此更新可解決下列安全性問題：

- Tavis Ormandy 在 Linux 核心 32 位元與 64 位元模擬中發現一個缺陷。這可允許無權限的本機使用者準備並執行特製的二進位檔案，其會利用此缺陷洩漏未初始化及潛在性的敏感資料。
 (CVE-2008-0598，重要)

- 在 Linux 核心「簡單網際網路轉換」 (SIT) INET6 實作中發現可能存在一個核心記憶體洩漏。這可讓無權限的本機使用者引發拒絕服務。(CVE-2008-2136，重要)

- 在 SBNI WAN 驅動程式中發現缺少功能檢查，這可允許本機使用者繞過預定的功能限制。(CVE-2008-3525，重要)

- do_truncate() 與 generic_file_splice_write() 函式未清除 setuid 與 setgid 位元。這可允許無權限的本機使用者取得受權限保護之資訊的存取權。(CVE-2008-4210，重要)

- 在整合式服務數位網路 (ISDN) 子系統中發現一個緩衝區溢位瑕疵。無權限的本機使用者可利用此瑕疵引發拒絕服務。
 (CVE-2007-6063，中等)

- 在多種 Linux 核心網路驅動程式中發現多個 NULL 指標解除參照。這些驅動程式遺漏檢查終端機有效性，而可允許權限提升。(CVE-2008-2812，中等)

- 在 Linux 核心虛擬檔案系統 (VFS) 實作中發現一個缺陷。這可允許無權限的本機使用者在刪除的目錄中嘗試建立檔案，而可能導致拒絕服務。(CVE-2008-3275，中等)

此更新也可修正下列錯誤：

- 在 nfs_xdr_readlinkres 中使用了不正確的 kunmap 函式。在應該使用 kunmap_atomic() 的地方使用了 kunmap()。因此，若 NFSv2 或 NFSv3 伺服器匯出含有符號連結的磁碟區，而其中包含等於或長於本機系統 PATH_MAX 值的路徑，則存取該連結會造成核心 oops。此更新已更正這個問題。

- mptctl_gettargetinfo 並未在使用 pIoc3 作為指標之前，先檢查它是否為 NULL。這會導致在某些情況下，mptctl_gettargetinfo 出現核心錯誤。現已新增檢查以防止此情況發生。

- 計時器中斷常式中缺少的勾選補償程式碼會在沒有明顯原因的情況下觸發。執行完全虛擬化的用戶端時，此假性觸發會造成 64 位元版本的 Red Hat Enterprise Linux 3 顯示時間的准确性大大降低。透過此更新，當作業系統在 Xen 或 VMware&reg; 下作為完整虛擬化的用戶端執行時，缺少的勾選補償程式碼會關閉。

來自 Red Hat 安全性公告 2008:0973：

現已提供適用於 Red Hat Enterprise Linux 3 的更新版核心套件，可解決安全性問題並修正各種錯誤。

Red Hat 安全性回應團隊已將此更新評等為具有重要安全性影響。

kernel 套件中包含 Linux 核心，這是任何 Linux 作業系統的核心。

此更新可解決下列安全性問題：

* Tavis Ormandy 在 Linux 核心 32 位元與 64 位元模擬中發現一個缺陷。這可允許無權限的本機使用者準備並執行特製的二進位檔案，其會利用此缺陷洩漏未初始化及潛在性的敏感資料。
(CVE-2008-0598，重要)

* 在 Linux 核心「簡單網際網路轉換」(SIT) INET6 實作中發現可能的核心記憶體洩漏。這可讓無權限的本機使用者引發拒絕服務。(CVE-2008-2136，重要)

* 在 SBNI WAN 驅動程式中發現缺少功能檢查，這可允許本機使用者繞過預定的功能限制。
(CVE-2008-3525，重要)

* do_truncate() 與 generic_file_splice_write() 函式並未清除 setuid 與 setgid 位元。這可允許無權限的本機使用者取得受權限保護之資訊的存取權。
(CVE-2008-4210，重要)

* 在整合式服務數位網路 (ISDN) 子系統中發現一個緩衝區溢位瑕疵。無權限的本機使用者可利用此瑕疵引發拒絕服務。(CVE-2007-6063，中等)

* 在多種 Linux 核心網路驅動程式中發現多個 NULL 指標解除參照。這些驅動程式遺漏檢查終端機有效性，而可允許權限提升。(CVE-2008-2812，中等)

