This kernel update for openSUSE 10.3 fixes some bugs and several security problems.

The following security issues are fixed: A local denial of service problem in the splice(2) system call.

CVE-2009-0834: The audit_syscall_entry function in the Linux kernel on the x86_64 platform did not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls.

CVE-2009-1072: nfsd in the Linux kernel did not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

CVE-2009-0835 The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod.

CVE-2009-1439: Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) or potential code execution via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.

This requires that kernel can be made to mount a 'cifs' filesystem from a malicious CIFS server.

CVE-2009-1337: The exit_notify function in kernel/exit.c in the Linux kernel did not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.

CVE-2009-0859: The shm_get_stat function in ipc/shm.c in the shm subsystem in the Linux kernel, when CONFIG_SHMEM is disabled, misinterprets the data type of an inode, which allows local users to cause a denial of service (system hang) via an SHM_INFO shmctl call, as demonstrated by running the ipcs program. (SUSE is enabling CONFIG_SHMEM, so is by default not affected, the fix is just for completeness).

CVE-2009-1265: Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux kernel might allow attackers to obtain sensitive information via a large length value, which causes 'garbage' memory to be sent.

CVE-2009-0028: The clone system call in the Linux kernel allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.

CVE-2009-0676: The sock_getsockopt function in net/core/sock.c in the Linux kernel does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.

CVE-2009-0322: drivers/firmware/dell_rbu.c in the Linux kernel allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/.

CVE-2009-0269: fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.

CVE-2009-0065: Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.

CVE-2008-5702: Buffer underflow in the ibwdt_ioctl function in drivers/watchdog/ib700wdt.c in the Linux kernel might allow local users to have an unknown impact via a certain /dev/watchdog WDIOC_SETTIMEOUT IOCTL call.

CVE-2008-4554: The do_splice_from function in fs/splice.c in the Linux kernel does not reject file descriptors that have the O_APPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.

Some other non-security bugs were fixed, please see the RPM changelog.

SUSE Linux Enterprise 10 Service Pack 2 の Linux カーネルが更新され、様々なセキュリティ問題といくつかのバグが修正されました。

次のセキュリティ問題が修正されました：CVE-2009-0834：x86_64 プラットフォーム上の Linux カーネルにある audit_syscall_entry 関数は、(1) 64 ビット syscall を実行する 32-ビットプロセス、または (2) 32 ビット syscall を実行する 64 ビットプロセスを適切に処理しませんでした。これによりローカルユーザーは、細工された syscall を通じて特定の syscall 監査構成をバイパスできます。

- Linux カーネルの nfsd は、スレッド内のユーザーリクエストを処理する前に CAP_MKNOD 機能をドロップしませんでした。これにより、ローカルユーザーはデバイスノードを作成することができます。これは、root_squash オプションでエクスポートされたファイルシステム上で実証されています。（CVE-2009-1072）

- x86_64 プラットフォーム上の Linux カーネルにおいて、seccomp サブシステム内の kernel/seccomp.c にある __secure_computing 関数は、CONFIG_SECCOMP　が有効である場合、(1) 64 ビット syscall を実行する 32-ビットプロセス、または (2) 32 ビット syscall を実行する 64 ビットプロセスを適切に処理しません。これによりローカルユーザーは、(a) stat または (b) chmod として誤解される細工された syscall を通じて、意図されたアクセス制限をバイパスできます。（CVE-2009-0835）

- 2.6.29 以前の Linux カーネルにおいて、CIFS 内の fs/cifs/connect.c にあるバッファオーバーフローにより、リモートの攻撃者が、SMB マウントリクエストに対する Tree Connect 応答内の長い nativeFileSystem フィールドを通じて、サービス拒否（クラッシュ）またはコード実行を引き起こす可能性があります。
 （CVE-2009-1439）

これには、カーネルが、悪意のある CIFS サーバーからの「cifs」ファイルシステムをマウントするように作られている必要があります。

- Linux カーネルの kernel/exit.c にある exit_notify 関数は、CAP_KILL 機能を保持する場合、終了信号を制限しませんでした。これによりローカルユーザーは、exit_signal フィールドを変更してから、exec システムコールを使用して setuid アプリケーションを起動するプログラムを実行することで、任意の信号をプロセスに送信できます。
 （CVE-2009-1337）

- Linux カーネルの shm サブシステムにある ipc/shm.c の shm_get_stat 関数は、CONFIG_SHMEM が無効である場合、inode のデータタイプを誤って解釈します。これによってローカルユーザーは、SHM_INFO shmctl 呼び出しを介してサービス拒否（システムのハングアップ）を引き起こすことができます。これは ipcs プログラムを実行することで実証されています。（SUSE は CONFIG_SHMEM を有効にするため、デフォルトでは影響を受けませんが、修正は完全を期すためのものです）（CVE-2009-0859）

GCC オプション -fwrapv がコンパイルに追加されており、整数オーバーフローチェックが削除される可能性を回避します。

- Linux カーネルの rose_sendmsg（sys/net/af_rose.c）にある整数オーバーフローによって、攻撃者は、「garbage」メモリを送信させる大きい長さの値を介して機密情報を入手できる可能性があります。（CVE-2009-1265）

複数のバグも修正されました。詳細については RPM 変更ログを参照してください。

SUSE Linux Enterprise 10 Service Pack 2 的 Linux 核心已更新，可修正多種安全性問題和數個錯誤。

下列安全性問題已修正：CVE-2009-0834：x86_64 平台上 Linux 核心的 audit_syscall_entry 函式未正確處理 (1) 進行 64 位元系統呼叫的 32 位元處理程序或 (2) 進行 32 位元系統呼叫的 64 位元處理程序，其可允許本機使用者透過特製系統呼叫繞過某些系統呼叫稽核組態。

- Linux 核心的 nfsd 沒有在處理執行緒中使用者要求之前中斷 CAP_MKNOD 功能，進而允許本機使用者建立裝置節點；以 root_squash 選項匯出的檔案系統即為一例。(CVE-2009-1072)

- 在 x86_64 平台的 Linux 核心中，seccomp 子系統內 kernel/seccomp.c 的 __secure_computing 函式在 CONFIG_SECCOMP 已啟用時，未正確處理 (1) 進行 64 位元系統呼叫的 32 位元處理程序或 (2) 進行 32 位元系統呼叫的 64 位元處理程序，其可允許本機使用者透過錯譯為 (a) stat 或 (b) chmod 的特製系統呼叫，繞過預定的存取限制。(CVE-2009-0835)

- 在 2.6.29 版及之前版本 Linux 核心中，CIFS 的 fs/cifs/connect.c 存有緩衝區溢位，允許遠端攻擊者透過 SMB 掛載要求的 Tree Connect 回應之長 nativeFileSystem 欄位，造成拒絕服務 (當機) 或可能執行程式碼。
 (CVE-2009-1439)

這需要該核心可從惡意 CIFS 伺服器掛載「cifs」檔案系統才能達成。

- CAP_KILL 功能保留時，Linux 核心中 kernel/exit.c 的 exit_notify 函式未限制結束訊號，其允許本機使用者執行程式來修改 exit_signal 欄位，然後使用 exec 系統呼叫來啟動 setuid 應用程式，進而傳送任意訊號給處理程序。
 (CVE-2009-1337)

- 在 Linux 核心的 shm 子系統中，ipc/shm.c 的 shm_get_stat 函式在 CONFIG_SHMEM 停用的情況下，錯譯 inode 的資料類型，其允許本機使用者透過 SHM_INFO shmctl 呼叫造成拒絕服務 (系統懸置)；執行 ipcs 程式即為一例。(SUSE 已啟用 CONFIG_SHMEM，因此依預設其不受影響，僅基於完整性而提供修正)。(CVE-2009-0859)

GCC 選項 -fwrapv 已新增至編譯，以因應可能發生的移除整數溢位檢查問題。

- Linux 核心中的 rose_sendmsg (sys/net/af_rose.c) 有整數溢位，可允許攻擊者透過可造成傳送「回收」記憶體的大值，取得敏感資訊。(CVE-2009-1265)

另已修正數個錯誤，如需詳細資訊，請參閱 RPM 變更記錄。

SUSE Linux Enterprise 10 Service Pack 2 上的 Linux 内核已更新，修复了各种安全问题和多个缺陷。

修复了以下问题：CVE-2009-0834：x86_64 平台上的 Linux 内核中的 audit_syscall_entry 函数未正确处理 (1) 发起 64 位 syscall 的 32 位进程或 (2) 发起 32 位 syscall 的 64 位进程，因而本地用户可通过构建的 syscall 绕过某些 syscall 审计配置。

- Linux 内核中的 nfsd 没有在处理线程中的用户请求之前终止 CAP_MKNOD 功能，这允许本地用户创建设备节点，这一点已在使用 root_squash 选项导出的文件系统中证实。(CVE-2009-1072)

- 启用了 CONFIG_SECCOMP 时，x86_64 平台上的 Linux 内核中 seccomp 子系统中 kernel/seccomp.c 中的 __secure_computing 函数不会正确处理 (1) 发起 64 位 syscall 的 32 位进程或 (2) 发起 32 位 syscall 的 64 位进程，这允许本地用户通过构建的被误解释为 (a) stat 或 (b) chmod 的 syscall 绕过预期访问限制。(CVE-2009-0835)

- 在 Linux 内核 2.6.29 和更早版本中，CIFS 的 fs/cifs/connect.c 中的缓冲区溢出允许远程攻击者通过对 SMB 挂载请求的树连接响应中的长 nativeFileSystem 字段造成拒绝服务（崩溃）或者潜在代码执行。
 (CVE-2009-1439)

这需要能够使内核挂载来自恶意 CIFS 服务器的“cifs”文件系统。

- Linux 内核中 kernel/exit.c 中的 exit_notify 函数在保留了 CAP_KILL 功能时不会限制退出信号，因而本地用户可运行修改 exit_signal 字段然后使用 exec 系统调用来启动 setuid 应用程序的程序，向进程发送任意信号。
 (CVE-2009-1337)

- 禁用了 CONFIG_SHMEM 时，Linux 内核中 shm 子系统中 ipc/shm.c 中的 shm_get_stat 函数误解释 inode 的数据类型，这允许本地用户通过 SHM_INFO shmctl 调用造成拒绝服务（系统挂起），这一点已通过运行 ipcs 程序证实。（SUSE 要启用 CONFIG_SHMEM，因此默认不受影响，该补丁仅针对完整性）。(CVE-2009-0859)

向编译中添加了 GCC 选项 -fwrapv 以解决潜在删除整数溢出检查。

- Linux 内核中 rose_sendmsg (sys/net/af_rose.c) 中的整数溢出可能允许攻击者通过造成发送“垃圾”内存的大型长度值来获取敏感信息。(CVE-2009-1265)

此外还修复了许多缺陷，有关详细信息，请参阅 RPM 变更日志。

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4307     Bryn M. Reeves reported a denial of service in the NFS     filesystem. Local users can trigger a kernel BUG() due     to a race condition in the do_setlk function.

  - CVE-2008-5079     Hugo Dias reported a DoS condition in the ATM subsystem     that can be triggered by a local user by calling the     svc_listen function twice on the same socket and reading     /proc/net/atm/*vc.

  - CVE-2008-5395     Helge Deller discovered a denial of service condition     that allows local users on PA-RISC systems to crash a     system by attempting to unwind a stack containing     userspace addresses.

  - CVE-2008-5700     Alan Cox discovered a lack of minimum timeouts on SG_IO     requests, which allows local users of systems using ATA     to cause a denial of service by forcing drives into PIO     mode.

  - CVE-2008-5701     Vlad Malov reported an issue on 64-bit MIPS systems     where a local user could cause a system crash by crafing     a malicious binary which makes o32 syscalls with a     number less than 4000.

  - CVE-2008-5702     Zvonimir Rakamaric reported an off-by-one error in the     ib700wdt watchdog driver which allows local users to     cause a buffer underflow by making a specially crafted     WDIOC_SETTIMEOUT ioctl call.

  - CVE-2009-0028     Chris Evans discovered a situation in which a child     process can send an arbitrary signal to its parent.

  - CVE-2009-0029     Christian Borntraeger discovered an issue effecting the     alpha, mips, powerpc, s390 and sparc64 architectures     that allows local users to cause a denial of service or     potentially gain elevated privileges.

  - CVE-2009-0031     Vegard Nossum discovered a memory leak in the keyctl     subsystem that allows local users to cause a denial of     service by consuming all of kernel memory.

  - CVE-2009-0065     Wei Yongjun discovered a memory overflow in the SCTP     implementation that can be triggered by remote users,     permitting remote code execution.

  - CVE-2009-0269     Duane Griffin provided a fix for an issue in the     eCryptfs subsystem which allows local users to cause a     denial of service (fault or memory corruption).

  - CVE-2009-0322     Pavel Roskin provided a fix for an issue in the dell_rbu     driver that allows a local user to cause a denial of     service (oops) by reading 0 bytes from a sysfs entry.

  - CVE-2009-0675     Roel Kluin discovered inverted logic in the skfddi     driver that permits local, unprivileged users to reset     the driver statistics.

  - CVE-2009-0676     Clement LECIGNE discovered a bug in the sock_getsockopt     function that may result in leaking sensitive kernel     memory.

  - CVE-2009-0745     Peter Kerwien discovered an issue in the ext4 filesystem     that allows local users to cause a denial of service     (kernel oops) during a resize operation.

  - CVE-2009-0834     Roland McGrath discovered an issue on amd64 kernels that     allows local users to circumvent system call audit     configurations which filter based on the syscall numbers     or argument details.

  - CVE-2009-0859     Jiri Olsa discovered that a local user can cause a     denial of service (system hang) using a SHM_INFO shmctl     call on kernels compiled with CONFIG_SHMEM disabled.
    This issue does not affect prebuilt Debian kernels.

  - CVE-2009-1046     Mikulas Patocka reported an issue in the console     subsystem that allows a local user to cause memory     corruption by selecting a small number of 3-byte UTF-8     characters.

  - CVE-2009-1192     Shaohua Li reported an issue in the AGP subsystem that     may allow local users to read sensitive kernel memory     due to a leak of uninitialized memory.

  - CVE-2009-1242     Benjamin Gilbert reported a local denial of service     vulnerability in the KVM VMX implementation that allows     local users to trigger an oops.

  - CVE-2009-1265     Thomas Pollet reported an overflow in the af_rose     implementation that allows remote attackers to retrieve     uninitialized kernel memory that may contain sensitive     data.

  - CVE-2009-1337     Oleg Nesterov discovered an issue in the exit_notify     function that allows local users to send an arbitrary     signal to a process by running a program that modifies     the exit_signal field and then uses an exec system call     to launch a setuid application.

  - CVE-2009-1338     Daniel Hokka Zakrisson discovered that a kill(-1) is     permitted to reach processes outside of the current     process namespace.

  - CVE-2009-1439     Pavan Naregundi reported an issue in the CIFS filesystem     code that allows remote users to overwrite memory via a     long nativeFileSystem field in a Tree Connect response     during mount.

