From Red Hat Security Advisory 2007:0014 :

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the get_fdb_entries function of the network bridging support that allowed a local user to cause a denial of service (crash) or allow a potential privilege escalation (CVE-2006-5751, Important)

* an information leak in the _block_prepare_write function that allowed a local user to read kernel memory (CVE-2006-4813, Important)

* an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read kernel memory (CVE-2006-5174, Important)

* a flaw in the handling of /proc/net/ip6_flowlabel that allowed a local user to cause a denial of service (infinite loop) (CVE-2006-5619, Important)

* a flaw in the AIO handling that allowed a local user to cause a denial of service (panic) (CVE-2006-5754, Important)

* a race condition in the mincore system core that allowed a local user to cause a denial of service (system hang) (CVE-2006-4814, Moderate)

* a flaw in the ELF handling on ia64 and sparc architectures which triggered a cross-region memory mapping and allowed a local user to cause a denial of service (CVE-2006-4538, Moderate)

* a flaw in the dev_queue_xmit function of the network subsystem that allowed a local user to cause a denial of service (data corruption) (CVE-2006-6535, Moderate)

* a flaw in the handling of CAPI messages over Bluetooth that allowed a remote system to cause a denial of service or potential code execution. This flaw is only exploitable if a privileged user establishes a connection to a malicious remote device (CVE-2006-6106, Moderate)

* a flaw in the listxattr system call that allowed a local user to cause a denial of service (data corruption) or potential privilege escalation. To successfully exploit this flaw the existence of a bad inode is required first (CVE-2006-5753, Moderate)

* a flaw in the __find_get_block_slow function that allowed a local privileged user to cause a denial of service (CVE-2006-5757, Low)

* various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service (CVE-2006-5823, CVE-2006-6053, CVE-2006-6054, CVE-2006-6056, Low)

In addition to the security issues described above, fixes for the following bugs were included :

* initialization error of the tg3 driver with some BCM5703x network card

* a memory leak in the audit subsystem

* x86_64 nmi watchdog timeout is too short

* ext2/3 directory reads fail intermittently

Red Hat would like to thank Dmitriy Monakhov and Kostantin Khorenko for reporting issues fixed in this erratum.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the get_fdb_entries function of the network bridging support that allowed a local user to cause a denial of service (crash) or allow a potential privilege escalation (CVE-2006-5751, Important)

* an information leak in the _block_prepare_write function that allowed a local user to read kernel memory (CVE-2006-4813, Important)

* an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read kernel memory (CVE-2006-5174, Important)

* a flaw in the handling of /proc/net/ip6_flowlabel that allowed a local user to cause a denial of service (infinite loop) (CVE-2006-5619, Important)

* a flaw in the AIO handling that allowed a local user to cause a denial of service (panic) (CVE-2006-5754, Important)

* a race condition in the mincore system core that allowed a local user to cause a denial of service (system hang) (CVE-2006-4814, Moderate)

* a flaw in the ELF handling on ia64 and sparc architectures which triggered a cross-region memory mapping and allowed a local user to cause a denial of service (CVE-2006-4538, Moderate)

* a flaw in the dev_queue_xmit function of the network subsystem that allowed a local user to cause a denial of service (data corruption) (CVE-2006-6535, Moderate)

* a flaw in the handling of CAPI messages over Bluetooth that allowed a remote system to cause a denial of service or potential code execution. This flaw is only exploitable if a privileged user establishes a connection to a malicious remote device (CVE-2006-6106, Moderate)

* a flaw in the listxattr system call that allowed a local user to cause a denial of service (data corruption) or potential privilege escalation. To successfully exploit this flaw the existence of a bad inode is required first (CVE-2006-5753, Moderate)

* a flaw in the __find_get_block_slow function that allowed a local privileged user to cause a denial of service (CVE-2006-5757, Low)

* various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service (CVE-2006-5823, CVE-2006-6053, CVE-2006-6054, CVE-2006-6056, Low)

In addition to the security issues described above, fixes for the following bugs were included :

* initialization error of the tg3 driver with some BCM5703x network card

* a memory leak in the audit subsystem

* x86_64 nmi watchdog timeout is too short

* ext2/3 directory reads fail intermittently

Red Hat would like to thank Dmitriy Monakhov and Kostantin Khorenko for reporting issues fixed in this erratum.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

