Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


More on LinuxToday


Linux-Mandrake Security Advisory: kernel update

Apr 18, 2001, 20:11 (0 Talkback[s])
Date:         Tue, 17 Apr 2001 14:31:46 -0600
From: Linux Mandrake Security Team <security@LINUX-MANDRAKE.COM>
Subject:      MDKSA-2001:037 - kernel update

Linux-Mandrake Security Update Advisory


Package name:           kernel
Date:                   April 17th, 2001
Advisory ID:            MDKSA-2001:037

Affected versions:      6.0, 6.1, 7.0, 7.1, 7.2, Corporate Server 1.0.1

Problem Description:

A number of security problems have been found in the Linux kernels prior to the latest 2.2.19 kernel. Following is a list of problems based on the 2.2.19 release notes as found on http://www.linux.org.uk/

  • binfmt_misc used user pages directly
  • the CPIA driver had an off-by-one error in the buffer code which made it possible for users to write into kernel memory
  • the CPUID and MSR drivers had a problem in the module unloading code which could cause a system a crash if they were set to automatically load and unload
  • there was a possible hang in the classifier code
  • the getsockopt and setsockopt system calls did not handle sign bits correctly which made a local DoS and other attacks possible
  • the sysctl system call did not handle sign bits correctly which allowed a user to write in kernel memory
  • ptrace/exec races that could give a local user extra privileges
  • possible abuse of a boundary case in the sockfilter code
  • SYSV shared memory code could overwrite recently freed memory which might cause problems
  • the packet lengh checks in the masquerading code were a bit lax (probably not exploitable)
  • some x86 assembly bugs caused the wrong number of bytes to be copied
  • a local user could deadlock the kernel due to bugs in the UDP port allocation.

All of these problems are corrected in the 2.2.19 kernel and it is highly recommended that all Linux-Mandrake users upgrade their systems to this kernel.

It is also recommended that you download the necessary RPMs and upgrade manually by following these steps:

  • type: rpm -ivh kernel-2.2.19-4.1mdk.i586.rpm
  • type: mv kernel-2.2.19-4.1mdk.i586.rpm/ /tmp
  • type: rpm -Fvh *.rpm
  • type: mkinitrd -f --ifneeded /boot/initrd-2.2.19-4.1mdk 2.2.19-4.1mdk
  • type: ln -sf /boot/initrd-2.2.19-4.1mdk /boot/initrd.img
  • edit /etc/lilo.conf and double-check the options
  • type: /sbin/lilo -v

Replace the kernel revision noted in the above instructions with those from the packages you downloaded. You will then be able to reboot and use the new kernel and remove the older kernel when you are comfortable using the upgraded one.


Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command: rpm --checksig package.rpm
You can get the GPG public key of the Linux-Mandrake Security Team at http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS If you use MandrakeUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.

