[ GLSA 200407-16 ] Linux Kernel: Multiple DoS and permission vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: Linux Kernel: Multiple DoS and permission vulnerabilities (GLSA 200407-16)
Severity: high
Exploitable: local
Date: July 22, 2004
Updated: March 27, 2011
Bug(s): #56171, #56479
ID: 200407-16

Synopsis


Multiple permission vulnerabilities have been found in the Linux kernel,
allowing an attacker to change the group IDs of files mounted on a remote
filesystem (CAN-2004-0497), as well as an issue in 2.6 series kernels which
allows /proc permissions to be bypassed. A context sharing vulnerability in
vserver-sources is also handled by this advisory as well as CAN-2004-0447,
CAN-2004-0496 and CAN-2004-0565. Patched, or updated versions of these
kernels have been released and details are included along with this
advisory.


Background


The Linux kernel is responsible for managing the core aspects of a
GNU/Linux system, providing an interface for core system applications
as well as providing the essential structure and capability to access
hardware that is needed for a running system.


Affected Packages

Package: sys-kernel/aa-sources
Vulnerable: < 2.6.5-r5
Unaffected: >= 2.4.23-r2 < 2.4.24
Unaffected: >= 2.6.5-r5
Architectures: All supported architectures

Package: sys-kernel/alpha-sources
Vulnerable: < 2.4.21-r9
Unaffected: >= 2.4.21-r9
Architectures: All supported architectures

Package: sys-kernel/ck-sources
Vulnerable: < 2.6.7-r5
Unaffected: >= 2.4.26-r1 < 2.4.27
Unaffected: >= 2.6.7-r5
Architectures: All supported architectures

Package: sys-kernel/compaq-sources
Vulnerable: < 2.4.9.32.7-r8
Unaffected: >= 2.4.9.32.7-r8
Architectures: All supported architectures

Package: sys-kernel/development-sources
Vulnerable: < 2.6.8_rc1
Unaffected: >= 2.6.8_rc1
Architectures: All supported architectures

Package: sys-kernel/gentoo-dev-sources
Vulnerable: < 2.6.7-r8
Unaffected: >= 2.6.7-r8
Architectures: All supported architectures

Package: sys-kernel/gentoo-sources
Vulnerable: < 2.4.26-r5
Unaffected: >= 2.4.19-r18 < 2.4.20
Unaffected: >= 2.4.20-r21 < 2.4.21
Unaffected: >= 2.4.22-r13 < 2.4.23
Unaffected: >= 2.4.25-r6 < 2.4.26
Unaffected: >= 2.4.26-r5
Architectures: All supported architectures

Package: sys-kernel/grsec-sources
Vulnerable: < 2.4.26.2.0-r6
Unaffected: >= 2.4.26.2.0-r6
Architectures: All supported architectures

Package: sys-kernel/gs-sources
Vulnerable: < 2.4.25_pre7-r8
Unaffected: >= 2.4.25_pre7-r8
Architectures: All supported architectures

Package: sys-kernel/hardened-dev-sources
Vulnerable: < 2.6.7-r2
Unaffected: >= 2.6.7-r2
Architectures: All supported architectures

Package: sys-kernel/hardened-sources
Vulnerable: < 2.4.26-r3
Unaffected: >= 2.4.26-r3
Architectures: All supported architectures

Package: sys-kernel/hppa-dev-sources
Vulnerable: < 2.6.7_p1-r2
Unaffected: >= 2.6.7_p1-r2
Architectures: All supported architectures

Package: sys-kernel/hppa-sources
Vulnerable: < 2.4.26_p6-r1
Unaffected: >= 2.4.26_p6-r1
Architectures: All supported architectures

Package: sys-kernel/ia64-sources
Vulnerable: < 2.4.24-r7
Unaffected: >= 2.4.24-r7
Architectures: All supported architectures

Package: sys-kernel/mm-sources
Vulnerable: < 2.6.7-r6
Unaffected: >= 2.6.7-r6
Architectures: All supported architectures

Package: sys-kernel/openmosix-sources
Vulnerable: < 2.4.22-r11
Unaffected: >= 2.4.22-r11
Architectures: All supported architectures

Package: sys-kernel/pac-sources
Vulnerable: < 2.4.23-r9
Unaffected: >= 2.4.23-r9
Architectures: All supported architectures

Package: sys-kernel/planet-ccrma-sources
Vulnerable: < 2.4.21-r11
Unaffected: >= 2.4.21-r11
Architectures: All supported architectures

Package: sys-kernel/pegasos-dev-sources
Vulnerable: < 2.6.7-r2
Unaffected: >= 2.6.7-r2
Architectures: All supported architectures

Package: sys-kernel/pegasos-sources
Vulnerable: < 2.4.26-r3
Unaffected: >= 2.4.26-r3
Architectures: All supported architectures

Package: sys-kernel/ppc-sources
Vulnerable: < 2.4.26-r3
Unaffected: >= 2.4.26-r3
Architectures: All supported architectures

Package: sys-kernel/rsbac-sources
Vulnerable: < 2.4.26-r3
Unaffected: >= 2.4.26-r3
Architectures: All supported architectures

Package: sys-kernel/rsbac-dev-sources
Vulnerable: < 2.6.7-r2
Unaffected: >= 2.6.7-r2
Architectures: All supported architectures

Package: sys-kernel/selinux-sources
Vulnerable: < 2.4.26-r2
Unaffected: >= 2.4.26-r2
Architectures: All supported architectures

