVB subsystem. On systems with installed DVB hardware and configured DVB support, a remote user could cause a denial of service (panic) by sending a ULE SNDU packet with length of 0. (CVE-2006-4623, Low) * an information leak in the network subsystem that possibly allowed a local user to read sensitive data from kernel memory. (CVE-2006-0039, Low) In addition, two bugfixes for the IPW-2200 wireless driver were included. The first one ensures that wireless management applications correctly identify IPW-2200 controlled devices, while the second fix ensures that DHCP requests using the IPW-2200 operate correctly. Red Hat would like to thank Olof Johansson, Stephane Eranian and Solar Designer for reporting issues fixed in this erratum. All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 22523
    published 2006-10-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22523
    title RHEL 4 : kernel (RHSA-2006:0689)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-2397.NASL
    description This kernel update fixes the following security problems : - CVE-2006-4145: A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226] - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - CVE-2006-4623: A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429] - CVE-2006-3741: A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269] - CVE-2006-4538: A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822] - CVE-2006-4997: A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383] CVE-2006-5757/ - CVE-2006-6060: A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384] - CVE-2006-5173: On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386] - CVE-2006-5174: On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880] - CVE-2006-5619: A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590] - CVE-2006-5648: On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295] - CVE-2006-5649: On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295] - CVE-2006-5823: A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237] - CVE-2006-6053: A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288] - CVE-2006-6056: Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230] - CVE-2006-4572: Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313] - CVE-2006-5751: An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656] Additionaly this kernel catches up to the SLE 10 state of the kernel, with massive additional fixes.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27291
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27291
    title openSUSE 10 Security Update : kernel (kernel-2397)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-DEBUG-2393.NASL
    description This kernel update fixes the following security problems : - A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226]. (CVE-2006-4145) - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429]. (CVE-2006-4623) - A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269]. (CVE-2006-3741) - A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822]. (CVE-2006-4538) - A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383]. (CVE-2006-4997) CVE-2006-5757/ - A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384]. (CVE-2006-6060) - On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386]. (CVE-2006-5173) - On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880]. (CVE-2006-5174) - A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590]. (CVE-2006-5619) - On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295]. (CVE-2006-5648) - On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295]. (CVE-2006-5649) - A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237]. (CVE-2006-5823) - A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288]. (CVE-2006-6053) - Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230]. (CVE-2006-6056) - Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313]. (CVE-2006-4572) - An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656]. (CVE-2006-5751) and the following non security bugs : - patches.fixes/dm-bio_list_merge-fix.diff: device-mapper snapshot: bio_list fix [#117435] - patches.fixes/statd-refcount-fix: Fix refcounting problems in host management in lockd. [#148009] - patches.fixes/i8042-reentry: Prevents i8042_interrupt() from being