Red Hat セキュリティアドバイザリ 2007:0014 から：

Red Hat Enterprise Linux 4 カーネルで、いくつかのセキュリティ問題を修正する更新済みのカーネルパッケージが現在利用可能です。

Red Hat セキュリティレスポンスチームは、このセキュリティアドバイザリに重大なセキュリティ上の影響があると評価しています。

Linux カーネルで、オペレーティングシステムの基本関数を処理します。

これらの新しいカーネルパッケージには、以下に説明するセキュリティ問題の修正が含まれています。

* ネットワークブリッジサポートの get_fdb_entries 関数の欠陥により、ローカルユーザーが、サービス拒否（クラッシュ）を引き起こしたり、潜在的な権限昇格を発生させたりすることが可能でした（CVE-2006-5751、重要度高）

* _block_prepare_write 関数の情報漏洩により、ローカルユーザーが、カーネルメモリを読み取ることが可能でした（CVE-2006-4813、重要度高）

* s390 および s390x プラットフォームの copy_from_user() の実装の情報漏洩により、ローカルユーザーが、カーネルメモリを読み取ることが可能でした（CVE-2006-5174、重要度高）

* /proc/net/ip6_flowlabel の処理の欠陥により、ローカルユーザーが、サービス拒否（無限ループ）を引き起こすことが可能でした（CVE-2006-5619、重要度高）

* AIO 処理の欠陥により、ローカルユーザーが、サービス拒否（パニック）を引き起こすことが可能でした（CVE-2006-5754、重要度高）

* mincore システムコアの競合状態により、ローカルユーザーが、サービス拒否（システムハングアップ）を引き起こすことが可能でした（CVE-2006-4814、重要度中）

* ia64 および sparc アーキテクチャの ELF 処理の欠陥により、領域を越えたメモリマッピングを発生させ、ローカルユーザーがサービス拒否を引き起こすことが可能でした（CVE-2006-4538、重要度中）

* ネットワークサブシステムの dev_queue_xmit 関数の欠陥により、ローカルユーザーが、サービス拒否（データの破損）を引き起こすことが可能でした（CVE-2006-6535、重要度中）

* Bluetooth 経由の CAPI メッセージの処理の欠陥により、リモートシステムが、サービス拒否または潜在的なコードの実行を引き起こすことが可能でした。この欠陥を悪用できるのは、特権ユーザーが悪意のあるリモートデバイスに対して接続を確立した場合のみです（CVE-2006-6106、重要度中）

* listxattr システムコールの欠陥により、ローカルユーザーが、サービス拒否（データ破損）または潜在的な権限昇格を引き起こすことが可能でした。この欠陥の悪用を成功させるためには、まず不良 inode の存在が必要です（CVE-2006-5753、重要度中）

* __find_get_block_slow 関数の欠陥により、ローカルの特権ユーザーが、サービス拒否を引き起こすことが可能でした（CVE-2006-5757、重要度低）

* サポートされたファイルシステムの様々な欠陥により、ローカルの特権ユーザーが、サービス拒否を引き起こすことが可能でした（CVE-2006-5823、CVE-2006-6053、CVE-2006-6054、CVE-2006-6056、重要度低）

上記のセキュリティ問題に加えて、次のバグに対する修正も含まれていました：

* 何らかの BCM5703x ネットワークカードを持つ tg3 ドライバーの初期化エラー

* 監査サブシステムのメモリ漏洩

* x86_64 nmi ウォッチドッグタイムアウトが短すぎます

* ext2/3 ディレクトリの読み取りが、断続的に失敗します

Red Hat は、このエラータで修正された問題を報告してくれた Dmitriy Monakhov 氏と Kostantin Khorenko 氏に感謝の意を表します。

Red Hat Enterprise Linux 4 の全ユーザーは、このエラータに記載されているマシンアーキテクチャと構成に関連づけられたパッケージへ、カーネルをアップグレードすることが推奨されます。

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3741     Stephane Eranian discovered a local DoS (Denial of     Service) vulnerability on the ia64 architecture. A local     user could exhaust the available file descriptors by     exploiting a counting error in the permonctl() system     call.

  - CVE-2006-4538     Kirill Korotaev reported a local DoS (Denial of Service)     vulnerability on the ia64 and sparc architectures. A     user could cause the system to crash by executing a     malformed ELF binary due to insufficient verification of     the memory layout.

  - CVE-2006-4813     Dmitriy Monakhov reported a potential memory leak in the
    __block_prepare_write function. __block_prepare_write     does not properly sanitize kernel buffers during error     recovery, which could be exploited by local users to     gain access to sensitive kernel memory.

