Vulnerabilities > CVE-2007-1592 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Linux Kernel
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
net/ipv6/tcp_ipv6.c in Linux kernel 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double free by opening a listening IPv6 socket, attaching a flow label, and connecting to that socket.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-0436.NASL description Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the ninth regular update. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. This is the ninth regular kernel update to Red Hat Enterprise Linux 3. There were no new features introduced by this update. The only changes that have been included address critical customer needs or security issues (elaborated below). Key areas affected by fixes in this update include the networking subsystem, dcache handling, the ext2 and ext3 file systems, the USB subsystem, ACPI handling, and the audit subsystem. There were also several isolated fixes in the tg3, e1000, megaraid_sas, and aacraid device drivers. The following security bugs were fixed in this update : * a flaw in the cramfs file system that allowed invalid compressed data to cause memory corruption (CVE-2006-5823, low) * a flaw in the ext2 file system that allowed an invalid inode size to cause a denial of service (system hang) (CVE-2006-6054, low) * a flaw in IPV6 flow label handling that allowed a local user to cause a denial of service (crash) (CVE-2007-1592, important) Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed. All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum. last seen 2020-06-01 modified 2020-06-02 plugin id 25479 published 2007-06-12 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25479 title RHEL 3 : kernel (RHSA-2007:0436) NASL family Scientific Linux Local Security Checks NASL id SL_20070611_KERNEL_ON_SL3.NASL description There were no new features introduced by this update. The only changes that have been included address critical customer needs or security issues (elaborated below). Key areas affected by fixes in this update include the networking subsystem, dcache handling, the ext2 and ext3 file systems, the USB subsystem, ACPI handling, and the audit subsystem. There were also several isolated fixes in the tg3, e1000, megaraid_sas, and aacraid device drivers. The following security bugs were fixed in this update : - a flaw in the cramfs file system that allowed invalid compressed data to cause memory corruption (CVE-2006-5823, low) - a flaw in the ext2 file system that allowed an invalid inode size to cause a denial of service (system hang) (CVE-2006-6054, low) - a flaw in IPV6 flow label handling that allowed a local user to cause a denial of service (crash) (CVE-2007-1592, important) last seen 2020-06-01 modified 2020-06-02 plugin id 60200 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60200 title Scientific Linux Security Update : kernel on SL3.x i386/x86_64 NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-0347.NASL description Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the following security issues : * a flaw in the handling of IPv6 type 0 routing headers that allowed remote users to cause a denial of service that led to a network amplification between two routers (CVE-2007-2242, Important). * a flaw in the nfnetlink_log netfilter module that allowed a local user to cause a denial of service (CVE-2007-1496, Important). * a flaw in the flow list of listening IPv6 sockets that allowed a local user to cause a denial of service (CVE-2007-1592, Important). * a flaw in the handling of netlink messages that allowed a local user to cause a denial of service (infinite recursion) (CVE-2007-1861, Important). * a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access (CVE-2007-2172, Important). * a flaw in the nf_conntrack netfilter module for IPv6 that allowed remote users to bypass certain netfilter rules using IPv6 fragments (CVE-2007-1497, Moderate). In addition to the security issues described above, fixes for the following have been included : * a regression in ipv6 routing. * an error in memory initialization that caused gdb to output inaccurate backtraces on ia64. * the nmi watchdog timeout was updated from 5 to 30 seconds. * a flaw in distributed lock management that could result in errors during virtual machine migration. * an omitted include in kernel-headers that led to compile failures for some packages. Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 25333 published 2007-05-25 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25333 title RHEL 5 : kernel (RHSA-2007:0347) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-078.NASL description Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056). Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges. (CVE-2007-0005) The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772). A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958). The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference. (CVE-2007-1000) Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet. (CVE-2007-1217) The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux kernel 2.6.17, and possibly other versions, allows local users to cause a denial of service (oops) by calling setsockopt with the IPV6_RTHDR option name and possibly a zero option length or invalid option value, which triggers a NULL pointer dereference. (CVE-2007-1388) net/ipv6/tcp_ipv6.c in Linux kernel 2.4 and 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double-free by opening a listeing IPv6 socket, attaching a flow label, and connecting to that socket. (CVE-2007-1592) The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes. In addition to these security fixes, other fixes have been included such as : - Suspend to disk speed improvements - Add nmi watchdog support for core2 - Add atl1 driver - Update KVM - Add acer_acpi - Update asus_acpi - Fix suspend on r8169, i8259A - Fix suspend when using ondemand governor - Add ide acpi support - Add suspend/resume support for sata_nv chipsets. - USB: Let USB-Serial option driver handle anydata devices (#29066) - USB: Add PlayStation 2 Trance Vibrator driver - Fix bogus delay loop in video/aty/mach64_ct.c - Add MCP61 support (#29398) - USB: fix floppy drive SAMSUNG SFD-321U/EP detected 8 times bug - Improve keyboard handling on Apple MacBooks - Add -latest patch - Workaround a possible binutils bug in smp alternatives - Add forcedeth support - Fix potential deadlock in driver core (USB hangs at boot time #24683) To update your kernel, please follow the directions located at : http://www.mandriva.com/en/security/kernelupdate last seen 2020-06-01 modified 2020-06-02 plugin id 24944 published 2007-04-05 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24944 title Mandrake Linux Security Advisory : kernel (MDKSA-2007:078) NASL family Scientific Linux Local Security Checks NASL id SL_20070516_KERNEL_ON_SL5_X.NASL description These new kernel packages contain fixes for the following security issues : - a flaw in the handling of IPv6 type 0 routing headers that allowed remote users to cause a denial of service that led to a network amplification between two routers (CVE-2007-2242, Important). - a flaw in the nfnetlink_log netfilter module that allowed a local user to cause a denial of service (CVE-2007-1496, Important). - a flaw in the flow list of listening IPv6 sockets that allowed a local user to cause a denial of service (CVE-2007-1592, Important). - a flaw in the handling of netlink messages that allowed a local user to cause a denial of service (infinite recursion) (CVE-2007-1861, Important). - a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access (CVE-2007-2172, Important). - a flaw in the nf_conntrack netfilter module for IPv6 that allowed remote users to bypass certain netfilter rules using IPv6 fragments (CVE-2007-1497, Moderate). In addition to the security issues described above, fixes for the following have been included : - a regression in ipv6 routing. - an error in memory initialization that caused gdb to output inaccurate backtraces on ia64. - the nmi watchdog timeout was updated from 5 to 30 seconds. - a flaw in distributed lock management that could result in errors during virtual machine migration. - an omitted include in kernel-headers that led to compile failures for some packages. last seen 2020-06-01 modified 2020-06-02 plugin id 60181 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60181 title Scientific Linux Security Update : kernel on SL5.x i386/x86_64 NASL family SuSE Local Security Checks NASL id SUSE_KERNEL-3128.NASL description This kernel update fixes the following security problems : - CVE-2007-1000 A NULL pointer dereference in the IPv6 sockopt handling can be used by local attackers to read arbitrary kernel memory and so gain access to private information. - CVE-2007-1388 A NULL pointer dereference could be used by local attackers to cause a Oops / crash of the machine. - CVE-2007-1592 A possible double free in the ipv6/flowlabel handling was fixed. - CVE-2007-1357 A remote denial of service attack in the AppleTalk protocol handler was fixed. This attack is only possible on the local subnet, and requires the AppleTalk protocol module to be loaded (which is not done by default). and the following non security bugs : - patches.fixes/visor_write_race.patch: fix race allowing overstepping memory limit in visor_write (Mainline: 2.6.21) - patches.drivers/libata-ide-via-add-PCI-IDs: via82cxxx/pata_via: backport PCI IDs (254158). - libata: implement HDIO_GET_IDENTITY (255413). - sata_sil24: Add Adaptec 1220SA PCI ID. (Mainline: 2.6.21) - ide: backport hpt366 from devel tree (244502). - mm: fix madvise infinine loop (248167). - libata: hardreset on SERR_INTERNAL (241334). - limited WPA support for prism54 (207944) - jmicron: match class instead of function number (224784, 207707) - ahci: RAID mode SATA patch for Intel ICH9M (Mainline: 2.6.21) - libata: blacklist FUJITSU MHT2060BH for NCQ (Mainline: 2.6.21) - libata: add missing PM callbacks. (Mainline: 2.6.20) - patches.fixes/nfs-readdir-timestamp: Set meaningful value for fattr->time_start