Multiple vulnerabilities in the Linux 2.6 kernel have been discovered and corrected in this update :

An integer overflow in vc_resize (CVE-2004-1333).

A race condition in the sysfs_read_file and sysfs_write_file functions in 2.6.10 and earlier allows local users to read kernel memory and cause a DoS (crash) via large offsets in sysfs files (CVE-2004-2302).

An integer signedness error in scsi_ioctl.c (CVE-2005-0180).

Netfilter allows a local user to cause a DoS (memory consumption) via certain packet fragments that are reassembled twice, which causes a data structure to be allocated twice (CVE-2005-0210).

A DoS in pkt_ioctl in pktcdvc.c (CVE-2005-1589).

An array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c allows local users to cause a DoS (oops or deadlock) and possibly execute arbitrary code (CVE-2005-2456).

The zisofs driver in versions prior to 2.6.12.5 allows local users and remove attackers to cause a DoS (crash) via a crafted compressed ISO filesystem (CVE-2005-2457).

inflate.c in the zlib routines in versions prior to 2.6.12.5 allow remove attackers to cause a DoS (crash) via a compressed file with 'improper tables' (CVE-2005-2458).

The huft_build function in inflate.c in the zlib routines in versions prior to 2.6.12.5 returns the wrong value, allowing remote attackers to cause a DoS (crash) via a certain compressed file that leads to a NULL pointer dereference (CVE-2005-2459).

A stack-based buffer overflow in the sendmsg function call in versions prior to 2.6.13.1 allow local users to execute arbitrary code by calling sendmsg and modifying the message contents in another thread (CVE-2005-2490).

vlan_dev.c in version 2.6.8 allows remote attackers to cause a DoS (oops from null dereference) via certain UDP packets that lead to a function call with the wrong argument (CVE-2005-2548).

The kernel does not properly restrict socket policy access to users with the CAP_NET_ADMIN capability, which could allow local users to conduct unauthorized activities via ipv4/ip_sockglue.c and ipv6/ipv6_sockglue.c (CVE-2005-2555).

A memory leak in the seq_file implementation in the SCSI procfs interface (sg.c) in 2.6.13 and earlier allows a local user to cause a DoS (memory consumption) via certain repeated reads from /proc/scsi/gs/devices file which is not properly handled when the next() interator returns NULL or an error (CVE-2005-2800).

xattr.c in the ext2 and ext3 file system code does not properly compare the name_index fields when sharing xattr blocks which could prevent ACLs from being applied (CVE-2005-2801).

The ipt_recent module in versions prior to 2.6.12 when running on 64bit processors allows remote attackers to cause a DoS (kernel panic) via certain attacks such as SSH brute force (CVE-2005-2872).

The ipt_recent module in versions prior to 2.6.12 does not properly perform certain tests when the jiffies value is greater than LONG_MAX, which can cause ipt_recent netfilter rules to block too early (CVE-2005-2873).

Multiple vulnerabilities in versions prior to 2.6.13.2 allow local users to cause a DoS (oops from null dereference) via fput in a 32bit ioctl on 64-bit x86 systems or sockfd_put in the 32-bit routing_ioctl function on 64-bit systems (CVE-2005-3044).

The sys_set_mempolicy function in mempolicy.c allows local users to cause a DoS via a negative first argument (CVE-2005-3053).

Versions 2.6.8 to 2.6.14-rc2 allow local users to cause a DoS (oops) via a userspace process that issues a USB Request Block (URB) to a USB device and terminates before the URB is finished, which leads to a stale pointer reference (CVE-2005-3055).

The Orinoco driver in 2.6.13 and earlier does not properly clear memory from a previously used packet whose length is increased, allowing remote attackers to obtain sensitive information (CVE-2005-3180).

Kernels 2.6.13 and earlier, when CONFIG_AUDITSYSCALL is enabled, use an incorrect function to free names_cache memory, preventing the memory from being tracked by AUDITSYSCALL code and leading to a memory leak (CVE-2005-3181).

The VT implementation in version 2.6.12 allows local users to use certain IOCTLs on terminals of other users and gain privileges (CVE-2005-3257).

Exec does not properly clear posix-timers in multi-threaded environments, which result in a resource leak and could allow a large number of multiple local users to cause a DoS by using more posix- timers than specified by the quota for a single user (CVE-2005-3271).

The rose_rt_ioctl function rose_route.c in versions prior to 2.6.12 does not properly verify the ndigis argument for a new route, allowing an attacker to trigger array out-of-bounds errors with a large number of digipeats (CVE-2005-3273).

