- Tue Nov 3 2009 Kyle McMartin <kyle at redhat.com>     2.6.30.9-96

    - fs/pipe.c: fix NULL pointer dereference       (CVE-2009-3547)

    - Sun Oct 25 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-95

    - Disable the stack protector on functions that don't       have onstack arrays.

    - Thu Oct 22 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-94

    - Fix overflow in KVM cpuid code. (CVE-2009-3638)

    - Thu Oct 22 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-93

    - Fix exploitable oops in keyring code (CVE-2009-3624)

    - Wed Oct 21 2009 Kyle McMartin <kyle at redhat.com>

    - shut-up-LOCK_TEST_WITH_RETURN.patch: sort out       #445331... or paper bag over it for now until the lock       warnings can be killed.

  - Mon Oct 19 2009 Kyle McMartin <kyle at redhat.com>

    -       af_unix-fix-deadlock-connecting-to-shutdown-socket.pat       ch: fix for rhbz#529626 local DoS. (CVE-2009-3621)

  - Sat Oct 17 2009 Chuck Ebbert <cebbert at redhat.com>     2.6.30.9-90

    - Fix null deref in r128 (F10#487546) (CVE-2009-3620)

    - Sat Oct 17 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-89

    - Keyboard and mouse fixes from 2.6.32 (#522126)

    - Sat Oct 17 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-88

    - Scheduler wakeup patch, fixes high latency on wakeup       (sched-update-the-clock-of-runqueue-select-task-rq-sel       ected.patch)

  - Fri Oct 16 2009 Chuck Ebbert <cebbert at redhat.com>     2.6.30.9-87

    - Fix uninitialized data leak in netlink (CVE-2009-3612)

    - Thu Oct 15 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-86

    - AX.25 security fix (CVE-2009-2909)

    - Thu Oct 15 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-85

    - Disable CONFIG_USB_STORAGE_CYPRESS_ATACB because it       causes failure to boot from USB disks using Cypress       bridges (#524998)

  - Tue Oct 13 2009 Chuck Ebbert <cebbert at redhat.com>     2.6.30.9-84

    - Copy libata drive detection fix from 2.6.31.4       (#524756)

    - Tue Oct 13 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-83

    - Networking fixes taken from 2.6.31-stable

    - Tue Oct 13 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-82

    - Fix boot hang with ACPI on some systems.

    - Mon Oct 12 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-81

    - Critical ftrace fixes:
      ftrace-use-module-notifier-for-function-tracer.patch       ftrace-check-for-failure-for-all-conversions.patch       tracing-correct-module-boundaries-for-ftrace_release.p       atch

  - Thu Oct 8 2009 Ben Skeggs <bskeggs at redhat.com>     2.6.30.9-80

    - ppc: compile nvidiafb as a module only,       nvidiafb+nouveau = bang! (rh#491308)

    - Wed Oct 7 2009 Dave Jones <davej at redhat.com>       2.6.30.9-78

    - Disable IRQSOFF tracer. (Adds unnecessary overhead       when unused)

    - Wed Oct 7 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-77

    - eCryptfs fixes taken from 2.6.31.2 (fixes       CVE-2009-2908)

    - Tue Oct 6 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-76

    - fix race in forcedeth network driver (#526546)

    - Tue Oct 6 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-75

    - x86: Don't leak 64-bit reg contents to 32-bit tasks.

    - Tue Oct 6 2009 Chuck Ebbert <cebbert at redhat.com>       2.6.30.9-74

[plus 194 lines in the Changelog]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

完全仮想化システムである kvm で複数の脆弱性が発見されています。Common Vulnerabilities and Exposures プロジェクトは次の問題を特定しています：

- CVE-2009-3638 kvm_dev_ioctl_get_supported_cpuid 関数に、整数オーバーフローが判明しました。これにより、ローカルのユーザーは、kvm_arch_dev_ioctl 関数に対する KVM_GET_SUPPORTED_CPUID リクエストから詳細不明な影響を与えることができます。

- CVE-2009-3722 KVM サブシステムの handle_dr 関数が、デバッグレジスタにアクセスする前に、Current Priviledge Level（CPL）を適切に検証していないことが判明しました。これにより、ゲスト OS ユーザーが、細工されたアプリケーションからホスト OS でサービス拒否（トラップ）を引き起こす可能性があります。