NFS did not correctly handle races between fcntl and interrupts. A local attacker on an NFS mount could consume unlimited kernel memory, leading to a denial of service. Ubuntu 8.10 was not affected.
(CVE-2008-4307)

Sparc syscalls did not correctly check mmap regions. A local attacker could cause a system panic, leading to a denial of service. Ubuntu 8.10 was not affected. (CVE-2008-6107)

In certain situations, cloned processes were able to send signals to parent processes, crossing privilege boundaries. A local attacker could send arbitrary signals to parent processes, leading to a denial of service. (CVE-2009-0028)

The kernel keyring did not free memory correctly. A local attacker could consume unlimited kernel memory, leading to a denial of service.
(CVE-2009-0031)

The SCTP stack did not correctly validate FORWARD-TSN packets. A remote attacker could send specially crafted SCTP traffic causing a system crash, leading to a denial of service. (CVE-2009-0065)

The eCryptfs filesystem did not correctly handle certain VFS return codes. A local attacker with write-access to an eCryptfs filesystem could cause a system crash, leading to a denial of service.
(CVE-2009-0269)

The Dell platform device did not correctly validate user parameters. A local attacker could perform specially crafted reads to crash the system, leading to a denial of service. (CVE-2009-0322)

The page fault handler could consume stack memory. A local attacker could exploit this to crash the system or gain root privileges with a Kprobe registered. Only Ubuntu 8.10 was affected. (CVE-2009-0605)

Network interfaces statistics for the SysKonnect FDDI driver did not check capabilities. A local user could reset statistics, potentially interfering with packet accounting systems. (CVE-2009-0675)

The getsockopt function did not correctly clear certain parameters. A local attacker could read leaked kernel memory, leading to a loss of privacy. (CVE-2009-0676)

The ext4 filesystem did not correctly clear group descriptors when resizing. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2009-0745)

The ext4 filesystem did not correctly validate certain fields. A local attacker could mount a malicious ext4 filesystem, causing a system crash, leading to a denial of service. (CVE-2009-0746, CVE-2009-0747, CVE-2009-0748)

The syscall interface did not correctly validate parameters when crossing the 64-bit/32-bit boundary. A local attacker could bypass certain syscall restricts via crafted syscalls. (CVE-2009-0834, CVE-2009-0835)

The shared memory subsystem did not correctly handle certain shmctl calls when CONFIG_SHMEM was disabled. Ubuntu kernels were not vulnerable, since CONFIG_SHMEM is enabled by default. (CVE-2009-0859)

The virtual consoles did not correctly handle certain UTF-8 sequences.
A local attacker on the physical console could exploit this to cause a system crash, leading to a denial of service. (CVE-2009-1046).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to denial of service, privilege escalation, or information leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4307     Bryn M. Reeves reported a denial of service in the NFS     filesystem. Local users can trigger a kernel BUG() due     to a race condition in the do_setlk function.

  - CVE-2008-5395     Helge Deller discovered a denial of service condition     that allows local users on PA-RISC to crash the system     by attempting to unwind a stack containing userspace     addresses.

  - CVE-2008-5701     Vlad Malov reported an issue on 64-bit MIPS where a     local user could cause a system crash by crafting a     malicious binary which makes o32 syscalls with a number     less than 4000.

  - CVE-2008-5702     Zvonimir Rakamaric reported an off-by-one error in the     ib700wdt watchdog driver which allows local users to     cause a buffer underflow by making a specially crafted     WDIOC_SETTIMEOUT ioctl call.

  - CVE-2008-5713     Flavio Leitner discovered that a local user can cause a     denial of service by generating large amounts of traffic     on a large SMP system, resulting in soft lockups.

  - CVE-2009-0028     Chris Evans discovered a situation in which a child     process can send an arbitrary signal to its parent.

  - CVE-2009-0029     Christian Borntraeger discovered an issue effecting the     alpha, mips, powerpc, s390 and sparc64 architectures     that allows local users to cause a denial of service or     potentially gain elevated privileges.

  - CVE-2009-0031     Vegard Nossum discovered a memory leak in the keyctl     subsystem that allows local users to cause a denial of     service by consuming all available kernel memory.

  - CVE-2009-0065     Wei Yongjun discovered a memory overflow in the SCTP     implementation that can be triggered by remote users,     permitting remote code execution.