in readdirplus results. (244967). - patches.fixes/usb_volito.patch: wacom volito tablet not working (#248832). - patches.fixes/965-fix: fix detection of aperture size versus GTT size on G965 (#258013). - patches.fixes/sbp2-MODE_SENSE-fix.diff: use proper MODE SENSE, fixes recognition of device properties (261086) - patches.fixes/ipt_CLUSTERIP_refcnt_fix: ipv4/netfilter/ipt_CLUSTERIP.c - refcnt fix (238646) - patches.fixes/reiserfs-fix-vs-13060.diff: reiserfs: fix corruption with vs-13060 (257735). - patches.drivers/ati-rs400_200-480-disable-msi: pci-quirks: disable MSI on RS400-200 and RS480 (263893). - patches.drivers/libata-ahci-ignore-interr-on-SB600: ahci.c: walkaround for SB600 SATA internal error issue (#264792). Furthermore, CONFIG_USB_DEVICEFS has been re-enabled to allow use of USB in legacy applications like VMware. (#210899). last seen 2020-06-01 modified 2020-06-02 plugin id 27294 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27294 title openSUSE 10 Security Update : kernel (kernel-3128) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1286.NASL description Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-0005 Daniel Roethlisberger discovered two buffer overflows in the cm4040 driver for the Omnikey CardMan 4040 device. A local user or malicious device could exploit this to execute arbitrary code in kernel space. - CVE-2007-0958 Santosh Eraniose reported a vulnerability that allows local users to read otherwise unreadable files by triggering a core dump while using PT_INTERP. This is related to CVE-2004-1073. - CVE-2007-1357 Jean Delvare reported a vulnerability in the appletalk subsystem. Systems with the appletalk module loaded can be triggered to crash by other systems on the local network via a malformed frame. - CVE-2007-1592 Masayuki Nakagawa discovered that flow labels were inadvertently being shared between listening sockets and child sockets. This defect can be exploited by local users to cause a DoS (Oops). last seen 2020-06-01 modified 2020-06-02 plugin id 25153 published 2007-05-03 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25153 title Debian DSA-1286-1 : linux-2.6 - several vulnerabilities NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2007-0347.NASL description From Red Hat Security Advisory 2007:0347 : Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the following security issues : * a flaw in the handling of IPv6 type 0 routing headers that allowed remote users to cause a denial of service that led to a network amplification between two routers (CVE-2007-2242, Important). * a flaw in the nfnetlink_log netfilter module that allowed a local user to cause a denial of service (CVE-2007-1496, Important). * a flaw in the flow list of listening IPv6 sockets that allowed a local user to cause a denial of service (CVE-2007-1592, Important). * a flaw in the handling of netlink messages that allowed a local user to cause a denial of service (infinite recursion) (CVE-2007-1861, Important). * a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access (CVE-2007-2172, Important). * a flaw in the nf_conntrack netfilter module for IPv6 that allowed remote users to bypass certain netfilter rules using IPv6 fragments (CVE-2007-1497, Moderate). In addition to the security issues described above, fixes for the following have been included : * a regression in ipv6 routing. * an error in memory initialization that caused gdb to output inaccurate backtraces on ia64. * the nmi watchdog timeout was updated from 5 to 30 seconds. * a flaw in distributed lock management that could result in errors during virtual machine migration. * an omitted include in kernel-headers that led to compile failures for some packages. Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67495 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67495 title Oracle Linux 5 : kernel (ELSA-2007-0347) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-464-1.NASL description Philipp Richter discovered that the AppleTalk protocol handler did not sufficiently verify the length of packets. By sending a crafted AppleTalk packet, a remote attacker could exploit this to crash the kernel. (CVE-2007-1357) Gabriel Campana discovered that the do_ipv6_setsockopt() function did not sufficiently verifiy option values for IPV6_RTHDR. A local attacker could exploit this to trigger a kernel crash. (CVE-2007-1388) A Denial of Service vulnerability was discovered in the nfnetlink_log() netfilter function. A remote attacker could exploit this to trigger a kernel crash. (CVE-2007-1496) The connection tracking module for IPv6 did not properly handle the status field when reassembling fragmented packets, so that the final packet always had the last seen 2020-06-01 modified 2020-06-02 plugin id 28064 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28064 title Ubuntu 6.06 LTS / 6.10 / 7.04 : linux-source-2.6.15/2.6.17/2.6.20 vulnerabilities (USN-464-1) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2007-0347.NASL description Updated kernel packages that fix security issues and bugs in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the following security issues : * a flaw in the handling of IPv6 type 0 routing headers that allowed remote users to cause a denial of service that led to a network amplification between two routers (CVE-2007-2242, Important). * a flaw in the nfnetlink_log netfilter module that allowed a local user to cause a denial of service (CVE-2007-1496, Important). * a flaw in the flow list of listening IPv6 sockets that allowed a local user to cause a denial of service (CVE-2007-1592, Important). * a flaw in the handling of netlink messages that allowed a local user to cause a denial of service (infinite recursion) (CVE-2007-1861, Important). * a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access (CVE-2007-2172, Important). * a flaw in the nf_conntrack netfilter module for IPv6 that allowed remote users to bypass certain netfilter rules using IPv6 fragments (CVE-2007-1497, Moderate). In addition to the security issues described above, fixes for the following have been included : * a regression in ipv6 routing. * an error in memory initialization that caused gdb to output inaccurate backtraces on ia64. * the nmi watchdog timeout was updated from 5 to 30 seconds. * a flaw in distributed lock management that could result in errors during virtual machine migration. * an omitted include in kernel-headers that led to compile failures for some packages. Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43641 published 2010-01-06 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43641 title CentOS 5 : kernel (CESA-2007:0347) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1304.NASL description CVE-2006-6060 CVE-2006-6106 CVE-2006-6535 CVE-2007-0958 CVE-2007-1357 CVE-2007-1592 Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. This update also fixes a regression in the smbfs subsystem which was introduced in DSA-1233which caused symlinks to be interpreted as regular files. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4811 David Gibson reported an issue in the hugepage code which could permit a local DoS (system crash) on appropriately configured systems. - CVE-2006-4814 Doug Chapman discovered a potential local DoS (deadlock) in the mincore function caused by improper lock handling. - CVE-2006-4623 Ang Way Chuang reported a remote DoS (crash) in the dvb driver which can be triggered by a ULE package with an SNDU length of 0. - CVE-2006-5753 Eric Sandeen provided a fix for a local memory corruption vulnerability resulting from a misinterpretation of return values when operating on inodes which have been marked bad. - CVE-2006-5754 Darrick Wong discovered a local DoS (crash) vulnerability resulting from the incorrect initialization of last seen 2020-06-01 modified 2020-06-02 plugin id 25529 published 2007-06-18 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25529 title Debian DSA-1304-1 : kernel-source-2.6.8 - several vulnerabilities NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1503.NASL description Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2004-2731 infamous41md reported multiple integer overflows in the Sbus PROM driver that would allow for a DoS (Denial of Service) attack by a local user, and possibly the execution of arbitrary code. - CVE-2006-4814 Doug Chapman discovered a potential local DoS (deadlock) in the mincore function caused by improper lock handling. - CVE-2006-5753 Eric Sandeen provided a fix for a local memory corruption vulnerability resulting from a misinterpretation of return values when operating on inodes which have been marked bad. - CVE-2006-5823 LMH reported a potential local DoS which could be exploited by a malicious user with the privileges to mount and read a corrupted cramfs filesystem. - CVE-2006-6053 LMH reported a potential local DoS which could be exploited by a malicious user with the privileges to mount and read a corrupted ext3 filesystem. - CVE-2006-6054 LMH reported a potential local DoS which could be exploited by a malicious user with the privileges to mount and read a corrupted ext2 filesystem. - CVE-2006-6106 Marcel Holtman discovered multiple buffer overflows in the Bluetooth subsystem which can be used to trigger a remote DoS (crash) and potentially execute arbitrary code. - CVE-2007-1353 Ilja van Sprundel discovered that kernel memory could be leaked via the Bluetooth setsockopt call due to an uninitialized stack buffer. This could be used by local attackers to read the contents of sensitive kernel memory. - CVE-2007-1592 Masayuki Nakagawa discovered that flow labels were inadvertently being shared between listening sockets and child sockets. This defect can be exploited by local users to cause a DoS (Oops). - CVE-2007-2172 Thomas Graf reported a typo in the DECnet protocol handler that could be used by a local attacker to overrun an array via crafted packets, potentially resulting in a Denial of Service (system crash). A similar issue exists in the IPV4 protocol handler and will be fixed in a subsequent update. - CVE-2007-2525 Florian Zumbiehl discovered a memory leak in the PPPOE subsystem caused by