  - CVE-2006-4997     ADLab Venustech Info Ltd reported a potential remote DoS     (Denial of Service) vulnerability in the IP over ATM     subsystem. A remote system could cause the system to     crash by sending specially crafted packets that would     trigger an attempt to free an already-freed pointer     resulting in a system crash.

  - CVE-2006-5174     Martin Schwidefsky reported a potential leak of     sensitive information on s390 systems. The     copy_from_user function did not clear the remaining     bytes of the kernel buffer after receiving a fault on     the userspace address, resulting in a leak of     uninitialized kernel memory. A local user could exploit     this by appending to a file from a bad address.

  - CVE-2006-5619     James Morris reported a potential local DoS (Denial of     Service) vulnerability that could be used to hang or     oops a system. The seqfile handling for     /proc/net/ip6_flowlabel has a flaw that can be exploited     to cause an infinite loop by reading this file after     creating a flowlabel.

  - CVE-2006-5649     Fabio Massimo Di Nitto reported a potential remote DoS     (Denial of Service) vulnerability on powerpc systems.
    The alignment exception only checked the exception table     for -EFAULT, not for other errors. This can be exploited     by a local user to cause a system crash (panic).

  - CVE-2006-5751     Eugene Teo reported a vulnerability in the     get_fdb_entries function that could potentially be     exploited to allow arbitrary code execution with     escalated privileges.

  - CVE-2006-5871     Bill Allombert reported that various mount options are     ignored by smbfs when UNIX extensions are enabled. This     includes the uid, gid and mode options. Client systems     would silently use the server-provided settings instead     of honoring these options, changing the security model.
    This update includes a fix from Haroldo Gamal that     forces the kernel to honor these mount options. Note     that, since the current versions of smbmount always pass     values for these options to the kernel, it is not     currently possible to activate unix extensions by     omitting mount options. However, this behavior is     currently consistent with the current behavior of the     next Debian release, 'etch'.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The __block_prepate_write function in the 2.6 kernel before 2.6.13 does not properly clear buffers during certain error conditions, which allows users to read portions of files that have been unlinked (CVE-2006-4813).

The clip_mkip function of the ATM subsystem in the 2.6 kernel allows remote attackers to dause a DoS (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (CVE-2006-4997).

The NFS lockd in the 2.6 kernel before 2.6.16 allows remote attackers to cause a DoS (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops and a deadlock (CVE-2006-5158).

The seqfile handling in the 2.6 kernel up to 2.6.18 allows local users to cause a DoS (hang or oops) via unspecified manipulations that trigger an infinite loop while searching for flowlabels (CVE-2006-5619).

A missing call to init_timer() in the isdn_ppp code of the Linux kernel can allow remote attackers to send a special kind of PPP pakcet which may trigger a kernel oops (CVE-2006-5749).

An integer overflow in the 2.6 kernel prior to 2.6.18.4 could allow a local user to execute arbitrary code via a large maxnum value in an ioctl request (CVE-2006-5751).

A race condition in the ISO9660 filesystem handling could allow a local user to cause a DoS (infinite loop) by mounting a crafted ISO9660 filesystem containing malformed data structures (CVE-2006-5757).

A vulnerability in the bluetooth support could allow for overwriting internal CMTP and CAPI data structures via malformed packets (CVE-2006-6106).

The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included such as :

  - __bread oops fix

  - added e1000_ng (nineveh support)

  - added sata_svw (Broadcom SATA support)

  - added Marvell PATA chipset support

  - disabled mmconf on some broken hardware/BIOSes

  - use GENERICARCH and enable bigsmp apic model for tulsa     machines

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

来自 Red Hat 安全公告 2007:0014：

现在可以使用更新后的 kernel 程序包，用于修复 Red Hat Enterprise Linux 4 内核中的多个安全问题。

Red Hat 安全响应团队将此安全公告评级为具有重要安全影响。

Linux 内核处理操作系统的基本功能。

这些新的内核程序包修复了以下安全问题：

* 网络桥接支持的 get_fdb_entries 函数中的一个缺陷，允许本地用户造成拒绝服务（崩溃）或允许潜在权限升级（CVE-2006-5751，重要）

* _block_prepare_write 函数中的一个信息泄漏，允许本地用户读取内核内存（CVE-2006-4813，重要）

* s390 和 s390x 平台上 copy_from_user() 中的一个信息泄漏，允许本地用户读取内核内存（CVE-2006-5174，重要）

* /proc/net/ip6_flowlabel 的处理中的一个缺陷，允许本地用户造成拒绝服务（无限循环）（CVE-2006-5619，重要）

* AIO 处理中的一个缺陷，允许本地用户造成拒绝服务（混乱）（CVE-2006-5754，重要）

* mincore 系统核心中的一个争用条件，允许本地用户造成拒绝服务（系统挂起（CVE-2006-4814，中危）

*ia64 和 sparc 架构上 ELF 处理中的一个缺陷，会触发跨区域内存映射并允许本地用户造成拒绝服务（CVE-2006-4538，中危）

* 网络子系统的 dev_queue_xmit 函数中的一个缺陷，允许本地用户造成拒绝服务（数据损坏）（CVE-2006-6535，中危）

* Bluetooth 上的 CAPI 消息处理中的一个缺陷，允许远程系统造成拒绝服务或潜在的代码执行。仅当特权用户与恶意远程设备建立连接时才可利用此缺陷（CVE-2006-6106，中危）

* listxattr 系统调用中的一个缺陷，允许本地用户造成拒绝服务（数据损坏）或潜在的权限升级。要成功利用此缺陷，必须首先存在不良 inode（CVE-2006-5753，中危）

* __find_get_block_slow 函数中的一个缺陷，允许本地特权用户造成拒绝服务（CVE-2006-5757，低危）

* 受支持的文件系统中的各种缺陷，允许本地特权用户造成拒绝服务（CVE-2006-5823、CVE-2006-6053、CVE-2006-6054、CVE-2006-6056，低危）

除了上述安全问题，还包含了针对以下缺陷的补丁：

* 某些 BCM5703x 网卡的 tg3 驱动程序的初始化错误

* 审计子系统中的内存泄漏

* x86_64 nmi 监视程序超时过短

* ext2/3 目录读取间歇性失败

Red Hat 在此感谢 Dmitriy Monakhov 和 Kostantin Khorenko 报告此勘误表中修复的问题。

建议所有 Red Hat Enterprise Linux 4 用户将其内核升级到与此勘误表中列出的计算机架构及配置相关的程序包。

來自 Red Hat 安全性公告 2007:0014：

現已提供適用於 Red Hat Enterprise Linux 4 核心的更新版核心套件，可修正數個安全性問題。

Red Hat 安全性回應團隊已將此安全性公告的安全性影響程度評為重要。

Linux 核心負責處理作業系統的基本功能。

這些新的核心套件包含如下所述之安全性問題的修正：

* 網路橋接支援的 get_fdb_entries 函式中有一個瑕疵，其允許本機使用者造成拒絕服務 (當機)，或可能提升權限 (CVE-2006-5751，重要)

* _block_prepare_write 函式有一個資訊洩漏弱點，允許本機使用者讀取核心記憶體 (CVE-2006-4813，重要)

* s390 與 s390x 平台上 copy_from_user() 實作有一個資訊洩漏弱點，允許本機使用者讀取任意核心記憶體 (CVE-2006-5174，重要)

* /proc/net/ip6_flowlabel 處理過程有一個瑕疵，允許本機使用者造成拒絕服務 (無限迴圈) (CVE-2006-5619，重要)

* AIO 處理過程有一個瑕疵，允許本機使用者造成拒絕服務 (不穩定) (CVE-2006-5754，重要)

* 在 mincore 系統核心中有一個爭用情形，其允許本機使用者造成拒絕服務 (系統懸置) (CVE-2006-4814，中等)

* ia64 和 sparc 架構上的 ELF 處理過程有一個瑕疵，其可觸發跨區域記憶體對應，並允許本機使用者造成拒絕服務 (CVE-2006-4538，中等)

* 網路子系統的 dev_queue_xmit 函式中有一個瑕疵，允許本機使用者造成拒絕服務 (資料損毀) (CVE-2006-6535，中等)

* 透過藍牙處理 CAPI 訊息時有一個瑕疵，允許遠端系統造成拒絕服務，或可能執行程式碼。只有在有權限的使用者建立連線至惡意遠端裝置時，此瑕疵才會遭到惡意利用 (CVE-2006-6106，中等)

* listxattr 系統呼叫有一個瑕疵，允許本機使用者造成拒絕服務 (資料損毀) 或可能提升權限。必須存有不良的 inode，才能成功惡意利用此瑕疵 (CVE-2006-5753，中等)

* __find_get_block_slow 函式有一個瑕疵，允許有權限的本機使用者造成拒絕服務 (CVE-2006-5757，低)

* 支援的檔案系統有多種瑕疵，允許有權限的本機使用者造成拒絕服務 (CVE-2006-5823、CVE-2006-6053、CVE-2006-6054、CVE-2006-6056，低)

除了上述安全性問題，還納入下列錯誤的修正：

* 具有某 BCM5703x 網路卡之 tg3 驅動程式的初始化錯誤

* 稽核子系統有一個記憶體洩漏問題

* x86_64 nmi 看門狗逾時太短

* ext2/3 目錄讀取間歇性失敗

Red Hat 要感謝 Dmitriy Monakhov 和 Kostantin Khorenko 報告已於此錯字勘誤表中修正的問題。

建議所有 Red Hat Enterprise Linux 4 使用者皆根據所用之機器架構和組態，將核心升級至此錯字勘誤表中所列的對應套件。

Mark Dowd discovered that the netfilter iptables module did not correcly handle fragmented packets. By sending specially crafted packets, a remote attacker could exploit this to bypass firewall rules. This has only be fixed for Ubuntu 6.10; the corresponding fix for Ubuntu 5.10 and 6.06 will follow soon. (CVE-2006-4572)

Dmitriy Monakhov discovered an information leak in the
__block_prepare_write() function. During error recovery, this function did not properly clear memory buffers which could allow local users to read portions of unlinked files. This only affects Ubuntu 5.10.
(CVE-2006-4813)

ADLab Venustech Info Ltd discovered that the ATM network driver referenced an already released pointer in some circumstances. By sending specially crafted packets to a host over ATM, a remote attacker could exploit this to crash that host. This does not affect Ubuntu 6.10. (CVE-2006-4997)

Matthias Andree discovered that the NFS locking management daemon (lockd) did not correctly handle mixing of 'lock' and 'nolock' option mounts on the same client. A remote attacker could exploit this to crash lockd and thus rendering the NFS imports inaccessible. This only affects Ubuntu 5.10. (CVE-2006-5158)

The task switching code did not save and restore EFLAGS of processes.
By starting a specially crafted executable, a local attacker could exploit this to eventually crash many other running processes. This does not affect Ubuntu 6.10. (CVE-2006-5173)

James Morris discovered that the ip6fl_get_n() function incorrectly handled flow labels. A local attacker could exploit this to crash the kernel. (CVE-2006-5619)

Fabio Massimo Di Nitto discovered that the sys_get_robust_list and sys_set_robust_list system calls lacked proper lock handling on the powerpc platform. A local attacker could exploit this to create unkillable processes, drain all available CPU/memory, and render the machine unrebootable. This only affects Ubuntu 6.10. (CVE-2006-5648)

Fabio Massimo Di Nitto discovered a flaw in the alignment check exception handling on the powerpc platform. A local attacker could exploit this to cause a kernel panic and crash the machine.
(CVE-2006-5649)

Certain corrupted squashfs file system images caused a memory allocation to be freed twice. By mounting a specially crafted squashfs file system, a local attacker could exploit this to crash the kernel.
This does not affect Ubuntu 5.10. (CVE-2006-5701)

An integer overflow was found in the get_fdb_entries() function of the network bridging code. By executing a specially crafted ioctl, a local attacker could exploit this to execute arbitrary code with root privileges. (CVE-2006-5751).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2007-0014.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
67438	Oracle Linux 4 : kernel (ELSA-2007-0014)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
36838	CentOS 4 : kernel (CESA-2007:0014)	Nessus	CentOS Local Security Checks	2009/4/23	2021/1/4	high
67438	Oracle Linux 4：カーネル（ELSA-2007-0014）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
23846	Debian DSA-1233-1 : kernel-source-2.6.8 - several vulnerabilities	Nessus	Debian Local Security Checks	2006/12/14	2021/1/4	high
24628	Mandrake Linux Security Advisory : kernel (MDKSA-2007:012)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	high
67438	Oracle Linux 4：kernel (ELSA-2007-0014)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
67438	Oracle Linux 4：kernel (ELSA-2007-0014)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
24315	RHEL 4 : kernel (RHSA-2007:0014)	Nessus	Red Hat Local Security Checks	2007/2/9	2021/1/14	high
27981	Ubuntu 5.10 / 6.06 LTS / 6.10 : linux-source-2.6.12/-2.6.15/-2.6.17 vulnerabilities (USN-395-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
801424	CentOS RHSA-2007-0014 Security Check	Log Correlation Engine	Generic			high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high