A race condition in ip_vs_conn_flush in versions prior to 2.6.13, when running on SMP systems, allows local users to cause a DoS (null dereference) by causing a connection timer to expire while the connection table is being flushed before the appropriate lock is acquired (CVE-2005-3274).

The NAT code in versions prior to 2.6.13 incorrectly declares a variable to be static, allowing remote attackers to cause a DoS (memory corruption) by causing two packets for the same protocol to be NATed at the same time (CVE-2005-3275).

The sys_get_thread_area function in process.c in versions prior to 2.6.12.4 and 2.6.13 does not clear a data structure before copying it to userspace, which may allow a user process to obtain sensitive information (CVE-2005-3276).

The following non-security fixes are also applied :

Driver updates were made to the aic97xx and sata_sil modules.

Support was added for ATI ipx400 chipsets, for IDE and sound.

A build problem with icecream on the x86_64 platform was fixed.

The pin1 APIC timer on RS480-based motherboards was disabled.

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2004-2302     A race condition in the sysfs filesystem allows local     users to read kernel memory and cause a denial of     service (crash).

  - CVE-2005-0756     Alexander Nyberg discovered that the ptrace() system     call does not properly verify addresses on the amd64     architecture which can be exploited by a local attacker     to crash the kernel.

  - CVE-2005-0757     A problem in the offset handling in the xattr file     system code for ext3 has been discovered that may allow     users on 64-bit systems that have access to an ext3     filesystem with extended attributes to cause the kernel     to crash.

  - CVE-2005-1265     Chris Wright discovered that the mmap() function could     create illegal memory maps that could be exploited by a     local user to crash the kernel or potentially execute     arbitrary code.

  - CVE-2005-1761     A vulnerability on the IA-64 architecture can lead local     attackers to overwrite kernel memory and crash the     kernel.

  - CVE-2005-1762     A vulnerability has been discovered in the ptrace()     system call on the amd64 architecture that allows a     local attacker to cause the kernel to crash.

  - CVE-2005-1763     A buffer overflow in the ptrace system call for 64-bit     architectures allows local users to write bytes into     arbitrary kernel memory.

  - CVE-2005-1765     Zou Nan Hai has discovered that a local user could cause     the kernel to hang on the amd64 architecture after     invoking syscall() with specially crafted arguments.

  - CVE-2005-1767     A vulnerability has been discovered in the stack segment     fault handler that could allow a local attacker to cause     a stack exception that will lead the kernel to crash     under certain circumstances.

  - CVE-2005-2456     Balazs Scheidler discovered that a local attacker could     call setsockopt() with an invalid xfrm_user policy     message which would cause the kernel to write beyond the     boundaries of an array and crash.

  - CVE-2005-2458     Vladimir Volovich discovered a bug in the zlib routines     which are also present in the Linux kernel and allows     remote attackers to crash the kernel.

  - CVE-2005-2459     Another vulnerability has been discovered in the zlib     routines which are also present in the Linux kernel and     allows remote attackers to crash the kernel.

  - CVE-2005-2548     Peter Sandstrom noticed that snmpwalk from a remote host     could cause a denial of service (kernel oops from null     dereference) via certain UDP packets that lead to a     function call with the wrong argument.

  - CVE-2005-2801     Andreas Gruenbacher discovered a bug in the ext2 and     ext3 file systems. When data areas are to be shared     among two inodes not all information were compared for     equality, which could expose wrong ACLs for files.

  - CVE-2005-2872     Chad Walstrom discovered that the ipt_recent kernel     module on 64-bit processors such as AMD64 allows remote     attackers to cause a denial of service (kernel panic)     via certain attacks such as SSH brute force.

  - CVE-2005-3105     The mprotect code on Itanium IA-64 Montecito processors     does not properly maintain cache coherency as required     by the architecture, which allows local users to cause a     denial of service and possibly corrupt data by modifying     PTE protections.

  - CVE-2005-3106     A race condition in the thread management may allow     local users to cause a denial of service (deadlock) when     threads are sharing memory and waiting for a thread that     has just performed an exec.

  - CVE-2005-3107     When one thread is tracing another thread that shares     the same memory map a local user could cause a denial of     service (deadlock) by forcing a core dump when the     traced thread is in the TASK_TRACED state.

  - CVE-2005-3108     A bug in the ioremap() system call has been discovered     on the amd64 architecture that could allow local users     to cause a denial of service or an information leak when     performing a lookup of a non-existent memory page.

  - CVE-2005-3109     The HFS and HFS+ (hfsplus) modules allow local attackers     to cause a denial of service (oops) by using hfsplus to     mount a filesystem that is not hfsplus.