Package: sys-kernel/sparc-sources
Vulnerable: < 2.4.26-r3
Unaffected: >= 2.4.26-r3
Architectures: All supported architectures

Package: sys-kernel/uclinux-sources
Vulnerable: < 2.6.7_p0-r2
Unaffected: >= 2.4.26_p0-r3 < 2.4.27
Unaffected: >= 2.6.7_p0-r2
Architectures: All supported architectures

Package: sys-kernel/usermode-sources
Vulnerable: < 2.6.6-r4
Unaffected: >= 2.4.24-r6 < 2.4.25
Unaffected: >= 2.4.26-r3 < 2.4.27
Unaffected: >= 2.6.6-r4
Architectures: All supported architectures

Package: sys-kernel/vserver-sources
Vulnerable: < 2.4.26.1.28-r1
Vulnerable: >= 2.4
Vulnerable: < 2.0
Unaffected: >= 2.0
Architectures: All supported architectures

Package: sys-kernel/win4lin-sources
Vulnerable: < 2.6.7-r2
Unaffected: >= 2.4.26-r3 < 2.4.27
Unaffected: >= 2.6.7-r2
Architectures: All supported architectures

Package: sys-kernel/wolk-sources
Vulnerable: < 4.14-r4
Unaffected: >= 4.9-r10 < 4.10
Unaffected: >= 4.11-r7 < 4.12
Unaffected: >= 4.14-r4
Architectures: All supported architectures

Package: sys-kernel/xbox-sources
Vulnerable: < 2.6.7-r2
Unaffected: >= 2.4.26-r3 < 2.4.27
Unaffected: >= 2.6.7-r2
Architectures: All supported architectures

Package: sys-kernel/mips-sources
Vulnerable: < 2.4.27
Unaffected: >= 2.4.27
Architectures: All supported architectures

Package: sys-kernel/vanilla-sources
Vulnerable: <= 2.4.26
Unaffected: >= 2.4.27
Architectures: All supported architectures


Description


The Linux kernel allows a local attacker to mount a remote file system
on a vulnerable Linux host and modify files' group IDs. On 2.4 series
kernels this vulnerability only affects shared NFS file systems. This
vulnerability has been assigned CAN-2004-0497 by the Common
Vulnerabilities and Exposures project.

Also, a flaw in the handling of /proc attributes has been found in 2.6
series kernels; allowing the unauthorized modification of /proc
entries, especially those which rely solely on file permissions for
security to vital kernel parameters.

An issue specific to the VServer Linux sources has been found, by which
/proc related changes in one virtual context are applied to other
contexts as well, including the host system.

CAN-2004-0447 resolves a local DoS vulnerability on IA64 platforms
which can cause unknown behaviour and CAN-2004-0565 resolves a floating
point information leak on IA64 platforms by which registers of other
processes can be read by a local user.

Finally, CAN-2004-0496 addresses some more unknown vulnerabilities in
2.6 series Linux kernels older than 2.6.7 which were found by the
Sparse source code checking tool.


Impact


Bad Group IDs can possibly cause a Denial of Service on parts of a host
if the changed files normally require a special GID to properly
operate. By exploiting this vulnerability, users in the original file
group would also be blocked from accessing the changed files.

The /proc attribute vulnerability allows local users with previously no
permissions to certain /proc entries to exploit the vulnerability and
then gain read, write and execute access to entries.

These new privileges can be used to cause unknown behaviour ranging
from reduced system performance to a Denial of Service by manipulating
various kernel options which are usually reserved for the superuser.
This flaw might also be used for opening restrictions set through /proc
entries, allowing further attacks to take place through another
possibly unexpected attack vector.

The VServer issue can also be used to induce similar unexpected
behaviour to other VServer contexts, including the host. By successful
exploitation, a Denial of Service for other contexts can be caused
allowing only root to read certain /proc entries. Such a change would
also be replicated to other contexts, forbidding normal users on those
contexts to read /proc entries which could contain details needed by
daemons running as a non-root user, for example.

Additionally, this vulnerability allows an attacker to read information
from another context, possibly hosting a different server, gaining
critical information such as what processes are running. This may be
used for furthering the exploitation of either context.

CAN-2004-0447 and CAN-2004-0496 permit various local unknown Denial of
Service vulnerabilities with unknown impacts - these vulnerabilities
can be used to possibly elevate privileges or access reserved kernel
memory which can be used for further exploitation of the system.

CAN-2004-0565 allows FPU register values of other processes to be read
by a local user setting the MFH bit during a floating point operation -
since no check was in place to ensure that the FPH bit was owned by the
requesting process, but only an MFH bit check, an attacker can simply
set the MFH bit and access FPU registers of processes running as other
users, possibly those running as root.


Workaround


2.4 users may not be affected by CAN-2004-0497 if they do not use
remote network filesystems and do not have support for any such
filesystems in their kernel configuration. All 2.6 users are affected
by the /proc attribute issue and the only known workaround is to
disable /proc support. The VServer flaw applies only to
vserver-sources, and no workaround is currently known for the issue.
There is no known fix to CAN-2004-0447, CAN-2004-0496 or CAN-2004-0565
other than to upgrade the kernel to a patched version.

As a result, all users affected by any of these vulnerabilities should
upgrade their kernels to ensure the integrity of their systems.


Resolution


Users are encouraged to upgrade to the latest available sources for
their system: