Multiple information leaks have been found in the Linux kernel, allowing an attacker to obtain sensitive data which may be used for further exploitation of the system.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-kernel/aa-sources | * | < 2.6.5-r5 | >= 2.4.23-r2 (revision), >= 2.6.5-r5 |
| sys-kernel/alpha-sources | * | < 2.4.21-r12 | >= 2.4.21-r12 |
| sys-kernel/ck-sources | * | < 2.6.7-r5 | >= 2.4.26-r1 (revision), >= 2.6.7-r5 |
| sys-kernel/development-sources | * | < 2.6.8 | >= 2.6.8 |
| sys-kernel/gentoo-dev-sources | * | < 2.6.7-r12 | >= 2.6.7-r12 |
| sys-kernel/gentoo-sources | * | < 2.4.26-r9 | >= 2.4.19-r22 (revision), >= 2.4.20-r25 (revision), >= 2.4.22-r16 (revision), >= 2.4.25-r9 (revision), >= 2.4.26-r9 |
| sys-kernel/grsec-sources | * | < 2.4.27.2.0.1-r1 | >= 2.4.27.2.0.1-r1 |
| sys-kernel/gs-sources | * | < 2.4.25_pre7-r11 | >= 2.4.25_pre7-r11 |
| sys-kernel/hardened-dev-sources | * | < 2.6.7-r7 | >= 2.6.7-r7 |
| sys-kernel/hardened-sources | * | < 2.4.27-r1 | >= 2.4.27-r1 |
| sys-kernel/hppa-dev-sources | * | < 2.6.7_p14-r1 | >= 2.6.7_p14-r1 |
| sys-kernel/hppa-sources | * | < 2.4.26_p7-r1 | >= 2.4.26_p7-r1 |
| sys-kernel/ia64-sources | * | < 2.4.24-r10 | >= 2.4.24-r10 |
| sys-kernel/mips-sources | * | < 2.6.6-r8 | >= 2.4.25-r8 (revision), >= 2.4.26-r8 (revision), >= 2.6.4-r8 (revision), >= 2.6.6-r8 (revision), >= 2.6.7-r5 |
| sys-kernel/mm-sources | * | < 2.6.8_rc4-r1 | >= 2.6.8_rc4-r1 |
| sys-kernel/openmosix-sources | * | < 2.4.24-r4 | >= 2.4.24-r4 |
| sys-kernel/pac-sources | * | < 2.4.23-r12 | >= 2.4.23-r12 |
| sys-kernel/pegasos-dev-sources | * | < 2.6.8 | >= 2.6.8 |
| sys-kernel/rsbac-dev-sources | * | < 2.6.7-r5 | >= 2.6.7-r5 |
| sys-kernel/rsbac-sources | * | < 2.4.26-r5 | >= 2.4.26-r5 |
| sys-kernel/selinux-sources | * | < 2.4.26-r3 | >= 2.4.26-r3 |
| sys-kernel/sparc-sources | * | < 2.4.27-r1 | >= 2.4.27-r1 |
| sys-kernel/uclinux-sources | * | < 2.6.7_p0-r5 | >= 2.4.26_p0-r6 (revision), >= 2.6.7_p0-r5 |
| sys-kernel/usermode-sources | * | < 2.6.6-r6 | >= 2.4.24-r9 (revision), >= 2.4.26-r6 (revision), >= 2.6.6-r6 |
| sys-kernel/vanilla-sources | * | < 2.4.27 | >= 2.4.27 |
| sys-kernel/vserver-sources | * | < 2.4.26.1.28-r4, < 2.0, >= 2.4 | >= 2.0 |
| sys-kernel/win4lin-sources | * | < 2.6.7-r5 | >= 2.4.26-r6 (revision), >= 2.6.7-r2 |
| sys-kernel/wolk-sources | * | < 4.14-r7 | >= 4.9-r14 (revision), >= 4.11-r10 (revision), >= 4.14-r7 |
| sys-kernel/xbox-sources | * | < 2.6.7-r5 | >= 2.4.27-r1 (revision), >= 2.6.7-r5 |
The Linux kernel is responsible for managing the core aspects of a GNU/Linux system, providing an interface for core system applications as well as providing the essential structure and capability to access hardware that is needed for a running system.
The Linux kernel allows a local attacker to obtain sensitive kernel information by gaining access to kernel memory via several leaks in the /proc interfaces. These vulnerabilities exist in various drivers which make up a working Linux kernel, some of which are present across all architectures and configurations.
CAN-2004-0415 deals with addressing invalid 32 to 64 bit conversions in the kernel, as well as insecure direct access to file offset pointers in kernel code which can be modified by the open(...), lseek(...) and other core system I/O functions by an attacker.
CAN-2004-0685 deals with certain USB drivers using uninitialized structures and then using the copy_to_user(...) kernel call to copy these structures. This may leak uninitialized kernel memory, which can contain sensitive information from user applications.
Finally, a race condition with the /proc/.../cmdline node was found, allowing environment variables to be read while the process was still spawning. If the race is won, environment variables of the process, which might not be owned by the attacker, can be read.
These vulnerabilities allow a local unprivileged attacker to access segments of kernel memory or environment variables which may contain sensitive information. Kernel memory may contain passwords, data transferred between processes and any memory which applications did not clear upon exiting as well as the kernel cache and kernel buffers.
This information may be used to read sensitive data, open other attack vectors for further exploitation or cause a Denial of Service if the attacker can gain superuser access via the leaked information.
There is no temporary workaround for any of these information leaks other than totally disabling /proc support - otherwise, a kernel upgrade is required. A list of unaffected kernels is provided along with this announcement.
Users are encouraged to upgrade to the latest available sources for their system:
# emerge sync # emerge -pv your-favorite-sources # emerge your-favorite-sources # # Follow usual procedure for compiling and installing a kernel. # # If you use genkernel, run genkernel as you would normally.
Multiple permission vulnerabilities have been found in the Linux kernel, allowing an attacker to change the group IDs of files mounted on a remote filesystem (CAN-2004-0497), as well as an issue in 2.6 series kernels which allows /proc permissions to be bypassed. A context sharing vulnerability in vserver-sources is also handled by this advisory as well as CAN-2004-0447, CAN-2004-0496 and CAN-2004-0565. Patched, or updated versions of these kernels have been released and details are included along with this advisory.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-kernel/aa-sources | * | < 2.6.5-r5 | >= 2.4.23-r2 (revision), >= 2.6.5-r5 |
| sys-kernel/alpha-sources | * | < 2.4.21-r9 | >= 2.4.21-r9 |
| sys-kernel/ck-sources | * | < 2.6.7-r5 | >= 2.4.26-r1 (revision), >= 2.6.7-r5 |
| sys-kernel/compaq-sources | * | < 2.4.9.32.7-r8 | >= 2.4.9.32.7-r8 |
| sys-kernel/development-sources | * | < 2.6.8_rc1 | >= 2.6.8_rc1 |
| sys-kernel/gentoo-dev-sources | * | < 2.6.7-r8 | >= 2.6.7-r8 |
| sys-kernel/gentoo-sources | * | < 2.4.26-r5 | >= 2.4.19-r18 (revision), >= 2.4.20-r21 (revision), >= 2.4.22-r13 (revision), >= 2.4.25-r6 (revision), >= 2.4.26-r5 |
| sys-kernel/grsec-sources | * | < 2.4.26.2.0-r6 | >= 2.4.26.2.0-r6 |
| sys-kernel/gs-sources | * | < 2.4.25_pre7-r8 | >= 2.4.25_pre7-r8 |
| sys-kernel/hardened-dev-sources | * | < 2.6.7-r2 | >= 2.6.7-r2 |
| sys-kernel/hardened-sources | * | < 2.4.26-r3 | >= 2.4.26-r3 |
| sys-kernel/hppa-dev-sources | * | < 2.6.7_p1-r2 | >= 2.6.7_p1-r2 |
| sys-kernel/hppa-sources | * | < 2.4.26_p6-r1 | >= 2.4.26_p6-r1 |
| sys-kernel/ia64-sources | * | < 2.4.24-r7 | >= 2.4.24-r7 |
| sys-kernel/mips-sources | * | < 2.4.27 | >= 2.4.27 |
| sys-kernel/mm-sources | * | < 2.6.7-r6 | >= 2.6.7-r6 |