  - CVE-2005-3110     A race condition in the ebtables netfilter module on an     SMP system running under high load may allow remote     attackers to cause a denial of service (crash).

  - CVE-2005-3271     Roland McGrath discovered that exec() does not properly     clear posix-timers in multi-threaded environments, which     results in a resource leak and could allow a large     number of multiple local users to cause a denial of     service by using more posix-timers than specified by the     quota for a single user.

  - CVE-2005-3272     The kernel allows remote attackers to poison the bridge     forwarding table using frames that have already been     dropped by filtering, which can cause the bridge to     forward spoofed packets.

  - CVE-2005-3273     The ioctl for the packet radio ROSE protocol does not     properly verify the arguments when setting a new router,     which allows attackers to trigger out-of-bounds errors.

  - CVE-2005-3274     A race condition on SMP systems allows local users to     cause a denial of service (null dereference) by causing     a connection timer to expire while the connection table     is being flushed before the appropriate lock is     acquired.

  - CVE-2005-3275     An error in the NAT code allows remote attackers to     cause a denial of service (memory corruption) by causing     two packets for the same protocol to be NATed at the     same time, which leads to memory corruption.

  - CVE-2005-3276     A missing memory cleanup in the thread handling routines     before copying data into userspace allows a user process     to obtain sensitive information.

This update also contains a number of corrections for issues that turned out to have no security implication afterwards.

Al Viro 氏は、ネットワークデバイスの /proc ファイルハンドラーで競合状態を発見しました。/proc/sys/net/ipv4/conf/<interface>/ の中の任意のファイルを開いて、そのインターフェイスがシャットダウンされるまで待機することで、ローカルの攻撃者がこれを悪用する可能性があります。特定の状況下では、このためにカーネルクラッシュが発生したり、完全なカーネル権限で任意のコードが実行される可能性もあります。(CVE-2005-2709)

Tetsuo Handa 氏は、udp_v6_get_port() 関数でローカルのサービス拒否の脆弱性を発見しました。IPv6 を使用するコンピュータで、ローカルの攻撃者がこれを悪用して、カーネルで無限ループを発生させる可能性があります。
(CVE-2005-2973)

Harald Welte 氏は、USB devio ドライバーでサービス拒否の脆弱性を発見しました。ローカルの攻撃者がこれを悪用して、「USB リクエストブロック」（URB）を送信し、応答が到着する前に送信プロセスを終了することで、無効なポインターを残してカーネルクラッシュを引き起こす可能性がありました。(CVE-2005-3055)

Pavel Roskin 氏は、Orinoco 無線カードドライバーで情報漏洩を発見しました。データを格納するためのバッファの長さが増加するとき、バッファがゼロでパディングされないため、ユーザーにシステムメモリのランダムな部分が露出されました。(CVE-2005-3180)

exec() 関数の POSIX タイマーの処理で、リソース漏洩が発見されました。これは、ローカルユーザーのグループにより DoS 攻撃（サービス拒否攻撃）に悪用可能です。この脆弱性の影響を受けるのは、Ubuntu 4.10 のみです。(CVE-2005-3271)

Stephen Hemming 氏は、ネットワークブリッジドライバーの弱点を発見しました。
パケットフィルターですでに落とされているパケットが、転送テーブルを汚染するため、ブリッジ転送にパッケージを偽装させるために悪用可能です。この脆弱性の影響を受けるのは、Ubuntu 4.10 および 5.04 のみです。(CVE-2005-3272)

David S. Miller 氏は、rose_rt_ioctl() 関数でバッファオーバーフローを発見しました。大きな「ngidis」引数を付けてこの関数を呼び出すことで、ローカルの攻撃者がカーネルクラッシュを引き起こす可能性があります。この脆弱性の影響を受けるのは、Ubuntu 4.10 および 5.04 のみです。(CVE-2005-3273)

Neil Horman 氏は、接続タイマーの処理で競合状態を発見しました。このため、ローカルの攻撃者が、接続リストがまだトラバースされている間に、その接続リストを変更する期限切れハンドラーを設定して、カーネルクラッシュを引き起こす可能性があります。この脆弱性は、マルチプロセッサ（SMP）システムだけに影響を及ぼします。(CVE-2005-3274)

Patrick McHardy 氏は、ネットワークアドレス変換（NAT）接続トラッカーの論理エラーを発見しました。リモートの攻撃者がこれを悪用して、同じプロトコルの 2 つのパケットを同時に NAT 処理させることで、カーネルクラッシュを引き起こす可能性があります。(CVE-2005-3275)