reentered. [#167187] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - patches.arch/i386-profile-pc: i386: Account spinlocks to the caller during profiling for !FP kernels [#176770] - patches.arch/add-user-mode: i386/x86-64: Add user_mode checks to profile_pc for oprofile [#176770] - patches.drivers/aic7xxx-max-sectors-adjust: Adjust .max_sectors to 8192 for aic7xxx [#177059] - patches.xen/xen-x86-dcr-fallback: Add fallback when XENMEM_exchange fails to replace contiguous region [#181869] - patches.suse/lkcd-support-large-minor-number: LKCD should support minor numbers > 256 [#185125] - patches.fixes/scsi-scan-limit-luns-seqscan-16k: Limit sequential scan to 16k LUNs [#185164] - patches.drivers/powernow-ext-mask: Handle extended powernow vid mask properly [#185654] - patches.fixes/xfs-unlink-recovery-fix: [XFS] unlink recovery fix. ([#185796] - patches.suse/lkcd-dont-lose-one-page: Fix incorrect dumps on machines with memory holes [#186169] - patches.fixes/ieee80211-orinoco_ap_workaround.diff: ieee80211: workaround for broken Orinoco access points [#186879] - patches.fixes/sched-group-exclusive: Fix scheduler crash with exclusive cpusets [#188921] - patches.fixes/bdev-imapping-race.diff: Fix race between sync_single_inode() and iput() [#188950] - patches.fixes/scsi-scan-blist-update: Update blacklist entries for EMC Symmetrix and HP EVA [#191648] - patches.arch/ia64-mce-output: Save/restore oops_in_progress around printing machine checks [#191901] - patches.fixes/scsi-add-device-oops-during-eh: Fix Oops in scsi_add_device during EH [#195050] - Included a set of fixes for [#195940] - patches.fixes/dm-fix-alloc_dev-error_path.patch: call free_minor in alloc_dev error path. patches.fixes/dm-snapshot-fix-origin_write-pe-submission .patch: fix origin_write pending_exception submission. - patches.fixes/dm-snapshot-replace-sibling-list.patch: replace sibling list. - patches.fixes/dm-snapshot-fix-pending-pe-ref.patch: fix references to pending pe. - patches.fixes/dm-snapshot-fix-invalidation.patch: fix invalidation. - patches.fixes/dm-kcopyd-error-accumulation-fix.patch: kcopyd should accumulate errors. patches.fixes/dm-snapshot-fix-metadata-error-handling.patch: fix read_metadata error handling. patches.fixes/dm-snapshot-fix-metadata-writing-when-suspending.patch: fix metadata writing when suspending. - patches.fixes/nat-t-pskb-pull.patch: Fix NAT-T VPN with certain ethernet chips, in particular recent e1000 chips. [#196747] - patches.drivers/e1000-update: Update so that we no longer break the 'Disable Packet Split for PCI express adapters' driver option. - patches.fixes/e1000-no-packet-split: Discard, no longer needed. - patches.arch/acpi_T60_ultrabay.patch: Add T60 ACPI dock station path to ibm_acpi module [#196884] - patches.fixes/acpi_battery_hotplug_fix.patch: Workaround ACPI misdesign to recon dock station when booting undocked. - patches.fixes/acpi_ibm_dock_fix_not_present.patch: Workaround ACPI misdesign to recon dock station when booting undocked [#196884] - patches.arch/x86_64-monotonic-clock: Fix monotonic clock on x86-64 [#197548] - patches.fixes/nfs-truncate-race: Fix a race when truncating over NFS and writing via mmap [#198023] - patches.drivers/libata-no-spindown-on-shutdown: Don't spindown SCSI disks when rebooting [#198687] - patches.drivers/qla2xxx-reset-fix: allow reset for qla2xxx via sg_reset [#200325] - kabi/s390/symvers-default: Update kABI symbols [#202134] - patches.suse/bond_alb_deadlock_fix: bonding: fix deadlock on high loads in bond_alb_monitor(). [#202512] - patches.arch/i386-fix-tsc-selection: Fix TSC timer selection on i386 [#203713] - patches.drivers/aic94xx-remove-flash-manfid-reliance: Remove reliance on the FLASH MANFID [#203768] - patches.fixes/xfs-kern-205110-xfs_dio_locking: Fix ABBA deadlock between i_mutex and iolock [#205110] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - add patches.fixes/fix-incorrect-hugepage-interleaving.patch fix NUMA interleaving for huge pages [#205268] - patches.suse/bondalb-hashtbl.patch: fix hang in bonding ALB driver. [#206629] patches.drivers/usb-add-raritan-kvm-usb-dongle-to-the-hi d_quirk_noget-blacklist.patch: USB: add Raritan KVM USB Dongle to the HID_QUIRK_NOGET blacklist [#206932] - patches.arch/ia64-mca_asm-set_kernel_registers: [IA64] set ar.fpsr on MCA/INIT kernel entry. [#206967] - patches.fixes/md-bitmap-ffz: Use ffz instead of find_first_set to