- CVE-2009-4031：KVM サブシステムの x86 エミュレーターにおける do_insn_fetch 関数が、有効にするための過剰な量のバイトを含む命令を解釈しようとすることが判明しました。これにより、ゲスト OS ユーザーが、SMP サポートに関連した詳細不明な操作により、ホスト OS でサービス拒否（スケジュール遅延の増大）を引き起こす可能性があります。

This update of QEMU KVM fixes the following bugs :

  - use-after-free bug in VNC code which might be used to     execute code on the host system injected from the guest     system. (CVE-2009-3616: CVSS v2 Base Score: 8.5)

  - integer overflow in kvm_dev_ioctl_get_supported_cpuid().
    (CVE-2009-3638: CVSS v2 Base Score: 7.2)

  - update_cr8_intercept() NULL pointer dereference.
    (CVE-2009-3640: CVSS v2 Base Score: 2.1)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddpN device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams. (CVE-2009-2903)

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname. (CVE-2009-3547)

The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881. (CVE-2009-3612)

net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket. (CVE-2009-3621)

Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.
(CVE-2009-3638)

The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.
(CVE-2009-3726)

The ip_frag_reasm function in ipv4/ip_fragment.c in Linux kernel 2.6.32-rc8, and possibly earlier versions, calls IP_INC_STATS_BH with an incorrect argument, which allows remote attackers to cause a denial of service (NULL pointer dereference and hang) via long IP packets, possibly related to the ip_defrag function. (CVE-2009-1298)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

Notice: Debian 5.0.4, the next point release of Debian 'lenny', will include a new default value for the mmap_min_addr tunable. This change will add an additional safeguard against a class of security vulnerabilities known as 'NULL pointer dereference' vulnerabilities, but it will need to be overridden when using certain applications.
Additional information about this change, including instructions for making this change locally in advance of 5.0.4 (recommended), can be found at: https://wiki.debian.org/mmap_min_addr.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3228     Eric Dumazet reported an instance of uninitialized     kernel memory in the network packet scheduler. Local     users may be able to exploit this issue to read the     contents of sensitive kernel memory.

  - CVE-2009-3238     Linus Torvalds provided a change to the get_random_int()     function to increase its randomness.

  - CVE-2009-3547     Earl Chew discovered a NULL pointer dereference issue in     the pipe_rdwr_open function which can be used by local     users to gain elevated privileges.

  - CVE-2009-3612     Jiri Pirko discovered a typo in the initialization of a     structure in the netlink subsystem that may allow local     users to gain access to sensitive kernel memory.

  - CVE-2009-3620     Ben Hutchings discovered an issue in the DRM manager for     ATI Rage 128 graphics adapters. Local users may be able     to exploit this vulnerability to cause a denial of     service (NULL pointer dereference).

  - CVE-2009-3621     Tomoki Sekiyama discovered a deadlock condition in the     UNIX domain socket implementation. Local users can     exploit this vulnerability to cause a denial of service     (system hang).

  - CVE-2009-3638     David Wagner reported an overflow in the KVM subsystem     on i386 systems. This issue is exploitable by local     users with access to the /dev/kvm device file.

It was discovered that the AX.25 network subsystem did not correctly check integer signedness in certain setsockopt calls. A local attacker could exploit this to crash the system, leading to a denial of service. Ubuntu 9.10 was not affected. (CVE-2009-2909)

Jan Beulich discovered that the kernel could leak register contents to 32-bit processes that were switched to 64-bit mode. A local attacker could run a specially crafted binary to read register values from an earlier process, leading to a loss of privacy. (CVE-2009-2910)

Dave Jones discovered that the gdth SCSI driver did not correctly validate array indexes in certain ioctl calls. A local attacker could exploit this to crash the system or gain elevated privileges.
(CVE-2009-3080)

Eric Dumazet and Jiri Pirko discovered that the TC and CLS subsystems would leak kernel memory via uninitialized structure members. A local attacker could exploit this to read several bytes of kernel memory, leading to a loss of privacy. (CVE-2009-3228, CVE-2009-3612)

Earl Chew discovered race conditions in pipe handling. A local attacker could exploit anonymous pipes via /proc/*/fd/ and crash the system or gain root privileges. (CVE-2009-3547)

Dave Jones and Francois Romieu discovered that the r8169 network driver could be made to leak kernel memory. A remote attacker could send a large number of jumbo frames until the system memory was exhausted, leading to a denial of service. Ubuntu 9.10 was not affected. (CVE-2009-3613).