| sys-kernel/openmosix-sources | * | < 2.4.22-r11 | >= 2.4.22-r11 |
| sys-kernel/pac-sources | * | < 2.4.23-r9 | >= 2.4.23-r9 |
| sys-kernel/pegasos-dev-sources | * | < 2.6.7-r2 | >= 2.6.7-r2 |
| sys-kernel/pegasos-sources | * | < 2.4.26-r3 | >= 2.4.26-r3 |
| sys-kernel/planet-ccrma-sources | * | < 2.4.21-r11 | >= 2.4.21-r11 |
| sys-kernel/ppc-sources | * | < 2.4.26-r3 | >= 2.4.26-r3 |
| sys-kernel/rsbac-dev-sources | * | < 2.6.7-r2 | >= 2.6.7-r2 |
| sys-kernel/rsbac-sources | * | < 2.4.26-r3 | >= 2.4.26-r3 |
| sys-kernel/selinux-sources | * | < 2.4.26-r2 | >= 2.4.26-r2 |
| sys-kernel/sparc-sources | * | < 2.4.26-r3 | >= 2.4.26-r3 |
| sys-kernel/uclinux-sources | * | < 2.6.7_p0-r2 | >= 2.4.26_p0-r3 (revision), >= 2.6.7_p0-r2 |
| sys-kernel/usermode-sources | * | < 2.6.6-r4 | >= 2.4.24-r6 (revision), >= 2.4.26-r3 (revision), >= 2.6.6-r4 |
| sys-kernel/vanilla-sources | * | <= 2.4.26 | >= 2.4.27 |
| sys-kernel/vserver-sources | * | < 2.4.26.1.28-r1, >= 2.4, < 2.0 | >= 2.0 |
| sys-kernel/win4lin-sources | * | < 2.6.7-r2 | >= 2.4.26-r3 (revision), >= 2.6.7-r2 |
| sys-kernel/wolk-sources | * | < 4.14-r4 | >= 4.9-r10 (revision), >= 4.11-r7 (revision), >= 4.14-r4 |
| sys-kernel/xbox-sources | * | < 2.6.7-r2 | >= 2.4.26-r3 (revision), >= 2.6.7-r2 |
The Linux kernel is responsible for managing the core aspects of a GNU/Linux system, providing an interface for core system applications as well as providing the essential structure and capability to access hardware that is needed for a running system.
The Linux kernel allows a local attacker to mount a remote file system on a vulnerable Linux host and modify files' group IDs. On 2.4 series kernels this vulnerability only affects shared NFS file systems. This vulnerability has been assigned CAN-2004-0497 by the Common Vulnerabilities and Exposures project.
Also, a flaw in the handling of /proc attributes has been found in 2.6 series kernels; allowing the unauthorized modification of /proc entries, especially those which rely solely on file permissions for security to vital kernel parameters.
An issue specific to the VServer Linux sources has been found, by which /proc related changes in one virtual context are applied to other contexts as well, including the host system.
CAN-2004-0447 resolves a local DoS vulnerability on IA64 platforms which can cause unknown behaviour and CAN-2004-0565 resolves a floating point information leak on IA64 platforms by which registers of other processes can be read by a local user.
Finally, CAN-2004-0496 addresses some more unknown vulnerabilities in 2.6 series Linux kernels older than 2.6.7 which were found by the Sparse source code checking tool.
Bad Group IDs can possibly cause a Denial of Service on parts of a host if the changed files normally require a special GID to properly operate. By exploiting this vulnerability, users in the original file group would also be blocked from accessing the changed files.
The /proc attribute vulnerability allows local users with previously no permissions to certain /proc entries to exploit the vulnerability and then gain read, write and execute access to entries.
These new privileges can be used to cause unknown behaviour ranging from reduced system performance to a Denial of Service by manipulating various kernel options which are usually reserved for the superuser. This flaw might also be used for opening restrictions set through /proc entries, allowing further attacks to take place through another possibly unexpected attack vector.
The VServer issue can also be used to induce similar unexpected behaviour to other VServer contexts, including the host. By successful exploitation, a Denial of Service for other contexts can be caused allowing only root to read certain /proc entries. Such a change would also be replicated to other contexts, forbidding normal users on those contexts to read /proc entries which could contain details needed by daemons running as a non-root user, for example.
Additionally, this vulnerability allows an attacker to read information from another context, possibly hosting a different server, gaining critical information such as what processes are running. This may be used for furthering the exploitation of either context.
CAN-2004-0447 and CAN-2004-0496 permit various local unknown Denial of Service vulnerabilities with unknown impacts - these vulnerabilities can be used to possibly elevate privileges or access reserved kernel memory which can be used for further exploitation of the system.
CAN-2004-0565 allows FPU register values of other processes to be read by a local user setting the MFH bit during a floating point operation - since no check was in place to ensure that the FPH bit was owned by the requesting process, but only an MFH bit check, an attacker can simply set the MFH bit and access FPU registers of processes running as other users, possibly those running as root.
2.4 users may not be affected by CAN-2004-0497 if they do not use remote network filesystems and do not have support for any such filesystems in their kernel configuration. All 2.6 users are affected by the /proc attribute issue and the only known workaround is to disable /proc support. The VServer flaw applies only to vserver-sources, and no workaround is currently known for the issue. There is no known fix to CAN-2004-0447, CAN-2004-0496 or CAN-2004-0565 other than to upgrade the kernel to a patched version.
As a result, all users affected by any of these vulnerabilities should upgrade their kernels to ensure the integrity of their systems.
Users are encouraged to upgrade to the latest available sources for their system:
# emerge sync # emerge -pv your-favorite-sources # emerge your-favorite-sources # # Follow usual procedure for compiling and installing a kernel. # # If you use genkernel, run genkernel as you would do normally.
Multiple vulnerabilities have been found in the Linux kernel used by GNU/Linux systems. Patched, or updated versions of these kernels have been released and details are included in this advisory.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-kernel/aa-sources | * | < 2.4.23-r2 | = 2.4.23-r2 |
| sys-kernel/alpha-sources | * | < 2.4.21-r8 | >= 2.4.21-r8 |
| sys-kernel/ck-sources | * | < 2.6.7-r1 | = 2.4.26-r1, >= 2.6.7-r1 |
| sys-kernel/compaq-sources | * | < 2.4.9.32.7-r7 | >= 2.4.9.32.7-r7 |
| sys-kernel/development-sources | * | < 2.6.7 | >= 2.6.7 |
| sys-kernel/gaming-sources | * | < 2.4.20-r14 | >= 2.4.20-r14 |
| sys-kernel/gentoo-dev-sources | * | < 2.6.7 | >= 2.6.7 |
| sys-kernel/gentoo-sources | * | < 2.4.26-r3 | >= 2.4.19-r17 (revision), >= 2.4.20-r20 (revision), >= 2.4.22-r12 (revision), >= 2.4.25-r5 (revision), >= 2.4.26-r3 |
| sys-kernel/grsec-sources | * | < 2.4.26.2.0-r5 | >= 2.4.26.2.0-r5 |
| sys-kernel/gs-sources | * | < 2.4.25_pre7-r7 | >= 2.4.25_pre7-r7 |
| sys-kernel/hardened-dev-sources | * | < 2.6.7 | >= 2.6.7 |
| sys-kernel/hardened-sources | * | < 2.4.26-r2 | >= 2.4.26-r2 |
| sys-kernel/hppa-dev-sources | * | < 2.6.7 | >= 2.6.7 |
| sys-kernel/hppa-sources | * | < 2.4.26_p6 | >= 2.4.26_p6 |
| sys-kernel/ia64-sources | * | < 2.4.24-r5 | >= 2.4.24-r5 |
| sys-kernel/mips-sources | * | < 2.4.26-r3 | >= 2.4.26-r3 |
| sys-kernel/mm-sources | * | < 2.6.7-r1 | >= 2.6.7-r1 |
| sys-kernel/openmosix-sources | * | < 2.4.22-r10 | >= 2.4.22-r10 |
| sys-kernel/pac-sources | * | < 2.4.23-r8 | >= 2.4.23-r8 |
| sys-kernel/pegasos-dev-sources | * | < 2.6.7 | >= 2.6.7 |
| sys-kernel/pegasos-sources | * | < 2.4.26-r2 | >= 2.4.26-r2 |
| sys-kernel/planet-ccrma-sources | * | < 2.4.21-r10 | >= 2.4.21-r10 |
| sys-kernel/ppc-sources | * | < 2.4.26-r2 | >= 2.4.26-r2 |
| sys-kernel/ppc64-sources | * | < 2.6.7 | >= 2.6.7 |
| sys-kernel/rsbac-dev-sources | * | < 2.6.7-r1 | >= 2.6.7-r1 |
| sys-kernel/rsbac-sources | * | < 2.4.26-r2 | >= 2.4.26-r2 |
| sys-kernel/selinux-sources | * | < 2.4.26-r2 | >= 2.4.26-r2 |
| sys-kernel/sparc-sources | * | < 2.4.26-r2 | >= 2.4.26-r2 |
| sys-kernel/uclinux-sources | * | < 2.4.26_p0-r2 | >= 2.4.26_p0-r2 |
| sys-kernel/usermode-sources | * | < 2.4.26-r2 | >= 2.4.24-r5 (revision), >= 2.4.26-r2 |
| sys-kernel/vanilla-sources | * | <= 2.4.26 | >= 2.4.27 |
| sys-kernel/vserver-sources | * | < 2.0, >= 2.4, < 2.4.26.1.3.9-r2 | >= 2.0 |
| sys-kernel/win4lin-sources | * | < 2.4.26-r2 | >= 2.4.26-r2 |
| sys-kernel/wolk-sources | * | < 4.14-r3 | >= 4.9-r9 (revision), >= 4.11-r6 (revision), >= 4.14-r3 |
| sys-kernel/xbox-sources | * | < 2.6.7 | >= 2.6.7 |
| sys-kernel/xfs-sources | * | < 2.4.24-r8 | >= 2.4.24-r8 |
The Linux kernel is responsible for managing the core aspects of a GNU/Linux system, providing an interface for core system applications as well as providing the essential structure and capability to access hardware that is needed for a running system.
Multiple flaws have been discovered in the Linux kernel. This advisory corrects the following issues:
Arbitrary code with normal non-super-user privileges may be able to exploit any of these vulnerabilities; gaining kernel level access to memory structures and hardware devices. This may be used for further exploitation of the system, to leak sensitive data or to cause a Denial of Service on the affected kernel.
Although users may not be affected by certain vulnerabilities, all kernels are affected by the CAN-2004-0394, CAN-2004-0427 and CAN-2004-0554 issues which have no workaround. As a result, all users are urged to upgrade their kernels to patched versions.
Users are encouraged to upgrade to the latest available sources for their system:
# emerge sync # emerge -pv your-favorite-sources # emerge your-favorite-sources # # Follow usual procedure for compiling and installing a kernel. # # If you use genkernel, run genkernel as you would do normally.
A critical security vulnerability has been found in recent Linux kernels by Paul Starzetz of iSEC Security Research which allows for local privilege escalations.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-kernel/aa-sources | * | < 2.4.23-r1 | >= 2.4.23-r1 |
| sys-kernel/alpha-sources | * | < 2.4.21-r4 | >= 2.4.21-r4 |
| sys-kernel/ck-sources | * | < 2.6.2-r1 | = 2.4.24-r1, >= 2.6.2-r1 |
| sys-kernel/compaq-sources | * | < 2.4.9.32.7-r2 | >= 2.4.9.32.7-r2 |
| sys-kernel/development-sources | * | < 2.6.3_rc1 | >= 2.6.3_rc1 |
| sys-kernel/gaming-sources | * | < 2.4.20-r8 | >= 2.4.20-r8 |
| sys-kernel/gentoo-dev-sources | * | < 2.6.3_rc1 | >= 2.6.3_rc1 |
| sys-kernel/gentoo-sources | * | < 2.4.22-r7 | = 2.4.19-r11, = 2.4.20-r12, >= 2.4.22-r7 |
| sys-kernel/grsec-sources | * | < 2.4.24.1.9.13-r1 | >= 2.4.24.1.9.13-r1 |
| sys-kernel/gs-sources | * | < 2.4.25_pre7-r2 | >= 2.4.25_pre7-r2 |
| sys-kernel/hardened-sources | * | < 2.4.24-r1 | >= 2.4.24-r1 |
| sys-kernel/hppa-dev-sources | * | < 2.6.2_p3-r1 | >= 2.6.2_p3-r1 |
| sys-kernel/hppa-sources | * | < 2.4.24_p0-r1 | >= 2.4.24_p0-r1 |
| sys-kernel/ia64-sources | * | < 2.4.24-r1 | >= 2.4.24-r1 |
| sys-kernel/mips-prepatch-sources | * | < 2.4.25_pre6-r1 | >= 2.4.25_pre6-r1 |
| sys-kernel/mips-sources | * | < 2.4.25_rc4 | >= 2.4.25_rc4 |
| sys-kernel/mm-sources | * | < 2.6.3_rc1-r1 | >= 2.6.3_rc1-r1 |
| sys-kernel/openmosix-sources | * | < 2.4.22-r4 | >= 2.4.22-r4 |
| sys-kernel/pac-sources | * | < 2.4.23-r3 | >= 2.4.23-r3 |
| sys-kernel/planet-ccrma-sources | * | < 2.4.21-r5 | >= 2.4.21-r5 |
| sys-kernel/ppc-development-sources | * | < 2.6.3_rc1-r1 | >= 2.6.3_rc1-r1 |
| sys-kernel/ppc-sources | * | < 2.4.24-r1 | >= 2.4.24-r1 |
| sys-kernel/ppc-sources-benh | * | < 2.4.22-r5 | >= 2.4.22-r5 |
| sys-kernel/ppc-sources-crypto | * | < 2.4.20-r3 | >= 2.4.20-r3 |
| sys-kernel/ppc-sources-dev | * | < 2.4.24-r2 | >= 2.4.24-r2 |
| sys-kernel/selinux-sources | * | < 2.4.24-r2 | >= 2.4.24-r2 |
| sys-kernel/sparc-dev-sources | * | < 2.6.3_rc1 | >= 2.6.3_rc1 |
| sys-kernel/sparc-sources | * | < 2.4.24-r2 | >= 2.4.24-r2 |
| sys-kernel/usermode-sources | * | < 2.6.3-r1 | >= 2.4.24-r1 (revision), >= 2.4.26 (revision), >= 2.6.3-r1 |
| sys-kernel/vanilla-prepatch-sources | * | < 2.4.25_rc4 | >= 2.4.25_rc4 |
| sys-kernel/vanilla-sources | * | < 2.4.25 | >= 2.4.25 |
| sys-kernel/win4lin-sources | * | < 2.6.2-r1 | = 2.4.23-r2, >= 2.6.2-r1 |
| sys-kernel/wolk-sources | * | < 4.10_pre7-r3 | = 4.9-r4, >= 4.10_pre7-r3 |
| sys-kernel/xfs-sources | * | < 2.4.24-r2 | >= 2.4.24-r2 |
The Linux kernel is responsible for memory management in a working system - to allow this, processes are allowed to allocate and unallocate memory.
The memory subsystem allows for shrinking, growing, and moving of chunks of memory along any of the allocated memory areas which the kernel posesses.
To accomplish this, the do_mremap code calls the do_munmap() kernel function to remove any old memory mappings in the new location - but, the code doesn't check the return value of the do_munmap() function which may fail if the maximum number of available virtual memory area descriptors has been exceeded.
Due to the missing return value check after trying to unmap the middle of the first memory area, the corresponding page table entries from the second new area are inserted into the page table locations described by the first old one, thus they are subject to page protection flags of the first area. As a result, arbitrary code can be executed.
Arbitrary code with normal non-super-user privelerges may be able to exploit this vulnerability and may disrupt the operation of other parts of the kernel memory management subroutines finally leading to unexpected behavior.
Since no special privileges are required to use the mremap() and mummap() system calls any process may misuse this unexpected behavior to disrupt the kernel memory management subsystem. Proper exploitation of this vulnerability may lead to local privilege escalation allowing for the execution of arbitrary code with kernel level root access.
Proof-of-concept exploit code has been created and successfully tested, permitting root escalation on vulnerable systems. As a result, all users should upgrade their kernels to new or patched versions.
Users who are unable to upgrade their kernels may attempt to use "sysctl -w vm.max_map_count=1000000", however, this is a temporary fix which only solves the problem by increasing the number of memory areas that can be created by each process. Because of the static nature of this workaround, it is not recommended and users are urged to upgrade their systems to the latest avaiable patched sources.
Users are encouraged to upgrade to the latest available sources for their system:
# emerge sync # emerge -pv your-favourite-sources # emerge your-favourite-sources # # Follow usual procedure for compiling and installing a kernel. # # If you use genkernel, run genkernel as you would do normally. # # IF YOUR KERNEL IS MARKED as "remerge required!" THEN # # YOU SHOULD UPDATE YOUR KERNEL EVEN IF PORTAGE # # REPORTS THAT THE SAME VERSION IS INSTALLED.
A vulnerability has been discovered by in the ptrace emulation code for AMD64 platforms when eflags are processed, allowing a local user to obtain elevated priveleges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-kernel/ck-sources | amd64 | < 2.6.2 | >= 2.6.2 |
| sys-kernel/development-sources | amd64 | < 2.6.2 | >= 2.6.2 |
| sys-kernel/gentoo-dev-sources | amd64 | < 2.6.2 | >= 2.6.2 |
| sys-kernel/gentoo-sources | amd64 | < 2.4.22-r6 | >= 2.4.22-r6 |
| sys-kernel/gentoo-test-sources | amd64 | < 2.6.2 | >= 2.6.2-r1 |
| sys-kernel/gs-sources | amd64 | < 2.4.25_pre7-r1 | >= 2.4.25_pre7-r1 |
| sys-kernel/vanilla-prepatch-sources | amd64 | < 2.4.25_rc3 | >= 2.4.25_rc3 |
| sys-kernel/vanilla-sources | amd64 | < 2.4.24-r1 | >= 2.4.24-r1 |
A vulnerability has been discovered by Andi Kleen in the ptrace emulation code for AMD64 platforms when eflags are processed, allowing a local user to obtain elevated priveleges. The Common Vulnerabilities and Exposures project, http://cve.mitre.org, has assigned CAN-2004-0001 to this issue.
Only users of the AMD64 platform are affected: in this scenario, a user may be able to obtain elevated priveleges, including root access. However, no public exploit is known for the vulnerability at this time.
There is no temporary workaround - a kernel upgrade is required. A list of unaffected kernels is provided along with this announcement.
Users are encouraged to upgrade to the latest available sources for their system:
# emerge sync # emerge -pv your-favourite-sources # emerge your-favourite-sources # # Follow usual procedure for compiling and installing a kernel. # # If you use genkernel, run genkernel as you would do normally.
# # IF YOUR KERNEL IS MARKED as "remerge required!" THEN # # YOU SHOULD UPDATE YOUR KERNEL EVEN IF PORTAGE # # REPORTS THAT THE SAME VERSION IS INSTALLED.
A critical security vulnerability has been found in recent Linux kernels which allows for local privelege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-kernel/aa-sources | * | < 2.4.23-r1 | >= 2.4.23-r1 |
| sys-kernel/alpha-sources | * | < 2.4.21-r2 | >= 2.4.21-r2 |
| sys-kernel/arm-sources | * | < 2.4.19-r2 | >= 2.4.19-r2 |
| sys-kernel/ck-sources | * | < 2.4.23-r1 | >= 2.4.23-r1 |
| sys-kernel/compaq-sources | * | < 2.4.9.32.7-r1 | >= 2.4.9.32.7-r1 |
| sys-kernel/development-sources | * | < 2.6.1_rc3 | >= 2.6.1_rc3 |
| sys-kernel/gaming-sources | * | < 2.4.20-r7 | >= 2.4.20-r7 |
| sys-kernel/gentoo-dev-sources | * | < 2.6.1_rc3 | >= 2.6.1_rc3 |
| sys-kernel/gentoo-sources | * | < 2.4.22-r3 | > 2.4.22-r3 |
| sys-kernel/grsec-sources | * | < 2.4.23.2.0_rc4-r1 | > 2.4.23.2.0_rc4-r1 |
| sys-kernel/gs-sources | * | < 2.4.23_pre8-r2 | >= 2.4.23_pre8-r2 |
| sys-kernel/hardened-sources | * | < 2.4.22-r2 | >= 2.4.22-r2 |
| sys-kernel/hppa-sources | * | < 2.4.23_p4-r2 | >= 2.4.23_p4-r2 |
| sys-kernel/ia64-sources | * | < 2.4.22-r2 | >= 2.4.22-r2 |
| sys-kernel/mips-prepatch-sources | * | < 2.4.24_pre2-r1 | >= 2.4.24_pre2-r1 |
| sys-kernel/mips-sources | * | < 2.4.23-r2 | >= 2.4.23-r2 |
| sys-kernel/mm-sources | * | < 2.6.1_rc1-r2 | >= 2.6.1_rc1-r2 |
| sys-kernel/openmosix-sources | * | < 2.4.22-r3 | >= 2.4.22-r3 |
| sys-kernel/pac-sources | * | < 2.4.23-r1 | >= 2.4.23-r1 |
| sys-kernel/pfeifer-sources | * | < 2.4.21.1_pre4-r1 | >= 2.4.21.1_pre4-r1 |
| sys-kernel/planet-ccrma-sources | * | < 2.4.21-r4 | >= 2.4.21-r4 |
| sys-kernel/ppc-development-sources | * | < 2.6.1_rc1-r1 | >= 2.6.1_rc1-r1 |
| sys-kernel/ppc-sources | * | < 2.4.23-r1 | >= 2.4.23-r1 |
| sys-kernel/ppc-sources-benh | * | < 2.4.22-r4 | >= 2.4.22-r4 |
| sys-kernel/ppc-sources-crypto | * | < 2.4.20-r2 | >= 2.4.20-r2 |
| sys-kernel/selinux-sources | * | < 2.4.24 | >= 2.4.24 |
| sys-kernel/sparc-dev-sources | * | < 2.6.1_rc2 | >= 2.6.1_rc2 |
| sys-kernel/sparc-sources | * | < 2.4.24 | >= 2.4.24 |
| sys-kernel/usermode-sources | * | < 2.4.23-r1 | >= 2.4.23-r1 |
| sys-kernel/vanilla-prepatch-sources | * | < 2.4.25_pre4 | >= 2.4.25_pre4 |
| sys-kernel/vanilla-sources | * | < 2.4.24 | >= 2.4.24 |
| sys-kernel/win4lin-sources | * | < 2.6.0-r1 | >= 2.6.0-r1 |
| sys-kernel/wolk-sources | * | < 4.10_pre7-r2 | >= 4.10_pre7-r2 |
| sys-kernel/xfs-sources | * | < 2.4.23-r1 | >= 2.4.23-r1 |
The Linux kernel is responsible for memory management in a working system - to allow this, processes are allowed to allocate and unallocate memory.
The memory subsystem allows for shrinking, growing, and moving of chunks of memory along any of the allocated memory areas which the kernel posesses.
A typical virtual memory area covers at least one memory page. An incorrect bound check discovered inside the do_mremap() kernel code performing remapping of a virtual memory area may lead to creation of a virtual memory area of 0 bytes length.
The problem is based on the general mremap flaw that remapping 2 pages from inside a VMA creates a memory hole of only one page in length but an additional VMA of two pages. In the case of a zero sized remapping request no VMA hole is created but an additional VMA descriptor of 0 bytes in length is created.
This advisory also addresses an information leak in the Linux RTC system.
Arbitrary code may be able to exploit this vulnerability and may disrupt the operation of other parts of the kernel memory management subroutines finally leading to unexpected behavior.
Since no special privileges are required to use the mremap(2) system call any process may misuse its unexpected behavior to disrupt the kernel memory management subsystem. Proper exploitation of this vulnerability may lead to local privilege escalation including execution of arbitrary code with kernel level access.
Proof-of-concept exploit code has been created and successfully tested, permitting root escalation on vulnerable systems. As a result, all users should upgrade their kernels to new or patched versions.
There is no temporary workaround - a kernel upgrade is required. A list of unaffected kernels is provided along with this announcement.
Users are encouraged to upgrade to the latest available sources for their system:
$> emerge sync $> emerge -pv your-favourite-sources $> emerge your-favourite-sources $> # Follow usual procedure for compiling and installing a kernel. $> # If you use genkernel, run genkernel as you would do normally. $> # IF YOUR KERNEL IS MARKED as "remerge required!" THEN $> # YOU SHOULD UPDATE YOUR KERNEL EVEN IF PORTAGE $> # REPORTS THAT THE SAME VERSION IS INSTALLED.