* 在 Linux 核心虛擬檔案系統 (VFS) 實作中發現一個缺陷。這可允許無權限的本機使用者在刪除的目錄中嘗試建立檔案，而可能導致拒絕服務。(CVE-2008-3275，中等)

此更新也可修正下列錯誤：

* 在 nfs_xdr_readlinkres 中使用了不正確的 kunmap 函式。
在應該使用 kunmap_atomic() 的地方使用了 kunmap()。因此，若 NFSv2 或 NFSv3 伺服器匯出含有符號連結的磁碟區，而其中包含等於或長於本機系統 PATH_MAX 值的路徑，則存取該連結會造成核心 oops。此更新已更正這個問題。

* mptctl_gettargetinfo 並未在使用 pIoc3 作為指標之前，先檢查它是否為 NULL。這會導致在某些情況下，mptctl_gettargetinfo 出現核心錯誤。現已新增檢查以防止此情況發生。

* 計時器中斷常式中缺少的勾選補償程式碼會在沒有明顯原因的情況下觸發。執行完全虛擬化的用戶端時，此假性觸發會造成 64 位元版本的 Red Hat Enterprise Linux 3 顯示時間的准确性大大降低。透過此更新，當作業系統在 Xen 或 VMware® 下作為完整虛擬化的用戶端執行時，缺少的勾選補償程式碼會關閉。

所有 Red Hat Enterprise Linux 3 使用者皆應安裝此更新版核心，其可解決這些弱點並修正這些錯誤。

It was discovered that there were multiple NULL pointer function dereferences in the Linux kernel terminal handling code. A local attacker could exploit this to execute arbitrary code as root, or crash the system, leading to a denial of service. (CVE-2008-2812)

The do_change_type routine did not correctly validation administrative users. A local attacker could exploit this to block mount points or cause private mounts to be shared, leading to denial of service or a possible loss of privacy. (CVE-2008-2931)

Tobias Klein discovered that the OSS interface through ALSA did not correctly validate the device number. A local attacker could exploit this to access sensitive kernel memory, leading to a denial of service or a loss of privacy. (CVE-2008-3272)

Zoltan Sogor discovered that new directory entries could be added to already deleted directories. A local attacker could exploit this, filling up available memory and disk space, leading to a denial of service. (CVE-2008-3275)

In certain situations, the fix for CVE-2008-0598 from USN-623-1 was causing infinite loops in the writev syscall. This update corrects the mistake. We apologize for the inconvenience.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a missing capability check was found in the Linux kernel do_change_type routine. This could allow a local unprivileged user to gain privileged access or cause a denial of service. (CVE-2008-2931, Important)

* a flaw was found in the Linux kernel Direct-IO implementation. This could allow a local unprivileged user to cause a denial of service.
(CVE-2007-6716, Important)

* Tobias Klein reported a missing check in the Linux kernel Open Sound System (OSS) implementation. This deficiency could lead to a possible information leak. (CVE-2008-3272, Moderate)

* a deficiency was found in the Linux kernel virtual filesystem (VFS) implementation. This could allow a local unprivileged user to attempt file creation within deleted directories, possibly causing a denial of service. (CVE-2008-3275, Moderate)

* a flaw was found in the Linux kernel tmpfs implementation. This could allow a local unprivileged user to read sensitive information from the kernel. (CVE-2007-6417, Moderate)

Bug fixes :

* when copying a small IPoIB packet from the original skb it was received in to a new, smaller skb, all fields in the new skb were not initialized. This may have caused a kernel oops.

* previously, data may have been written beyond the end of an array, causing memory corruption on certain systems, resulting in hypervisor crashes during context switching.

* a kernel crash may have occurred on heavily-used Samba servers after 24 to 48 hours of use.

* under heavy memory pressure, pages may have been swapped out from under the SGI Altix XPMEM driver, causing silent data corruption in the kernel.

* the ixgbe driver is untested, but support was advertised for the Intel 82598 network card. If this card was present when the ixgbe driver was loaded, a NULL pointer dereference and a panic occurred.

* on certain systems, if multiple InfiniBand queue pairs simultaneously fell into an error state, an overrun may have occurred, stopping traffic.

