USN-178-1: Linux kernel vulnerabilities

9 September 2005

Linux kernel vulnerabilities

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Releases

Details

Oleg Nesterov discovered a local Denial of Service vulnerability in
the timer handling. When a non group-leader thread called exec() to
execute a different program while an itimer was pending, the timer
expiry would signal the old group leader task, which did not exist any
more. This caused a kernel panic. This vulnerability only affects
Ubuntu 5.04. (CAN-2005-1913)

Al Viro discovered that the sendmsg() function did not sufficiently
validate its input data. By calling sendmsg() and at the same time
modifying the passed message in another thread, he could exploit this
to execute arbitrary commands with kernel privileges. This only
affects the amd64 bit platform. (CAN-2005-2490)

Al Viro discovered a vulnerability in the raw_sendmsg() function. By
calling this function with specially crafted arguments, a local
attacker could either read kernel memory contents (leading to
information disclosure) or manipulate the hardware state by reading
certain IO ports. This vulnerability only affects Ubuntu 5.04.
(CAN-2005-2492)

Jan Blunck discovered a Denial of Service vulnerability in the procfs
interface of the SCSI driver. By repeatedly reading
/proc/scsi/sg/devices, a local attacker could eventually exhaust
kernel memory. (CAN-2005-2800)

A flaw was discovered in the handling of extended attributes on ext2
and ext3 file systems. Under certain condidions, this could prevent
the enforcement of Access Control Lists, which eventually could lead
to information disclosure, unauthorized program execution, or
unauthorized data modification. This does not affect the standard Unix
permissions. (CAN-2005-2801)

Chad Walstrom discovered a Denial of Service in the ipt_recent module,
which can be used in netfilter (Firewall configuration). A remote
attacker could exploit this to crash the kernel by sending certain
packets (such as an SSH brute force attack) to a host which uses the
"recent" module. (CAN-2005-2802)

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 5.04
  • linux-patch-ubuntu-2.6.10 -
  • linux-image-2.6.8.1-5-powerpc-smp -
  • linux-image-2.6.8.1-5-power4-smp -
  • linux-image-2.6.10-5-386 -
  • linux-image-2.6.10-5-itanium-smp -
  • linux-image-2.6.10-5-power4 -
  • linux-image-2.6.10-5-amd64-k8 -
  • linux-image-2.6.10-5-amd64-xeon -
  • linux-image-2.6.10-5-mckinley-smp -
  • linux-image-2.6.10-5-power4-smp -
  • linux-image-2.6.8.1-5-amd64-generic -
  • linux-image-2.6.10-5-amd64-k8-smp -
  • linux-image-2.6.8.1-5-k7-smp -
  • linux-image-2.6.8.1-5-power3-smp -
  • linux-image-2.6.8.1-5-amd64-xeon -
  • linux-image-2.6.10-5-powerpc-smp -
  • linux-image-2.6.8.1-5-power3 -
  • linux-image-2.6.8.1-5-power4 -
  • linux-image-2.6.8.1-5-powerpc -
  • linux-image-2.6.10-5-mckinley -
  • linux-image-2.6.10-5-itanium -
  • linux-image-2.6.10-5-power3-smp -
  • linux-image-2.6.10-5-k7 -
  • linux-image-2.6.10-5-power3 -
  • linux-image-2.6.8.1-5-amd64-k8-smp -
  • linux-image-2.6.8.1-5-686 -
  • linux-image-2.6.8.1-5-686-smp -
  • linux-patch-debian-2.6.8.1 -
  • linux-image-2.6.10-5-powerpc -
  • linux-image-2.6.8.1-5-k7 -
  • linux-image-2.6.10-5-k7-smp -
  • linux-image-2.6.10-5-amd64-generic -
  • linux-image-2.6.10-5-686-smp -
  • linux-image-2.6.8.1-5-386 -
  • linux-image-2.6.10-5-686 -
  • linux-image-2.6.8.1-5-amd64-k8 -
Ubuntu 4.10
  • linux-patch-ubuntu-2.6.10 -
  • linux-image-2.6.8.1-5-powerpc-smp -
  • linux-image-2.6.8.1-5-power4-smp -
  • linux-image-2.6.10-5-386 -
  • linux-image-2.6.10-5-itanium-smp -
  • linux-image-2.6.10-5-power4 -
  • linux-image-2.6.10-5-amd64-k8 -
  • linux-image-2.6.10-5-amd64-xeon -
  • linux-image-2.6.10-5-mckinley-smp -
  • linux-image-2.6.10-5-power4-smp -
  • linux-image-2.6.8.1-5-amd64-generic -
  • linux-image-2.6.10-5-amd64-k8-smp -
  • linux-image-2.6.8.1-5-k7-smp -
  • linux-image-2.6.8.1-5-power3-smp -
  • linux-image-2.6.8.1-5-amd64-xeon -
  • linux-image-2.6.10-5-powerpc-smp -
  • linux-image-2.6.8.1-5-power3 -
  • linux-image-2.6.8.1-5-power4 -
  • linux-image-2.6.8.1-5-powerpc -
  • linux-image-2.6.10-5-mckinley -
  • linux-image-2.6.10-5-itanium -
  • linux-image-2.6.10-5-power3-smp -
  • linux-image-2.6.10-5-k7 -
  • linux-image-2.6.10-5-power3 -
  • linux-image-2.6.8.1-5-amd64-k8-smp -
  • linux-image-2.6.8.1-5-686 -
  • linux-image-2.6.8.1-5-686-smp -
  • linux-patch-debian-2.6.8.1 -
  • linux-image-2.6.10-5-powerpc -
  • linux-image-2.6.8.1-5-k7 -
  • linux-image-2.6.10-5-k7-smp -
  • linux-image-2.6.10-5-amd64-generic -
  • linux-image-2.6.10-5-686-smp -
  • linux-image-2.6.8.1-5-386 -
  • linux-image-2.6.10-5-686 -
  • linux-image-2.6.8.1-5-amd64-k8 -

In general, a standard system update will make all the necessary changes.

References

Join the discussion

Need help with your security needs?

Ubuntu Pro provides up to ten-year security coverage for over 23,000 open-source packages within the Ubuntu Main and Universe repositories.

Talk to an expert to find out what would work best for you

Further reading