  - CVE-2009-0322     Pavel Roskin provided a fix for an issue in the dell_rbu     driver that allows a local user to cause a denial of     service (oops) by reading 0 bytes from a sysfs entry.

  - CVE-2009-0675     Roel Kluin discovered inverted logic in the skfddi     driver that permits local, unprivileged users to reset     the driver statistics.

  - CVE-2009-0676     Clement LECIGNE discovered a bug in the sock_getsockopt     function that may result in leaking sensitive kernel     memory.

  - CVE-2009-0834     Roland McGrath discovered an issue on amd64 kernels that     allows local users to circumvent system call audit     configurations which filter based on the syscall numbers     or argument details.

  - CVE-2009-0859     Jiri Olsa discovered that a local user can cause a     denial of service (system hang) using a SHM_INFO shmctl     call on kernels compiled with CONFIG_SHMEM disabled.
    This issue does not affect prebuilt Debian kernels.

  - CVE-2009-1192     Shaohua Li reported an issue in the AGP subsystem that     may allow local users to read sensitive kernel memory     due to a leak of uninitialized memory.

  - CVE-2009-1265     Thomas Pollet reported an overflow in the af_rose     implementation that allows remote attackers to retrieve     uninitialized kernel memory that may contain sensitive     data.

  - CVE-2009-1336     Trond Myklebust reported an issue in the encode_lookup()     function in the nfs server subsystem that allows local     users to cause a denial of service (oops in     encode_lookup()) by use of a long filename.

  - CVE-2009-1337     Oleg Nesterov discovered an issue in the exit_notify     function that allows local users to send an arbitrary     signal to a process by running a program that modifies     the exit_signal field and then uses an exec system call     to launch a setuid application.

  - CVE-2009-1439     Pavan Naregundi reported an issue in the CIFS filesystem     code that allows remote users to overwrite memory via a     long nativeFileSystem field in a Tree Connect response     during mount.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, privilege escalation or a sensitive memory leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0028     Chris Evans discovered a situation in which a child     process can send an arbitrary signal to its parent.

  - CVE-2009-0834     Roland McGrath discovered an issue on amd64 kernels that     allows local users to circumvent system call audit     configurations which filter based on the syscall numbers     or argument details.

  - CVE-2009-0835     Roland McGrath discovered an issue on amd64 kernels with     CONFIG_SECCOMP enabled. By making a specially crafted     syscall, local users can bypass access restrictions.

  - CVE-2009-0859     Jiri Olsa discovered that a local user can cause a     denial of service (system hang) using a SHM_INFO shmctl     call on kernels compiled with CONFIG_SHMEM disabled.
    This issue does not affect prebuilt Debian kernels.

  - CVE-2009-1046     Mikulas Patocka reported an issue in the console     subsystem that allows a local user to cause memory     corruption by selecting a small number of 3-byte UTF-8     characters.

  - CVE-2009-1072     Igor Zhbanov reported that nfsd was not properly     dropping CAP_MKNOD, allowing users to create device     nodes on file systems exported with root_squash.

  - CVE-2009-1184     Dan Carpenter reported a coding issue in the selinux     subsystem that allows local users to bypass certain     networking checks when running with compat_net=1.

  - CVE-2009-1192     Shaohua Li reported an issue in the AGP subsystem they     may allow local users to read sensitive kernel memory     due to a leak of uninitialized memory.

  - CVE-2009-1242     Benjamin Gilbert reported a local denial of service     vulnerability in the KVM VMX implementation that allows     local users to trigger an oops.

  - CVE-2009-1265     Thomas Pollet reported an overflow in the af_rose     implementation that allows remote attackers to retrieve     uninitialized kernel memory that may contain sensitive     data.

  - CVE-2009-1337     Oleg Nesterov discovered an issue in the exit_notify     function that allows local users to send an arbitrary     signal to a process by running a program that modifies     the exit_signal field and then uses an exec system call     to launch a setuid application.

  - CVE-2009-1338     Daniel Hokka Zakrisson discovered that a kill(-1) is     permitted to reach processes outside of the current     process namespace.