Linux-Mandrake 6.0:
58c4a19e37d0fe453333921652d2dd33 6.0/RPMS/kernel-2.2.19-4.6mdk.i586.rpm c2c32fa328442f2afa3dae1184b92d70 6.0/RPMS/kernel-doc-2.2.19-4.6mdk.i586.rpm 477b1caf8bb8bc906ef3f67c09a68e87 6.0/RPMS/kernel-headers-2.2.19-4.6mdk.i586.rpm 86daf8dbae84e536a637fe0cc0fced7f 6.0/RPMS/kernel-pcmcia-cs-2.2.19-4.6mdk.i586.rpm 0c4106b4025986b76af97848e421c437 6.0/RPMS/kernel-secure-2.2.19-4.6mdk.i586.rpm 06ef51ec45fec0f67bd4719c44ed3965 6.0/RPMS/kernel-smp-2.2.19-4.6mdk.i586.rpm cc28675100767f8f4810c18e93f678fc 6.0/RPMS/kernel-source-2.2.19-4.6mdk.i586.rpm c9fe90d26e275124c5544c06d41822aa 6.0/RPMS/kernel-utils-2.2.19-4.6mdk.i586.rpm a7d7f50e53eff25b9c939b7575ff25fc 6.0/RPMS/reiserfs-utils-2.2.19_3.5.29-4.6mdk.i586.rpm 16355590c240a43c172b0414f2ffd8c5 6.0/SRPMS/kernel-2.2.19-4.6mdk.src.rpm
Linux-Mandrake 6.1:
98248d95def8d43b396815e28d0c2ce5 6.1/RPMS/kernel-2.2.19-4.5mdk.i586.rpm e2633a1b043a2411d5bdc1ad62960775 6.1/RPMS/kernel-doc-2.2.19-4.5mdk.i586.rpm 1f88e9c3367aaf950ad954163438d64e 6.1/RPMS/kernel-headers-2.2.19-4.5mdk.i586.rpm 73f43b886e8a972271a8aefdb61a75ce 6.1/RPMS/kernel-pcmcia-cs-2.2.19-4.5mdk.i586.rpm 769aa585f4fb855f574096500d0adbb2 6.1/RPMS/kernel-secure-2.2.19-4.5mdk.i586.rpm 2df67de9971daff29736ec121b600fcb 6.1/RPMS/kernel-smp-2.2.19-4.5mdk.i586.rpm c6803f72684aaff25bf7eb0e7486b652 6.1/RPMS/kernel-source-2.2.19-4.5mdk.i586.rpm f6491ed2f0d812c0ca6928ea47156dcd 6.1/RPMS/kernel-utils-2.2.19-4.5mdk.i586.rpm 26182f6aa42f22a6e47f0be54e9c1e7f 6.1/RPMS/reiserfs-utils-2.2.19_3.5.29-4.5mdk.i586.rpm 65b9b26963f7d2ae4e900d91d5afc8fc 6.1/SRPMS/kernel-2.2.19-4.5mdk.src.rpm
Linux-Mandrake 7.0:
9eb48b0cea6390220cf1d4a0f31ae9ed 7.0/RPMS/alsa-2.2.19_0.5.10b-4.4mdk.i586.rpm fa7c911ad6d789557adca7ab6a9a34bb 7.0/RPMS/alsa-source-2.2.19_0.5.10b-4.4mdk.i586.rpm ec1a34a15bdf7a76b5f9fd543db4d897 7.0/RPMS/kernel-2.2.19-4.4mdk.i586.rpm 885d2afbf16e9b05ba66b6716475cd4a 7.0/RPMS/kernel-doc-2.2.19-4.4mdk.i586.rpm f29d3c03075cb266b2d9286bc919a09a 7.0/RPMS/kernel-headers-2.2.19-4.4mdk.i586.rpm 2ac6af9becc96f1c8615027c726034ed 7.0/RPMS/kernel-linus-2.2.19-1.1mdk.i586.rpm 69272e0ed4413c51ab593512805ba22e 7.0/RPMS/kernel-pcmcia-cs-2.2.19-4.4mdk.i586.rpm 08bacbb3b4a2480c8d654a9b58f8963f 7.0/RPMS/kernel-secure-2.2.19-4.4mdk.i586.rpm 88a68d5bc1779f91d13c6c5d8ffa9127 7.0/RPMS/kernel-smp-2.2.19-4.4mdk.i586.rpm 66281a0c42ab4aa0a4620f92abd61c46 7.0/RPMS/kernel-source-2.2.19-4.4mdk.i586.rpm 861cbc44c62e3ab7d1284d29a5373e03 7.0/RPMS/kernel-utils-2.2.19-4.4mdk.i586.rpm 0a242233c013ca9f728085855f8e383b 7.0/RPMS/reiserfs-utils-2.2.19_3.5.29-4.4mdk.i586.rpm e960f1ee495cd418925706d51907a4e1 7.0/SRPMS/kernel-2.2.19-4.4mdk.src.rpm 134f46c445c1f1f0afa607efe19bd85e 7.0/SRPMS/kernel-linus-2.2.19-1.1mdk.src.rpm
Linux-Mandrake 7.1:
c844f293e5adeb7b65a20544da101861 7.1/RPMS/alsa-2.2.19_0.5.10b-4.3mdk.i586.rpm c96d2f9d400dce99e7d835d7090ec8d1 7.1/RPMS/alsa-source-2.2.19_0.5.10b-4.3mdk.i586.rpm 9aad7c86ba24eb7f4f858d3dc793bab2 7.1/RPMS/kernel-2.2.19-4.3mdk.i586.rpm 91b4789c9e322501c053dee75873bace 7.1/RPMS/kernel-doc-2.2.19-4.3mdk.i586.rpm 651d6b35a92143a1f15ad3d61c4a3769 7.1/RPMS/kernel-headers-2.2.19-4.3mdk.i586.rpm 8df874be1da1c692060ad72b7da277c2 7.1/RPMS/kernel-linus-2.2.19-1.1mdk.i586.rpm 54d0afcbadb9b61d92c8e23cae20c8a4 7.1/RPMS/kernel-pcmcia-cs-2.2.19-4.3mdk.i586.rpm 9329644060c1ef79c4efd48dc6a9820c 7.1/RPMS/kernel-secure-2.2.19-4.3mdk.i586.rpm 56abbf267082304e476765a019a8b359 7.1/RPMS/kernel-smp-2.2.19-4.3mdk.i586.rpm 01873d5c28870ef2e7c2decd2b9a934a 7.1/RPMS/kernel-source-2.2.19-4.3mdk.i586.rpm 0e43ffd93619eeca986bbb293b116098 7.1/RPMS/kernel-utils-2.2.19-4.3mdk.i586.rpm f29ef6a7933f02c5f0d49ecc8a02a6a1 7.1/RPMS/reiserfs-utils-2.2.19_3.5.29-4.3mdk.i586.rpm 108a9edb5164b8b9f5983ddf104d1bb1 7.1/SRPMS/kernel-2.2.19-4.3mdk.src.rpm 134f46c445c1f1f0afa607efe19bd85e 7.1/SRPMS/kernel-linus-2.2.19-1.1mdk.src.rpm
Linux-Mandrake 7.2:
4263a6ec09e39ee5cff90ef8162bbdaf 7.2/RPMS/alsa-2.2.19_0.5.10b-4.1mdk.i586.rpm 98c74f3ffada4eb05c0295a0d7ac11de 7.2/RPMS/alsa-source-2.2.19_0.5.10b-4.1mdk.i586.rpm c4b0225399ce09e18f1d92505da6c18e 7.2/RPMS/kernel-2.2.19-4.1mdk.i586.rpm 7bb7ba06786e78a469dc7e0c2a382873 7.2/RPMS/kernel-doc-2.2.19-4.1mdk.i586.rpm e4f51a300913232780b402e41b33561b 7.2/RPMS/kernel-headers-2.2.19-4.1mdk.i586.rpm da682c4930d0bbebbbe3e28382d9c019 7.2/RPMS/kernel-linus-2.2.19-1.1mdk.i586.rpm a0a369ccd3b93fd18c75bc74028e4d2f 7.2/RPMS/kernel-pcmcia-cs-2.2.19-4.1mdk.i586.rpm 19a4f69af8652fd389d65e253be23bbf 7.2/RPMS/kernel-secure-2.2.19-4.1mdk.i586.rpm e878e01e6d1a8a155fdbf17073e1b60d 7.2/RPMS/kernel-smp-2.2.19-4.1mdk.i586.rpm 17c8137d83e13dea7b083c5cdb67d723 7.2/RPMS/kernel-source-2.2.19-4.1mdk.i586.rpm c83d9df0cc0234c254823073a2545d63 7.2/RPMS/kernel-utils-2.2.19-4.1mdk.i586.rpm ec8fbcb2b6aa0cdcf8b069540be4a661 7.2/RPMS/reiserfs-utils-2.2.19_3.5.29-4.1mdk.i586.rpm cd175b4c5d940bf46dbc6e3a025aba14 7.2/SRPMS/kernel-2.2.19-4.1mdk.src.rpm 134f46c445c1f1f0afa607efe19bd85e 7.2/SRPMS/kernel-linus-2.2.19-1.1mdk.src.rpm
Corporate Server 1.0.1:
1ee205464fc96a51871bd07e209403be 1.0.1/RPMS/alsa-2.2.19_0.5.10b-4.7mdk.i586.rpm e3f329d940ceb06b605c7cc97cae5128 1.0.1/RPMS/alsa-source-2.2.19_0.5.10b-4.7mdk.i586.rpm cfa396c4424bb390c510f975de626d4f 1.0.1/RPMS/kernel-2.2.19-4.7mdk.i586.rpm 5005b4deb1c6bbdc7513b315b971eb9b 1.0.1/RPMS/kernel-doc-2.2.19-4.7mdk.i586.rpm 5698fd2539d0f9f54a0d5e066119f7be 1.0.1/RPMS/kernel-headers-2.2.19-4.7mdk.i586.rpm 3d31bff588b0b089e4db3250ce7bc3f7 1.0.1/RPMS/kernel-linus-2.2.19-1.1mdk.i586.rpm fe3fbd5d666c7ece6983445f9d714224 1.0.1/RPMS/kernel-pcmcia-cs-2.2.19-4.7mdk.i586.rpm 9d6a6bade0200f4807f707896284ceca 1.0.1/RPMS/kernel-secure-2.2.19-4.7mdk.i586.rpm 6100331c78f63f5e8d7d1dc831e9a523 1.0.1/RPMS/kernel-smp-2.2.19-4.7mdk.i586.rpm e1ea8f81cad0a137e5224384822ef12e 1.0.1/RPMS/kernel-source-2.2.19-4.7mdk.i586.rpm 93771a0034d87a149abb16c6cabc36ea 1.0.1/RPMS/kernel-utils-2.2.19-4.7mdk.i586.rpm 7deb47e80f109076e3cac83c7883e940 1.0.1/RPMS/reiserfs-utils-2.2.19_3.5.29-4.7mdk.i586.rpm 688cf912a9072b455f85839340c1c86b 1.0.1/SRPMS/kernel-2.2.19-4.7mdk.src.rpm 134f46c445c1f1f0afa607efe19bd85e 1.0.1/SRPMS/kernel-linus-2.2.19-1.1mdk.src.rpm

To upgrade automatically, use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites listed at:

http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory. For example, if you are looking for an updated RPM package for Linux-Mandrake 7.2, look for it in "updates/7.2/RPMS/". Updated source RPMs are available as well, but you generally do not need to download them.

Please be aware that sometimes it takes the mirrors a few hours to update.

You can view other security advisories for Linux-Mandrake at:

http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

security@linux-mandrake.com


Linux-Mandrake has two security-related mailing list services that anyone can subscribe to:

security-announce@linux-mandrake.com

Linux-Mandrake's security announcements mailing list. Only announcements are sent to this list and it is read-only.

security-discuss@linux-mandrake.com

Linux-Mandrake's security discussion mailing list. This list is open to anyone to discuss Linux-Mandrake security specifically and Linux security in general.

To subscribe to either list, send a message to sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.

To remove yourself from either list, send a message to sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.

To get more information on either list, send a message to sympa@linux-mandrake.com
with "info [listname]" in the body of the message.

Optionally, you can use the web interface to subscribe to or unsubscribe from either list:

http://www.linux-mandrake.com/en/flists.php3#security