convert multiplier to shift. [#207679] - patches.fixes/md-bitmap-compat-ioctl: Allow SET_BITMAP_FILE to work on 64bit kernel with 32bit userspace. [#207688] - patches.drivers/mpt-rport-stall: Fix MPT oops during aborting commands [#207768] - patches.drivers/libata-jmicron-update: Fix handling of JMicron controller [#207939] - patches.arch/i386-mmconfig-flush: arch/i386/pci/mmconfig.c tlb flush fix [#208414] - patches.fixes/scsi-fix-req-page-count: scsi_lib.c: properly count the number of pages in scsi_req_map_sg() [#208782] - patches.fixes/fix-processor-placement.diff: sched: Fix longstanding load balancing bug in the scheduler [#209460]. - patches.arch/x86_64-fpu-corruption: Fix FPU corruption [#209903] - patches.drivers/qla1280-bus-reset-handling: performance slowdown after bus reset on qla12160 HBA [#213717] - patches.drivers/qla1280-scb-timeout: qla1280 times out on long operations such as tape rewind [#214695] - patches.fixes/slab-per-cpu-data: Make slab initialization use per cpu data of correction CPU [#216316] - patches.fixes/ocfs2-network-send-lock.diff: ocfs2: introduce sc->sc_send_lock to protect outbound network messages [#216912] - marked module megaraid_sas as supported - marked module jsm as supported [#218969] - patches.suse/ocfs2-13-fix-quorum-work.diff: ocfs2: outstanding scheduled work can oops when quorum is shut down [#220694] - patches.xen/xen-x86_64-agp: add missing header [#222174] [#224170] - patches.fixes/md-rebuild-fix: md: Fix bug where a rebuild of spares, when interrupted by a rebuild, doesn't always get properly completed once the system is back up, leading to filesystem corruption. [#224960]. - patches.fixes/scsi-sdev-initialisation-block-race: SCSI midlayer race: scan vs block/unblock deadlocks sdev [#225770]
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 59162
    published 2012-05-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59162
    title SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2393)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KERNEL-BIGSMP-2399.NASL
    description This kernel update fixes the following security problems : - A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226]. (CVE-2006-4145) - A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809] - A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429]. (CVE-2006-4623) - A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269]. (CVE-2006-3741) - A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822]. (CVE-2006-4538) - A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383]. (CVE-2006-4997) CVE-2006-5757/ - A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384]. (CVE-2006-6060) - On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386]. (CVE-2006-5173) - On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880]. (CVE-2006-5174) - A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590]. (CVE-2006-5619) - On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295]. (CVE-2006-5648) - On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295]. (CVE-2006-5649) - A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237]. (CVE-2006-5823) - A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288]. (CVE-2006-6053) - Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230]. (CVE-2006-6056) - Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) 'ip6_tables protocol bypass bug' and (2) 'ip6_tables extension header bypass bug'. [#221313]. (CVE-2006-4572) - An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656]. (CVE-2006-5751) and the following non security bugs : - patches.fixes/dm-bio_list_merge-fix.diff: device-mapper snapshot: bio_list fix [#117435] - patches.fixes/statd-refcount-fix: Fix refcounting problems in host management in lockd. [#148009] - patches.fixes/i8042-reentry: Prevents i8042_interrupt() from being reentered. [#167187] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - patches.arch/i386-profile-pc: i386: Account spinlocks to the caller during profiling for !FP kernels [#176770] - patches.arch/add-user-mode: i386/x86-64: Add user_mode checks to profile_pc for oprofile [#176770] - patches.drivers/aic7xxx-max-sectors-adjust: Adjust .max_sectors to 8192 for aic7xxx [#177059] - patches.xen/xen-x86-dcr-fallback: Add fallback when XENMEM_exchange fails to replace contiguous region [#181869] - patches.suse/lkcd-support-large-minor-number: LKCD should support minor numbers > 256 [#185125] - patches.fixes/scsi-scan-limit-luns-seqscan-16k: Limit sequential scan to 16k LUNs [#185164] - patches.drivers/powernow-ext-mask: Handle extended powernow vid mask properly [#185654] - patches.fixes/xfs-unlink-recovery-fix: [XFS] unlink recovery fix. ([#185796] - patches.suse/lkcd-dont-lose-one-page: Fix incorrect dumps on machines with memory holes [#186169] - patches.fixes/ieee80211-orinoco_ap_workaround.diff: ieee80211: workaround for broken Orinoco access points [#186879] - patches.fixes/sched-group-exclusive: Fix scheduler crash with exclusive cpusets [#188921] - patches.fixes/bdev-imapping-race.diff: Fix race between sync_single_inode() and iput() [#188950] - patches.fixes/scsi-scan-blist-update: Update blacklist entries for EMC Symmetrix and HP EVA [#191648] - patches.arch/ia64-mce-output: Save/restore oops_in_progress around printing machine checks [#191901] - patches.fixes/scsi-add-device-oops-during-eh: Fix Oops in scsi_add_device during EH [#195050] - Included a set of fixes for [#195940] - patches.fixes/dm-fix-alloc_dev-error_path.patch: call free_minor in alloc_dev error path. patches.fixes/dm-snapshot-fix-origin_write-pe-submission .patch: fix origin_write pending_exception submission. - patches.fixes/dm-snapshot-replace-sibling-list.patch: replace sibling list. - patches.fixes/dm-snapshot-fix-pending-pe-ref.patch: fix references to pending pe. - patches.fixes/dm-snapshot-fix-invalidation.patch: fix invalidation. - patches.fixes/dm-kcopyd-error-accumulation-fix.patch: kcopyd should accumulate errors. patches.fixes/dm-snapshot-fix-metadata-error-handling.patch: fix read_metadata error handling. patches.fixes/dm-snapshot-fix-metadata-writing-when-suspending.patch: fix metadata writing when suspending. - patches.fixes/nat-t-pskb-pull.patch: Fix NAT-T VPN with certain ethernet chips, in particular recent e1000 chips. [#196747] - patches.drivers/e1000-update: Update so that we no longer break the 'Disable Packet Split for PCI express adapters' driver option. - patches.fixes/e1000-no-packet-split: Discard, no longer needed. - patches.arch/acpi_T60_ultrabay.patch: Add T60 ACPI dock station path to ibm_acpi module [#196884] - patches.fixes/acpi_battery_hotplug_fix.patch: Workaround ACPI misdesign to recon dock station when booting undocked. - patches.fixes/acpi_ibm_dock_fix_not_present.patch: Workaround ACPI misdesign to recon dock station when booting undocked [#196884] - patches.arch/x86_64-monotonic-clock: Fix monotonic clock on x86-64 [#197548] - patches.fixes/nfs-truncate-race: Fix a race when truncating over NFS and writing via mmap [#198023] - patches.drivers/libata-no-spindown-on-shutdown: Don't spindown SCSI disks when rebooting [#198687] - patches.drivers/qla2xxx-reset-fix: allow reset for qla2xxx via sg_reset [#200325] - kabi/s390/symvers-default: Update kABI symbols [#202134] - patches.suse/bond_alb_deadlock_fix: bonding: fix deadlock on high loads in bond_alb_monitor(). [#202512] - patches.arch/i386-fix-tsc-selection: Fix TSC timer selection on i386 [#203713] - patches.drivers/aic94xx-remove-flash-manfid-reliance: Remove reliance on the FLASH MANFID [#203768] - patches.fixes/xfs-kern-205110-xfs_dio_locking: Fix ABBA deadlock between i_mutex and iolock [#205110] - patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196] - add patches.fixes/fix-incorrect-hugepage-interleaving.patch fix NUMA interleaving for huge pages [#205268] - patches.suse/bondalb-hashtbl.patch: fix hang in bonding ALB driver. [#206629] patches.drivers/usb-add-raritan-kvm-usb-dongle-to-the-hi d_quirk_noget-blacklist.patch: USB: add Raritan KVM USB Dongle to the HID_QUIRK_NOGET blacklist [#206932] - patches.arch/ia64-mca_asm-set_kernel_registers: [IA64] set ar.fpsr on MCA/INIT kernel entry. [#206967] - patches.fixes/md-bitmap-ffz: Use ffz instead of find_first_set to convert multiplier to shift. [#207679] - patches.fixes/md-bitmap-compat-ioctl: Allow SET_BITMAP_FILE to work on 64bit kernel with 32bit userspace. [#207688] - patches.drivers/mpt-rport-stall: Fix MPT oops during aborting commands [#207768] - patches.drivers/libata-jmicron-update: Fix handling of JMicron controller [#207939] - patches.arch/i386-mmconfig-flush: arch/i386/pci/mmconfig.c tlb flush fix [#208414] - patches.fixes/scsi-fix-req-page-count: scsi_lib.c: properly