  - CVE-2009-1439     Pavan Naregundi reported an issue in the CIFS filesystem     code that allows remote users to overwrite memory via a     long nativeFileSystem field in a Tree Connect response     during mount.

NFS did not correctly handle races between fcntl and interrupts. A local attacker on an NFS mount could consume unlimited kernel memory, leading to a denial of service. (CVE-2008-4307)

Sparc syscalls did not correctly check mmap regions. A local attacker could cause a system panic, leading to a denial of service.
(CVE-2008-6107)

In certain situations, cloned processes were able to send signals to parent processes, crossing privilege boundaries. A local attacker could send arbitrary signals to parent processes, leading to a denial of service. (CVE-2009-0028)

The 64-bit syscall interfaces did not correctly handle sign extension.
A local attacker could make malicious syscalls, possibly gaining root privileges. The x86_64 architecture was not affected. (CVE-2009-0029)

The SCTP stack did not correctly validate FORWARD-TSN packets. A remote attacker could send specially crafted SCTP traffic causing a system crash, leading to a denial of service. (CVE-2009-0065)

The Dell platform device did not correctly validate user parameters. A local attacker could perform specially crafted reads to crash the system, leading to a denial of service. (CVE-2009-0322)

Network interfaces statistics for the SysKonnect FDDI driver did not check capabilities. A local user could reset statistics, potentially interfering with packet accounting systems. (CVE-2009-0675)

The getsockopt function did not correctly clear certain parameters. A local attacker could read leaked kernel memory, leading to a loss of privacy. (CVE-2009-0676)

The syscall interface did not correctly validate parameters when crossing the 64-bit/32-bit boundary. A local attacker could bypass certain syscall restricts via crafted syscalls. (CVE-2009-0834, CVE-2009-0835)

The shared memory subsystem did not correctly handle certain shmctl calls when CONFIG_SHMEM was disabled. Ubuntu kernels were not vulnerable, since CONFIG_SHMEM is enabled by default. (CVE-2009-0859).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux kernel on SUSE Linux Enterprise 10 Service Pack 2 was updated to fix various security issues and several bugs.

The following security issues were fixed: CVE-2009-0834: The audit_syscall_entry function in the Linux kernel on the x86_64 platform did not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls.

  - nfsd in the Linux kernel did not drop the CAP_MKNOD     capability before handling a user request in a thread,     which allows local users to create device nodes, as     demonstrated on a filesystem that has been exported with     the root_squash option. (CVE-2009-1072)

  - The __secure_computing function in kernel/seccomp.c in     the seccomp subsystem in the Linux kernel on the x86_64     platform, when CONFIG_SECCOMP is enabled, does not     properly handle (1) a 32-bit process making a 64-bit     syscall or (2) a 64-bit process making a 32-bit syscall,     which allows local users to bypass intended access     restrictions via crafted syscalls that are     misinterpreted as (a) stat or (b) chmod. (CVE-2009-0835)

  - Buffer overflow in fs/cifs/connect.c in CIFS in the     Linux kernel 2.6.29 and earlier allows remote attackers     to cause a denial of service (crash) or potential code     execution via a long nativeFileSystem field in a Tree     Connect response to an SMB mount request.
    (CVE-2009-1439)

This requires that kernel can be made to mount a 'cifs' filesystem from a malicious CIFS server.

  - The exit_notify function in kernel/exit.c in the Linux     kernel did not restrict exit signals when the CAP_KILL     capability is held, which allows local users to send an     arbitrary signal to a process by running a program that     modifies the exit_signal field and then uses an exec     system call to launch a setuid application.
    (CVE-2009-1337)

  - The shm_get_stat function in ipc/shm.c in the shm     subsystem in the Linux kernel, when CONFIG_SHMEM is     disabled, misinterprets the data type of an inode, which     allows local users to cause a denial of service (system     hang) via an SHM_INFO shmctl call, as demonstrated by     running the ipcs program. (SUSE is enabling     CONFIG_SHMEM, so is by default not affected, the fix is     just for completeness). (CVE-2009-0859)

The GCC option -fwrapv has been added to compilation to work around potentially removing integer overflow checks.