* with bridging, when forward delay was set to zero, setting an interface to the forwarding state was delayed by one or possibly two timers, depending on whether STP was enabled. This may have caused long delays in moving an interface to the forwarding state. This issue caused packet loss when migrating virtual machines, preventing them from being migrated without interrupting applications.

* on certain multinode systems, IPMI device nodes were created in reverse order of where they physically resided.

* process hangs may have occurred while accessing application data files via asynchronous direct I/O system calls.

* on systems with heavy lock traffic, a possible deadlock may have caused anything requiring locks over NFS to stop, or be very slow.
Errors such as 'lockd: server [IP] not responding, timed out' were logged on client systems.

* unexpected removals of USB devices may have caused a NULL pointer dereference in kobject_get_path.

* on Itanium-based systems, repeatedly creating and destroying Windows guests may have caused Dom0 to crash, due to the 'XENMEM_add_to_physmap' hypercall, used by para-virtualized drivers on HVM, being SMP-unsafe.

* when using an MD software RAID, crashes may have occurred when devices were removed or changed while being iterated through. Correct locking is now used.

* break requests had no effect when using 'Serial Over Lan' with the Intel 82571 network card. This issue may have caused log in problems.

* on Itanium-based systems, module_free() referred the first parameter before checking it was valid. This may have caused a kernel panic when exiting SystemTap.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The openSUSE 11.0 kernel was updated to 2.6.25.16.

It fixes various stability bugs and also security bugs.

CVE-2008-1673: Fixed the range checking in the ASN.1 decoder in NAT for SNMP and CIFS, which could have been used by a remote attacker to crash the machine.

CVE-2008-3276: An integer overflow flaw was found in the Linux kernel dccp_setsockopt_change() function. An attacker may leverage this vulnerability to trigger a kernel panic on a victim's machine remotely.

CVE-2008-3272: The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.

CVE-2008-3275: The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ('overflow' of the UBIFS orphan area) via a series of attempted file creations within deleted directories.

Also lots of bugs were fixed.

This kernel security update fixes lots of bugs and some

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update addresses the following security issues :

* Tavis Ormandy discovered a deficiency in the Linux kernel 32-bit and 64-bit emulation. This could allow a local, unprivileged user to prepare and run a specially crafted binary which would use this deficiency to leak uninitialized and potentially sensitive data.
(CVE-2008-0598, Important)

* a possible kernel memory leak was found in the Linux kernel Simple Internet Transition (SIT) INET6 implementation. This could allow a local, unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

* missing capability checks were found in the SBNI WAN driver which could allow a local user to bypass intended capability restrictions.
(CVE-2008-3525, Important)

* the do_truncate() and generic_file_splice_write() functions did not clear the setuid and setgid bits. This could allow a local, unprivileged user to obtain access to privileged information.
(CVE-2008-4210, Important)

* a buffer overflow flaw was found in Integrated Services Digital Network (ISDN) subsystem. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2007-6063, Moderate)

* multiple NULL pointer dereferences were found in various Linux kernel network drivers. These drivers were missing checks for terminal validity, which could allow privilege escalation. (CVE-2008-2812, Moderate)

* a deficiency was found in the Linux kernel virtual filesystem (VFS) implementation. This could allow a local, unprivileged user to attempt file creation within deleted directories, possibly causing a denial of service. (CVE-2008-3275, Moderate)

This update also fixes the following bugs :

* the incorrect kunmap function was used in nfs_xdr_readlinkres.
kunmap() was used where kunmap_atomic() should have been. As a consequence, if an NFSv2 or NFSv3 server exported a volume containing a symlink which included a path equal to or longer than the local system's PATH_MAX, accessing the link caused a kernel oops. This has been corrected in this update.

* mptctl_gettargetinfo did not check if pIoc3 was NULL before using it as a pointer. This caused a kernel panic in mptctl_gettargetinfo in some circumstances. A check has been added which prevents this.

* lost tick compensation code in the timer interrupt routine triggered without apparent cause. When running as a fully-virtualized client, this spurious triggering caused the 64-bit version of Red Hat Enterprise Linux 3 to present highly inaccurate times. With this update the lost tick compensation code is turned off when the operating system is running as a fully-virtualized client under Xen or VMware(r).

All Red Hat Enterprise Linux 3 users should install this updated kernel which addresses these vulnerabilities and fixes these bugs.

Updated kernel packages that fix a number of security issues are now available for Red Hat Enterprise Linux 2.1 running on 32-bit architectures.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* a flaw was found in the IPv4 forwarding base. This could allow a local, unprivileged user to cause a denial of service. (CVE-2007-2172, Important)

* a flaw was found in the handling of process death signals. This allowed a local, unprivileged user to send arbitrary signals to the suid-process executed by that user. Successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important)

* when accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local, unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a denial of service. (CVE-2008-0007, Important)

* a possible kernel memory leak was found in the Linux kernel Simple Internet Transition (SIT) INET6 implementation. This could allow a local, unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

* missing capability checks were found in the SBNI WAN driver which could allow a local, unprivileged user to bypass intended capability restrictions. (CVE-2008-3525, Important)

* a flaw was found in the way files were written using truncate() or ftruncate(). This could allow a local, unprivileged user to acquire the privileges of a different group and obtain access to sensitive information. (CVE-2008-4210, Important)

* a race condition in the mincore system core allowed a local, unprivileged user to cause a denial of service. (CVE-2006-4814, Moderate)

* a flaw was found in the aacraid SCSI driver. This allowed a local, unprivileged user to make ioctl calls to the driver which should otherwise be restricted to privileged users. (CVE-2007-4308, Moderate)

* two buffer overflow flaws were found in the Integrated Services Digital Network (ISDN) subsystem. A local, unprivileged user could use these flaws to cause a denial of service. (CVE-2007-6063, CVE-2007-6151, Moderate)

* a flaw was found in the way core dump files were created. If a local, unprivileged user could make a root-owned process dump a core file into a user-writable directory, the user could gain read access to that core file, potentially compromising sensitive information.
(CVE-2007-6206, Moderate)

* a deficiency was found in the Linux kernel virtual file system (VFS) implementation. This could allow a local, unprivileged user to attempt file creation within deleted directories, possibly causing a denial of service. (CVE-2008-3275, Moderate)

All users of Red Hat Enterprise Linux 2.1 on 32-bit architectures should upgrade to these updated packages which address these vulnerabilities. For this update to take effect, the system must be rebooted.

This update addresses the following security issues :

  - Tavis Ormandy discovered a deficiency in the Linux     kernel 32-bit and 64-bit emulation. This could allow a     local, unprivileged user to prepare and run a specially     crafted binary which would use this deficiency to leak     uninitialized and potentially sensitive data.
    (CVE-2008-0598, Important)

  - a possible kernel memory leak was found in the Linux     kernel Simple Internet Transition (SIT) INET6     implementation. This could allow a local, unprivileged     user to cause a denial of service. (CVE-2008-2136,     Important)

  - missing capability checks were found in the SBNI WAN     driver which could allow a local user to bypass intended     capability restrictions. (CVE-2008-3525, Important)

  - the do_truncate() and generic_file_splice_write()     functions did not clear the setuid and setgid bits. This     could allow a local, unprivileged user to obtain access     to privileged information. (CVE-2008-4210, Important)

  - a buffer overflow flaw was found in Integrated Services     Digital Network (ISDN) subsystem. A local, unprivileged     user could use this flaw to cause a denial of service.
    (CVE-2007-6063, Moderate)

  - multiple NULL pointer dereferences were found in various     Linux kernel network drivers. These drivers were missing     checks for terminal validity, which could allow     privilege escalation. (CVE-2008-2812, Moderate)

  - a deficiency was found in the Linux kernel virtual     filesystem (VFS) implementation. This could allow a     local, unprivileged user to attempt file creation within     deleted directories, possibly causing a denial of     service. (CVE-2008-3275, Moderate)

This update also fixes the following bugs :

  - the incorrect kunmap function was used in     nfs_xdr_readlinkres. kunmap() was used where     kunmap_atomic() should have been. As a consequence, if     an NFSv2 or NFSv3 server exported a volume containing a     symlink which included a path equal to or longer than     the local system's PATH_MAX, accessing the link caused a     kernel oops. This has been corrected in this update.

  - mptctl_gettargetinfo did not check if pIoc3 was NULL     before using it as a pointer. This caused a kernel panic     in mptctl_gettargetinfo in some circumstances. A check     has been added which prevents this.

  - lost tick compensation code in the timer interrupt     routine triggered without apparent cause. When running     as a fully-virtualized client, this spurious triggering     caused the 64-bit version of Red Hat Enterprise Linux 3     to present highly inaccurate times. With this update the     lost tick compensation code is turned off when the     operating system is running as a fully-virtualized     client under Xen or VMware&reg;.

From Red Hat Security Advisory 2008:0973 :

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update addresses the following security issues :

* Tavis Ormandy discovered a deficiency in the Linux kernel 32-bit and 64-bit emulation. This could allow a local, unprivileged user to prepare and run a specially crafted binary which would use this deficiency to leak uninitialized and potentially sensitive data.
(CVE-2008-0598, Important)

* a possible kernel memory leak was found in the Linux kernel Simple Internet Transition (SIT) INET6 implementation. This could allow a local, unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

* missing capability checks were found in the SBNI WAN driver which could allow a local user to bypass intended capability restrictions.
(CVE-2008-3525, Important)

* the do_truncate() and generic_file_splice_write() functions did not clear the setuid and setgid bits. This could allow a local, unprivileged user to obtain access to privileged information.
(CVE-2008-4210, Important)

* a buffer overflow flaw was found in Integrated Services Digital Network (ISDN) subsystem. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2007-6063, Moderate)

* multiple NULL pointer dereferences were found in various Linux kernel network drivers. These drivers were missing checks for terminal validity, which could allow privilege escalation. (CVE-2008-2812, Moderate)

* a deficiency was found in the Linux kernel virtual filesystem (VFS) implementation. This could allow a local, unprivileged user to attempt file creation within deleted directories, possibly causing a denial of service. (CVE-2008-3275, Moderate)

This update also fixes the following bugs :

* the incorrect kunmap function was used in nfs_xdr_readlinkres.
kunmap() was used where kunmap_atomic() should have been. As a consequence, if an NFSv2 or NFSv3 server exported a volume containing a symlink which included a path equal to or longer than the local system's PATH_MAX, accessing the link caused a kernel oops. This has been corrected in this update.

* mptctl_gettargetinfo did not check if pIoc3 was NULL before using it as a pointer. This caused a kernel panic in mptctl_gettargetinfo in some circumstances. A check has been added which prevents this.

* lost tick compensation code in the timer interrupt routine triggered without apparent cause. When running as a fully-virtualized client, this spurious triggering caused the 64-bit version of Red Hat Enterprise Linux 3 to present highly inaccurate times. With this update the lost tick compensation code is turned off when the operating system is running as a fully-virtualized client under Xen or VMware(r).

All Red Hat Enterprise Linux 3 users should install this updated kernel which addresses these vulnerabilities and fixes these bugs.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0885.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2009-0014.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2008-0973.

ID	名稱	產品	系列	已發布	已更新	嚴重性
60507	Scientific Linux 安全性更新：SL3.x i386/x86_64 上的核心	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
67763	Oracle Linux 3：kernel (ELSA-2008-0973)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
34048	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : linux, linux-source-2.6.15/20/22 vulnerabilities (USN-637-1)	Nessus	Ubuntu Local Security Checks	2008/8/26	2021/1/19	high
34288	RHEL 5 : kernel (RHSA-2008:0885)	Nessus	Red Hat Local Security Checks	2008/9/25	2021/1/14	high
40009	openSUSE Security Update : kernel (kernel-171)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	critical
41534	SuSE 10 Security Update : Linux Kernel (x86) (ZYPP Patch Number 5565)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	critical
59130	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5605)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	critical
35186	CentOS 3 : kernel (CESA-2008:0973)	Nessus	CentOS Local Security Checks	2008/12/17	2021/1/4	high
35323	RHEL 2.1 : kernel (RHSA-2009:0001)	Nessus	Red Hat Local Security Checks	2009/1/9	2021/1/14	high
60507	Scientific Linux Security Update : kernel on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
67763	Oracle Linux 3 : kernel (ELSA-2008-0973)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
801457	CentOS RHSA-2008-0885 Security Check	Log Correlation Engine	Generic			high
801465	CentOS RHSA-2009-0014 Security Check	Log Correlation Engine	Generic			high
801460	CentOS RHSA-2008-0973 Security Check	Log Correlation Engine	Generic			high

偵測

搜尋 Plugin

high

high

high

high

critical

critical

critical

high

high

high

high

high

high

high