count the number of pages in scsi_req_map_sg() [#208782] - patches.fixes/fix-processor-placement.diff: sched: Fix longstanding load balancing bug in the scheduler [#209460]. - patches.arch/x86_64-fpu-corruption: Fix FPU corruption [#209903] - patches.drivers/qla1280-bus-reset-handling: performance slowdown after bus reset on qla12160 HBA [#213717] - patches.drivers/qla1280-scb-timeout: qla1280 times out on long operations such as tape rewind [#214695] - patches.fixes/slab-per-cpu-data: Make slab initialization use per cpu data of correction CPU [#216316] - patches.fixes/ocfs2-network-send-lock.diff: ocfs2: introduce sc->sc_send_lock to protect outbound network messages [#216912] - marked module megaraid_sas as supported - marked module jsm as supported [#218969] - patches.suse/ocfs2-13-fix-quorum-work.diff: ocfs2: outstanding scheduled work can oops when quorum is shut down [#220694] - patches.xen/xen-x86_64-agp: add missing header [#222174] [#224170] - patches.fixes/md-rebuild-fix: md: Fix bug where a rebuild of spares, when interrupted by a rebuild, doesn't always get properly completed once the system is back up, leading to filesystem corruption. [#224960]. - patches.fixes/scsi-sdev-initialisation-block-race: SCSI midlayer race: scan vs block/unblock deadlocks sdev [#225770]
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29490
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29490
    title SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 2399)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1304.NASL
    description CVE-2006-6060 CVE-2006-6106 CVE-2006-6535 CVE-2007-0958 CVE-2007-1357 CVE-2007-1592 Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. This update also fixes a regression in the smbfs subsystem which was introduced in DSA-1233which caused symlinks to be interpreted as regular files. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4811 David Gibson reported an issue in the hugepage code which could permit a local DoS (system crash) on appropriately configured systems. - CVE-2006-4814 Doug Chapman discovered a potential local DoS (deadlock) in the mincore function caused by improper lock handling. - CVE-2006-4623 Ang Way Chuang reported a remote DoS (crash) in the dvb driver which can be triggered by a ULE package with an SNDU length of 0. - CVE-2006-5753 Eric Sandeen provided a fix for a local memory corruption vulnerability resulting from a misinterpretation of return values when operating on inodes which have been marked bad. - CVE-2006-5754 Darrick Wong discovered a local DoS (crash) vulnerability resulting from the incorrect initialization of 'nr_pages' in aio_setup_ring(). - CVE-2006-5757 LMH reported a potential local DoS which could be exploited by a malicious user with the privileges to mount and read a corrupted iso9660 filesystem. - CVE-2006-6053 LMH reported a potential local DoS which could be exploited by a malicious user with the privileges to mount and read a corrupted ext3 filesystem. - CVE-2006-6056 LMH reported a potential local DoS which could be exploited by a malicious user with the privileges to mount and read a corrupted hfs filesystem on systems with SELinux hooks enabled (Debian does not enable SELinux by default). - CVE-2006-6060 LMH reported a potential local DoS (infinite loop) which could be exploited by a malicious user with the privileges to mount and read a corrupted NTFS filesystem. - CVE-2006-6106 Marcel Holtman discovered multiple buffer overflows in the Bluetooth subsystem which can be used to trigger a remote DoS (crash) and potentially execute arbitrary code. - CVE-2006-6535 Kostantin Khorenko discovered an invalid error path in dev_queue_xmit() which could be exploited by a local user to cause data corruption. - CVE-2007-0958 Santosh Eraniose reported a vulnerability that allows local users to read otherwise unreadable files by triggering a core dump while using PT_INTERP. This is related to CVE-2004-1073. - CVE-2007-1357 Jean Delvare reported a vulnerability in the appletalk subsystem. Systems with the appletalk module loaded can be triggered to crash by other systems on the local network via a malformed frame. - CVE-2007-1592 Masayuki Nakagawa discovered that flow labels were inadvertently being shared between listening sockets and child sockets. This defect can be exploited by local users to cause a DoS (Oops).
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 25529
    published 2007-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25529
    title Debian DSA-1304-1 : kernel-source-2.6.8 - several vulnerabilities
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2006-182.NASL
    description A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel : Stephane Eranian discovered an issue with permon2.0 where, under certain circumstances, the perfmonctl() system call may not correctly manage the file descriptor reference count, resulting in the system possibly running out of file structure (CVE-2006-3741). Prior to and including 2.6.17, the Universal Disk Format (UDF) filesystem driver allowed local users to cause a DoS (hang and crash) via certain operations involving truncated files (CVE-2006-4145). Various versions of the Linux kernel allowed local users to cause a DoS (crash) via an SCTP socket with a certain SO_LINGER value, which is possibly related to the patch used to correct CVE-2006-3745 (CVE-2006-4535). The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in the dvb driver allows remote attackers to cause a DoS (crash) via an SNDU length of 0 in a ULE packet (CVE-2006-4623). The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes. In addition to these security fixes, other fixes have been included such as : - added support for new devices: o NetXtreme BCM5715 gigabit ethernet o NetXtreme II BCM5708 gigabit ethernet - enabled the CISS driver for Xen kernels - updated ich8 support in ata_piix - enabled support for 1078 type controller in megaraid_sas - multiple fixes for RSBAC support To update your kernel, please follow the directions located at : http://www.mandriva.com/en/security/kernelupdate
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 24567
    published 2007-02-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24567
    title Mandrake Linux Security Advisory : kernel (MDKSA-2006:182)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2006-0689.NASL
    description Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the security issues described below : * a flaw in the SCTP support that allowed a local user to cause a denial of service (crash) with a specific SO_LINGER value. (CVE-2006-4535, Important) * a flaw in the hugepage table support that allowed a local user to cause a denial of service (crash). (CVE-2005-4811, Important) * a flaw in the mprotect system call that allowed setting write permission for a read-only attachment of shared memory. (CVE-2006-2071, Moderate) * a flaw in HID0[31] (en_attn) register handling on PowerPC 970 systems that allowed a local user to cause a denial of service. (crash) (CVE-2006-4093, Moderate) * a flaw in the perfmon support of Itanium systems that allowed a local user to cause a denial of service by consuming all file descriptors. (CVE-2006-3741, Moderate) * a flaw in the ATM subsystem. On systems with installed ATM hardware and configured ATM support, a remote user could cause a denial of service (panic) by accessing socket buffers memory after freeing them. (CVE-2006-4997, Moderate) * a flaw in the DVB subsystem. On systems with installed DVB hardware and configured DVB support, a remote user could cause a denial of service (panic) by sending a ULE SNDU packet with length of 0. (CVE-2006-4623, Low) * an information leak in the network subsystem that possibly allowed a local user to read sensitive data from kernel memory. (CVE-2006-0039, Low) In addition, two bugfixes for the IPW-2200 wireless driver were included. The first one ensures that wireless management applications correctly identify IPW-2200 controlled devices, while the second fix ensures that DHCP requests using the IPW-2200 operate correctly. Red Hat would like to thank Olof Johansson, Stephane Eranian and Solar Designer for reporting issues fixed in this erratum. All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 22513
    published 2006-10-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22513
    title CentOS 4 : kernel (CESA-2006:0689)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-489-1.NASL
    description A flaw was discovered in dvb ULE decapsulation. A remote attacker could send a specially crafted message and cause a denial of service. (CVE-2006-4623) The compat_sys_mount function allowed local users to cause a denial of service when mounting a smbfs filesystem in compatibility mode. (CVE-2006-7203) The Omnikey CardMan 4040 driver (cm4040_cs) did not limit the size of buffers passed to read() and write(). A local attacker could exploit this to execute arbitrary code with kernel privileges. (CVE-2007-0005) Due to an variable handling flaw in the ipv6_getsockopt_sticky() function a local attacker could exploit the getsockopt() calls to read arbitrary kernel memory. This could disclose sensitive data. (CVE-2007-1000) Ilja van Sprundel discovered that Bluetooth setsockopt calls could leak kernel memory contents via an uninitialized stack buffer. A local attacker could exploit this flaw to view sensitive kernel information. (CVE-2007-1353) A flaw was discovered in the handling of netlink messages. Local attackers could cause infinite recursion leading to a denial of service. (CVE-2007-1861) The random number generator was hashing a subset of the available entropy, leading to slightly less random numbers. Additionally, systems without an entropy source would be seeded with the same inputs at boot time, leading to a repeatable series of random numbers. (CVE-2007-2453) A flaw was discovered in the PPP over Ethernet implementation. Local attackers could manipulate ioctls and cause kernel memory consumption leading to a denial of service. (CVE-2007-2525) An integer underflow was discovered in the cpuset filesystem. If mounted, local attackers could obtain kernel memory using large file offsets while reading the tasks file. This could disclose sensitive data. (CVE-2007-2875) Vilmos Nebehaj discovered that the SCTP netfilter code did not correctly validate certain states. A remote attacker could send a specially crafted packet causing a denial of service. (CVE-2007-2876) Luca Tettamanti discovered a flaw in the VFAT compat ioctls on 64-bit systems. A local attacker could corrupt a kernel_dirent struct and cause a denial of service. (CVE-2007-2878) A flaw was discovered in the cluster manager. A remote attacker could connect to the DLM port and block further DLM operations. (CVE-2007-3380) A flaw was discovered in the usblcd driver. A local attacker could cause large amounts of kernel memory consumption, leading to a denial of service. (CVE-2007-3513). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 28090
    published 2007-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28090
    title Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerability (USN-489-1)
oval via4
accepted 2013-04-29T04:22:03.848-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.
family unix
id oval:org.mitre.oval:def:9775
status accepted
submitted 2010-07-09T03:56:16-04:00
title The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.
version 23
redhat via4
advisories
rhsa
id RHSA-2006:0689
rpms
  • kernel-0:2.6.9-42.0.3.EL
  • kernel-devel-0:2.6.9-42.0.3.EL
  • kernel-doc-0:2.6.9-42.0.3.EL
  • kernel-hugemem-0:2.6.9-42.0.3.EL
  • kernel-hugemem-devel-0:2.6.9-42.0.3.EL
  • kernel-largesmp-0:2.6.9-42.0.3.EL
  • kernel-largesmp-devel-0:2.6.9-42.0.3.EL
  • kernel-smp-0:2.6.9-42.0.3.EL
  • kernel-smp-devel-0:2.6.9-42.0.3.EL
refmap via4
bid 19939
bugtraq
  • 20061017 rPSA-2006-0194-1 kernel
  • 20070615 rPSA-2007-0124-1 kernel xen
confirm
debian DSA-1304
mandriva MDKSA-2006:182
mlist [lkml-patch] 20060821 dvb-core: Proper handling ULE SNDU length of 0
secunia
  • 21820
  • 22292
  • 22382
  • 22441
  • 22945
  • 23474
  • 25691
  • 25714
  • 26139
suse SUSE-SA:2006:079
ubuntu USN-489-1
vupen ADV-2006-3551
statements via4
contributor Joshua Bressers
lastmodified 2006-09-21
organization Red Hat
statement Red Hat is aware of this issue and is tracking it via the following bug for Red Hat Enterprise Linux 4: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204912 This issue does not affect Red Hat Enterprise Linux 2.1 or 3.
Last major update 07-03-2011 - 21:41
Published 11-09-2006 - 13:04
Last modified 17-10-2018 - 17:38
Back to Top