CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : kernel
SUMMARY : Fixes for kernel vulnerabilities
DATE : 2004-07-15 11:28:00
ID : CLA-2004:846
RELEVANT RELEASES : 8, 9
DESCRIPTION
The Linux kernel is responsible for handling the basic functions of
the GNU/Linux operating system.
This announcement fixes the following vulnerabilities:
1. Vicam USB driver denial of service (CAN-2004-0075[1])
The Linux kernel Vicam USB driver used an insecure method for
copying data from userspace instead of using the copy_from_user
function. A local attacker could exploit this vulnerability[1] to
possibly cause a denial of service.
2. OSS denial of service (CAN-2004-0178[2])
The OSS code for the Sound Blaster driver in Linux 2.4.x does
not properly handle certain sample sizes, which allows local users
to cause a denial of service.
3. ISO-9660 buffer overflow vulnerability[3]
(CAN-2004-0109[4])
The Linux kernel performs no length checking on symbolic links
stored on an ISO9660 file system, allowing a malformed CD to cause
an arbitrary length overflow in kernel memory.
4. R128 DRI local privileges escalation (CAN-2004-0003[5])
Alan Cox found a vulnerability in the R128 DRI driver which
could potentially lead an attacker to gain unauthorized
privileges.
5. do_fork memory leak (CAN-2004-0427[6])
John Byrne found[7] an issue in the do_fork function under
certain conditions would not free allocated memory, possibly
causing a denial of service.
6. Infoleak on filesystems (CAN-2004-0133[8],
CAN-2004-0177[9])
Solar Designer noticed that the ext3[8] code in Linux 2.4.x does
not properly initialize journal descriptor blocks, which causes an
information leak. In-memory data is written to the device for an
ext3 file system, which would allow privileged users to obtain
portions of kernel memory by reading the raw device. Chris noticed
that it affected JFS too.
7. Buffer overflow at panic state (CAN-2004-0394[10])
The Linux kernel 2.4.x has a buffer overflow in the panic()
function, which, at this time, is believed to not be exploitable
due to the way panic() works.
8. Sparse bugs (CAN-2004-0495[11])
This announcement adds missing parts of the sparse corrections
done to the Linux kernel in our previous announcement[12].
SOLUTION
It is recommended that all Conectiva Linux users upgrade the kernel
package.
IMPORTANT: exercise caution and preparation when upgrading the
kernel, since it will require a reboot after the new packages are
installed. In particular, Conectiva Linux 9 will most likely
require an initrd file (which is automatically created in the /boot
directory after the new packages are installed). Generic kernel
update instructions can be obtained in the manuals and in our
updates page[13]. More detailed instructions are also available in
Portuguese at our Moin[14] page.
REFER&Etilde;NCIAS:
1.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0075
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0178
3.http://www.idefense.com/application/poi/display?id=101&type=vulnerabilities&flashstatus=true
4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0109
5.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0003
6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0427
7.http://marc.theaimsgroup.com/?l=linux-kernel&m=108139073506983&w=2
8.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0133
9.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0177
10.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0394
11.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0495
12.http://distro2.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000845&idioma=en
13.https://moin.conectiva.com.br/UpdatingKernelPackages
14.http://www.conectiva.com.br/suporte/pr/sistema.kernel.atualizar.html
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/SRPMS/kernel-2.4.19-1U80_24cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/devfsd-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-2.4.19-1U80_24cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-2.4.19-1U80_24cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-BOOT-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-doc-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-enterprise-2.4.19-1U80_24cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-headers-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-rbc-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-smp-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-smp-2.4.19-1U80_24cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-smp-2.4.19-1U80_24cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/kernel-source-2.4.19-1U80_24cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/kernel24-2.4.21-31301U90_18cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/devfsd-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-2.4.21-31301U90_18cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-BOOT-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-doc-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-enterprise-2.4.21-31301U90_18cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-enterprise-2.4.21-31301U90_18cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-enterprise-2.4.21-31301U90_18cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-headers-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-rbc-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-smp-2.4.21-31301U90_18cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/kernel24-source-2.4.21-31301U90_18cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com