releasing a socket before PPPIOCGCHAN is called upon it. This could be used by a local user to DoS a system by consuming all available memory. - CVE-2007-3848 Wojciech Purczynski discovered that pdeath_signal was not being reset properly under certain conditions which may allow local users to gain privileges by sending arbitrary signals to suid binaries. - CVE-2007-4308 Alan Cox reported an issue in the aacraid driver that allows unprivileged local users to make ioctl calls which should be restricted to admin privileges. - CVE-2007-4311 PaX team discovered an issue in the random driver where a defect in the reseeding code leads to a reduction in entropy. - CVE-2007-5093 Alex Smith discovered an issue with the pwc driver for certain webcam devices. If the device is removed while a userspace application has it open, the driver will wait for userspace to close the device, resulting in a blocked USB subsystem. This issue is of low security impact as it requires the attacker to either have physical access to the system or to convince a user with local access to remove the device on their behalf. - CVE-2007-6063 Venustech AD-LAB discovered a a buffer overflow in the isdn ioctl handling, exploitable by a local user. - CVE-2007-6151 ADLAB discovered a possible memory overrun in the ISDN subsystem that may permit a local user to overwrite kernel memory by issuing ioctls with unterminated data. - CVE-2007-6206 Blake Frantz discovered that when a core file owned by a non-root user exists, and a root-owned process dumps core over it, the core file retains its original ownership. This could be used by a local user to gain access to sensitive information. - CVE-2007-6694 Cyrill Gorcunov reported a NULL pointer dereference in code specific to the CHRP PowerPC platforms. Local users could exploit this issue to achieve a Denial of Service (DoS). - CVE-2008-0007 Nick Piggin of SuSE discovered a number of issues in subsystems which register a fault handler for memory mapped areas. This issue can be exploited by local users to achieve a Denial of Service (DoS) and possibly execute arbitrary code. The following matrix lists additional packages that were rebuilt for compatibility with or to take advantage of this update : Debian 3.1 (sarge) alsa-modules-i386 1.0.8+2sarge2 kernel-image-2.4.27-arm 2.4.27-2sarge6 kernel-image-2.4.27-m68k 2.4.27-3sarge6 kernel-image-speakup-i386 2.4.27-1.1sarge5 kernel-image-2.4.27-alpha 2.4.27-10sarge6 kernel-image-2.4.27-s390 2.4.27-2sarge6 kernel-image-2.4.27-sparc 2.4.27-9sarge6 kernel-image-2.4.27-i386 2.4.27-10sarge6 kernel-image-2.4.27-ia64 2.4.27-10sarge6 kernel-patch-2.4.27-mips 2.4.27-10.sarge4.040815-3 kernel-patch-powerpc-2.4.27 2.4.27-10sarge6 kernel-latest-2.4-alpha 101sarge3 kernel-latest-2.4-i386 101sarge2 kernel-latest-2.4-s390 2.4.27-1sarge2 kernel-latest-2.4-sparc 42sarge3 i2c 1:2.9.1-1sarge2 lm-sensors 1:2.9.1-1sarge4 mindi-kernel 2.4.27-2sarge5 pcmcia-modules-2.4.27-i386 3.2.5+2sarge2 hostap-modules-i386 1:0.3.7-1sarge3 systemimager 3.2.3-6sarge5 last seen 2020-06-01 modified 2020-06-02 plugin id 31147 published 2008-02-25 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/31147 title Debian DSA-1503-1 : kernel-source-2.4.27 - several vulnerabilities NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2007-0436.NASL description Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the ninth regular update. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. This is the ninth regular kernel update to Red Hat Enterprise Linux 3. There were no new features introduced by this update. The only changes that have been included address critical customer needs or security issues (elaborated below). Key areas affected by fixes in this update include the networking subsystem, dcache handling, the ext2 and ext3 file systems, the USB subsystem, ACPI handling, and the audit subsystem. There were also several isolated fixes in the tg3, e1000, megaraid_sas, and aacraid device drivers. The following security bugs were fixed in this update : * a flaw in the cramfs file system that allowed invalid compressed data to cause memory corruption (CVE-2006-5823, low) * a flaw in the ext2 file system that allowed an invalid inode size to cause a denial of service (system hang) (CVE-2006-6054, low) * a flaw in IPV6 flow label handling that allowed a local user to cause a denial of service (crash) (CVE-2007-1592, important) Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed. All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum. last seen 2020-06-01 modified 2020-06-02 plugin id 25498 published 2007-06-14 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25498 title CentOS 3 : kernel (CESA-2007:0436) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2007-0436.NASL description From Red Hat Security Advisory 2007:0436 : Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the ninth regular update. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. This is the ninth regular kernel update to Red Hat Enterprise Linux 3. There were no new features introduced by this update. The only changes that have been included address critical customer needs or security issues (elaborated below). Key areas affected by fixes in this update include the networking subsystem, dcache handling, the ext2 and ext3 file systems, the USB subsystem, ACPI handling, and the audit subsystem. There were also several isolated fixes in the tg3, e1000, megaraid_sas, and aacraid device drivers. The following security bugs were fixed in this update : * a flaw in the cramfs file system that allowed invalid compressed data to cause memory corruption (CVE-2006-5823, low) * a flaw in the ext2 file system that allowed an invalid inode size to cause a denial of service (system hang) (CVE-2006-6054, low) * a flaw in IPV6 flow label handling that allowed a local user to cause a denial of service (crash) (CVE-2007-1592, important) Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed. All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum. last seen 2020-06-01 modified 2020-06-02 plugin id 67516 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67516 title Oracle Linux 3 : kernel (ELSA-2007-0436) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-0672.NASL description Updated kernel packages that fix a number of security issues are now available for Red Hat Enterprise Linux 2.1 (32-bit architectures). This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the security issues described below : * a flaw in IPv6 flow label handling that allowed a local user to cause a denial of service (crash). (CVE-2007-1592, Important) * a flaw in the ISDN CAPI subsystem that allowed a remote user to cause a denial of service or potential privilege escalation. (CVE-2007-1217, Moderate) * a flaw in the Bluetooth subsystem that allowed a local user to trigger an information leak. (CVE-2007-1353, Low) * various flaws in the supported filesystems that allowed a local privileged user to cause a denial of service. (CVE-2006-6054, CVE-2006-6058, Low) Red Hat would like to thank Ilja van Sprundel for reporting an issue fixed in this erratum. All Red Hat Enterprise Linux 2.1 users are advised to upgrade their kernels to these updated packages, which contain backported fixes to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 25876 published 2007-08-13 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25876 title RHEL 2.1 : kernel (RHSA-2007:0672)
Oval
| accepted | 2013-04-29T04:02:02.653-04:00 | ||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||
| description | net/ipv6/tcp_ipv6.c in Linux kernel 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double free by opening a listening IPv6 socket, attaching a flow label, and connecting to that socket. | ||||||||||||||||||||||||||||||||
| family | unix | ||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:10130 | ||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||||||||||||||
| title | net/ipv6/tcp_ipv6.c in Linux kernel 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double free by opening a listening IPv6 socket, attaching a flow label, and connecting to that socket. | ||||||||||||||||||||||||||||||||
| version | 27 |
Redhat
| advisories |
| ||||||||||||||||||||
| rpms |
|
References
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.4
- http://www.securityfocus.com/bid/23104
- http://secunia.com/advisories/24618
- http://secunia.com/advisories/24777
- http://www.debian.org/security/2007/dsa-1286
- http://lists.suse.com/archive/suse-security-announce/2007-May/0001.html
- http://secunia.com/advisories/25078
- http://secunia.com/advisories/25099
- http://www.novell.com/linux/security/advisories/2007_30_kernel.html
- http://www.redhat.com/support/errata/RHSA-2007-0347.html
- http://secunia.com/advisories/25288
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=233478
- http://support.avaya.com/elmodocs2/security/ASA-2007-404.htm
- http://www.debian.org/security/2007/dsa-1304
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:078
- http://rhn.redhat.com/errata/RHSA-2007-0436.html
- http://www.redhat.com/support/errata/RHSA-2007-0673.html
- http://www.redhat.com/support/errata/RHSA-2007-0672.html
- http://www.novell.com/linux/security/advisories/2007_35_kernel.html
- http://www.novell.com/linux/security/advisories/2007_43_kernel.html
- http://www.ubuntu.com/usn/usn-464-1
- http://secunia.com/advisories/25392
- http://secunia.com/advisories/25630
- http://secunia.com/advisories/25683
- http://secunia.com/advisories/25714
- http://secunia.com/advisories/25961
- http://secunia.com/advisories/26379
- http://secunia.com/advisories/25226
- http://secunia.com/advisories/27528
- http://www.debian.org/security/2008/dsa-1503
- http://secunia.com/advisories/29058
- http://rhn.redhat.com/errata/RHBA-2007-0304.html
- http://www.vupen.com/english/advisories/2007/1084
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:051
- http://marc.info/?l=linux-netdev&m=117406721731891&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33176
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10130
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d35690beda1429544d46c8eb34b2e3a8c37ab299