Paolo Giarrusso 氏は、sys_get_thread_area() の情報漏洩を発見しました。戻される構造体が適切にクリアされず、少量のカーネルメモリがユーザー空間のプログラムに漏洩しました。これにより、機密データが漏洩する可能性があります。
（CVE-2005-3276）。

Al Viro 在网络设备的 /proc 文件处理程序中发现一个争用条件。本地攻击者可通过打开 /proc/sys/net/ipv4/conf/<interface>/ 中的任意文件并等待该界面关闭来利用此问题。在某些情况下，这样可导致内核崩溃，甚至以完整的内核权限执行任意代码。(CVE-2005-2709)

Tetsuo Handa 在 udp_v6_get_port() 函数中发现一个本地拒绝服务漏洞。在使用 IPv6 的计算机上，本地攻击者可利用此漏洞来触发内核中的无限循环。
(CVE-2005-2973)

Harald Welte 在 USB devio 驱动程序中发现一个拒绝服务漏洞。本地攻击者可通过发送“USB 请求块”(URB) 并在回复到达之前终止发送进程来利用此漏洞，从而留下无效指针并导致内核崩溃。(CVE-2005-3055)

Pavel Roskin 在 Orinoco 无线网卡驱动程序中发现一个信息泄漏。增加用户存储数据的缓冲区长度时，该缓冲区不会用 0 来填充，从而将系统内存的随机部分暴露给用户。(CVE-2005-3180)

在 exec() 函数中的 POSIX 定时器处理中发现一个资源泄漏。此问题可被一组本地用户用于进行拒绝服务攻击。此漏洞仅影响 Ubuntu 4.10。(CVE-2005-3271)

Stephen Hemming 在网桥驱动程序中发现一个漏洞。
已被数据包过滤器丢弃的数据包可使转发表中毒，这样可被利用于使桥接转发欺骗性程序包。此漏洞仅影响 Ubuntu 4.10 和 5.04。(CVE-2005-3272)

David S. Miller 在 rose_rt_ioctl() 函数中发现一个缓冲区溢出。通过以大型“ngidis”参数调用该函数，本地攻击者可造成内核崩溃。此漏洞仅影响 Ubuntu 4.10 和 5.04。(CVE-2005-3273)

Neil Horman 在连接定时器处理中发现一个争用条件。这样允许本地攻击者设置到期处理程序，该处理程序会在仍在遍历连接列表时修改该列表，这样可导致内核崩溃。此漏洞仅影响多处理器 (SMP) 系统。(CVE-2005-3274)

Patrick McHardy 注意到网络地址转换 (NAT) 连接跟踪器中的一个逻辑错误。远程攻击者可通过导致同时对同一协议的两个数据包进行 NAT 来利用此问题，从而导致内核崩溃。(CVE-2005-3275)

Paolo Giarrusso 在 sys_get_thread_area() 中发现一个信息泄漏。返回的结构未得到正确清理，这样会将少量内核内存暴露给用户空间程序。这样可能会暴露机密数据。
(CVE-2005-3276)。

Al Viro discovered a race condition in the /proc file handler of network devices. A local attacker could exploit this by opening any file in /proc/sys/net/ipv4/conf/<interface>/ and waiting until that interface was shut down. Under certain circumstances this could lead to a kernel crash or even arbitrary code execution with full kernel privileges. (CVE-2005-2709)

Tetsuo Handa discovered a local Denial of Service vulnerability in the udp_v6_get_port() function. On computers which use IPv6, a local attacker could exploit this to trigger an infinite loop in the kernel.
(CVE-2005-2973)

Harald Welte discovered a Denial of Service vulnerability in the USB devio driver. A local attacker could exploit this by sending an 'USB Request Block' (URB) and terminating the sending process before the arrival of the answer, which left an invalid pointer and caused a kernel crash. (CVE-2005-3055)

Pavel Roskin discovered an information leak in the Orinoco wireless card driver. When increasing the buffer length for storing data, the buffer was not padded with zeros, which exposed a random part of the system memory to the user. (CVE-2005-3180)

A resource leak has been discovered in the handling of POSIX timers in the exec() function. This could be exploited to a Denial of Service attack by a group of local users. This vulnerability only affects Ubuntu 4.10. (CVE-2005-3271)

Stephen Hemming discovered a weakness in the network bridge driver.
Packets which had already been dropped by the packet filter could poison the forwarding table, which could be exploited to make the bridge forward spoofed packages. This vulnerability only affects Ubuntu 4.10 and 5.04. (CVE-2005-3272)

David S. Miller discovered a buffer overflow in the rose_rt_ioctl() function. By calling the function with a large 'ngidis' argument, a local attacker could cause a kernel crash. This vulnerability only affects Ubuntu 4.10 and 5.04. (CVE-2005-3273)