  - Integer overflow in rose_sendmsg (sys/net/af_rose.c) in     the Linux kernel might allow attackers to obtain     sensitive information via a large length value, which     causes 'garbage' memory to be sent. (CVE-2009-1265)

Also a number of bugs were fixed, for details please see the RPM changelog.

This kernel update for openSUSE 11.0 fixes some bugs and several security problems.

The following security issues are fixed: A local denial of service problem in the splice(2) system call.

CVE-2009-1630: The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.

CVE-2009-0834: The audit_syscall_entry function in the Linux kernel on the x86_64 platform did not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls.

CVE-2009-1072: nfsd in the Linux kernel did not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

CVE-2009-0835 The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod.

CVE-2009-1439: Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) or potential code execution via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.

This requires that kernel can be made to mount a 'cifs' filesystem from a malicious CIFS server.

CVE-2009-1337: The exit_notify function in kernel/exit.c in the Linux kernel did not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.

CVE-2009-0859: The shm_get_stat function in ipc/shm.c in the shm subsystem in the Linux kernel, when CONFIG_SHMEM is disabled, misinterprets the data type of an inode, which allows local users to cause a denial of service (system hang) via an SHM_INFO shmctl call, as demonstrated by running the ipcs program. (SUSE is enabling CONFIG_SHMEM, so is by default not affected, the fix is just for completeness).

CVE-2009-1242: The vmx_set_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFER_LME (aka 'Long mode enable') bit in the Extended Feature Enable Register (EFER) model-specific register, which is specific to the x86_64 platform.

CVE-2009-1265: Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux kernel might allow attackers to obtain sensitive information via a large length value, which causes 'garbage' memory to be sent.

CVE-2009-0028: The clone system call in the Linux kernel allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.

CVE-2009-0675: The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an 'inverted logic' issue.

CVE-2009-0676: The sock_getsockopt function in net/core/sock.c in the Linux kernel does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.

CVE-2009-0322: drivers/firmware/dell_rbu.c in the Linux kernel allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/.

CVE-2009-0269: fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.

CVE-2009-0065: Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.

Some other non-security bugs were fixed, please see the RPM changelog.

ID	名稱	產品	系列	已發布	已更新	嚴重性
39335	openSUSE 10 Security Update : kernel (kernel-6274)	Nessus	SuSE Local Security Checks	2009/6/9	2021/1/14	critical
59137	SuSE 10 セキュリティ更新：Linux カーネル（ZYPP パッチ番号 6236）	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	high
59137	SuSE 10 安全性更新：Linux 核心 (ZYPP 修補程式編號 6236)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	high
59137	SuSE 10 安全更新：Linux 内核（ZYPP 修补程序编号 6236）	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	high
38668	Debian DSA-1787-1 : linux-2.6.24 - denial of service/privilege escalation/information leak	Nessus	Debian Local Security Checks	2009/5/4	2021/1/4	critical
37337	Ubuntu 7.10 / 8.04 LTS / 8.10 : linux, linux-source-2.6.22 vulnerabilities (USN-751-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	critical
38722	Debian DSA-1794-1 : linux-2.6 - denial of service/privilege escalation/information leak	Nessus	Debian Local Security Checks	2009/5/11	2021/1/4	critical
38795	Debian DSA-1800-1 : linux-2.6 - denial of service/privilege escalation/sensitive memory leak	Nessus	Debian Local Security Checks	2009/5/18	2021/1/4	high
36418	Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerabilities (USN-752-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	critical
41539	SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 6237)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
40012	openSUSE Security Update : kernel (kernel-951)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	critical
59137	SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 6236)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	high

偵測

搜尋 Plugin

critical

high

high

high

critical

critical

critical

high

critical

high

critical

high