Neil Horman discovered a race condition in the connection timer handling. This allowed a local attacker to set up an expiration handler which modified the connection list while the list still being traversed, which could result in a kernel crash. This vulnerability only affects multiprocessor (SMP) systems. (CVE-2005-3274)

Patrick McHardy noticed a logic error in the network address translation (NAT) connection tracker. A remote attacker could exploit this by causing two packets for the same protocol to be NATed at the same time, which resulted in a kernel crash. (CVE-2005-3275)

Paolo Giarrusso discovered an information leak in the sys_get_thread_area(). The returned structure was not properly cleared, which exposed a small amount of kernel memory to userspace programs. This could possibly expose confidential data.
(CVE-2005-3276).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Al Viro 在網路裝置的 /proc 檔案處置程式中發現爭用情形。本機攻擊者可在 /proc/sys/net/ipv4/conf/<interface>/ 中開啟任何檔案並等候到該介面關閉為止來加以惡意利用。在某些情況下，這可導致核心損毀甚或以完整核心權限執行任意程式碼。(CVE-2005-2709)

Tetsuo Handa 在 udp_v6_get_port() 函式中發現一個本機拒絕服務弱點。在使用 IPv6 的電腦上，本機攻擊者可加以惡意利用，在核心中觸發無限迴圈。
(CVE-2005-2973)

Harald Welte 在 USB devio 驅動程式中發現一個拒絕服務弱點。本機攻擊者可加以惡意利用，傳送 'USB Request Block' (URB) 並在答案到達之前終止傳送處理程序，進而留下無效的指標並造成核心損毀。(CVE-2005-3055)

Pavel Roskin 在 Orinoco 無線卡驅動程式中發現資訊洩漏。當增加儲存資料的緩衝區長度時，緩衝區並未填補零，而致使系統記憶體的隨機部分洩漏給使用者。(CVE-2005-3180)

在 exec() 函式的 POSIX 計時器處理中發現資源洩漏。本機使用者群組可加以惡意利用，發動拒絕服務攻擊。此弱點只會影響 Ubuntu 4.10。(CVE-2005-3271)

Stephen Hemming 在網路橋接器驅動程式中發現一個弱點。
已由封包篩選器捨棄的封包可毒害轉送表格，其可被惡意利用來使橋接器轉送偽造的套件。受此弱點影響的只有 Ubuntu 4.10 和 5.04。(CVE-2005-3272)

David S. Miller 在 rose_rt_ioctl() 函式中發現一個緩衝區溢位。透過以大型 'ngidis' 引數呼叫此函式，本機攻擊者可造成核心損毀。受此弱點影響的只有 Ubuntu 4.10 和 5.04。(CVE-2005-3273)

Neil Horman 在連線計時器處理中發現爭用情形。這允許本機攻擊者設定到期處置程式，其會在清單仍在遊走時修改連線清單，進而導致核心損毀。此弱點只會影響多處理器 (SMP) 系統。(CVE-2005-3274)

Patrick McHardy 在網路位址轉譯 (NAT) 連線追蹤器中發現一個邏輯錯誤。遠端攻擊者可加以惡意利用，造成相同通訊協定的兩個封包同時進行 NAT，進而導致核心損毀。(CVE-2005-3275)

Paolo Giarrusso 在 sys_get_thread_area() 中發現資訊洩漏。未正確清除傳回的結構，導致少量的核心記憶體洩漏給使用者空間程式。這可能洩漏機密資料。
(CVE-2005-3276)。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
20450	Mandrake Linux Security Advisory : kernel (MDKSA-2005:219)	Nessus	Mandriva Local Security Checks	2006/1/15	2021/1/6	high
22788	Debian DSA-922-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	high
65105	Ubuntu 4.10 / 5.10：linux-source-2.6.8.1/-2.6.10/-2.6.12 の脆弱性（USN-219-1）	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	medium
65105	Ubuntu 4.10 / 5.10：linux-source-2.6.8.1/-2.6.10/-2.6.12 漏洞 (USN-219-1)	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	medium
65105	Ubuntu 4.10 / 5.10 : linux-source-2.6.8.1/-2.6.10/-2.6.12 vulnerabilities (USN-219-1)	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	medium
65105	Ubuntu 4.10 / 5.10：linux-source-2.6.8.1/-2.6.10/-2.6.12 弱點 (USN-219-1)	Nessus	Ubuntu Local Security Checks	2013/3/9	2021/1/19	medium

検出

プラグインの検索

high

high

medium

medium

medium

medium