Ben Hutchings discovered that the ATI Rage 128 video driver did not correctly validate initialization states. A local attacker could make specially crafted ioctl calls to crash the system or gain root privileges. (CVE-2009-3620)

Tomoki Sekiyama discovered that Unix sockets did not correctly verify namespaces. A local attacker could exploit this to cause a system hang, leading to a denial of service. (CVE-2009-3621)

J. Bruce Fields discovered that NFSv4 did not correctly use the credential cache. A local attacker using a mount with AUTH_NULL authentication could exploit this to crash the system or gain root privileges. Only Ubuntu 9.10 was affected. (CVE-2009-3623)

Alexander Zangerl discovered that the kernel keyring did not correctly reference count. A local attacker could issue a series of specially crafted keyring calls to crash the system or gain root privileges.
Only Ubuntu 9.10 was affected. (CVE-2009-3624)

David Wagner discovered that KVM did not correctly bounds-check CPUID entries. A local attacker could exploit this to crash the system or possibly gain elevated privileges. Ubuntu 6.06 and 9.10 were not affected. (CVE-2009-3638)

Avi Kivity discovered that KVM did not correctly check privileges when accessing debug registers. A local attacker could exploit this to crash a host system from within a guest system, leading to a denial of service. Ubuntu 6.06 and 9.10 were not affected. (CVE-2009-3722)

Philip Reisner discovered that the connector layer for uvesafb, pohmelfs, dst, and dm did not correctly check capabilties. A local attacker could exploit this to crash the system or gain elevated privileges. Ubuntu 6.06 was not affected. (CVE-2009-3725)

Trond Myklebust discovered that NFSv4 clients did not robustly verify attributes. A malicious remote NFSv4 server could exploit this to crash a client or gain root privileges. Ubuntu 9.10 was not affected.
(CVE-2009-3726)

Robin Getz discovered that NOMMU systems did not correctly validate NULL pointers in do_mmap_pgoff calls. A local attacker could attempt to allocate large amounts of memory to crash the system, leading to a denial of service. Only Ubuntu 6.06 and 9.10 were affected.
(CVE-2009-3888)

Joseph Malicki discovered that the MegaRAID SAS driver had world-writable option files. A local attacker could exploit these to disrupt the behavior of the controller, leading to a denial of service. (CVE-2009-3889, CVE-2009-3939)

Roel Kluin discovered that the Hisax ISDN driver did not correctly check the size of packets. A remote attacker could send specially crafted packets to cause a system crash, leading to a denial of service. (CVE-2009-4005)

Lennert Buytenhek discovered that certain 802.11 states were not handled correctly. A physically-proximate remote attacker could send specially crafted wireless traffic that would crash the system, leading to a denial of service. Only Ubuntu 9.10 was affected.
(CVE-2009-4026, CVE-2009-4027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in kvm, a full virtualization system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3638     It was discovered an Integer overflow in the     kvm_dev_ioctl_get_supported_cpuid function. This allows     local users to have an unspecified impact via a     KVM_GET_SUPPORTED_CPUID request to the     kvm_arch_dev_ioctl function.

  - CVE-2009-3722     It was discovered that the handle_dr function in the KVM     subsystem does not properly verify the Current Privilege     Level (CPL) before accessing a debug register, which     allows guest OS users to cause a denial of service     (trap) on the host OS via a crafted application.

  - CVE-2009-4031     It was discovered that the do_insn_fetch function in the     x86 emulator in the KVM subsystem tries to interpret     instructions that contain too many bytes to be valid,     which allows guest OS users to cause a denial of service     (increased scheduling latency) on the host OS via     unspecified manipulations related to SMP support.

Linux 2.6 カーネルで複数の脆弱性が検出され、修正されました：

2.4.37.6 までの 2.4.x および 2.6.31 までの 2.6.x の Linux カーネルにおいて、appletalk サブシステムのメモリ漏洩により、appletalk および ipddp のモジュールがロードされていながら ipddpN デバイスが見つからない場合、リモートの攻撃者が、IP-DDP データグラムを介して、サービス拒否（メモリ消費）を引き起こす可能性があります。（CVE-2009-2903）

2.6.32-rc6 より前の Linux カーネルにおいて、fs/pipe.c の複数の競合状態により、ローカルユーザーが、/proc/*/fd/ のパス名を介して匿名パイプを開こうとすることで、サービス拒否（NULL ポインターデリファレンスおよびシステムのクラッシュ）を引き起こしたり、権限を取得したりする可能性があります。（CVE-2009-3547）

2.6.32-rc5、および 2.4.37.6 以前の Linux カーネル 2.6.x では、netlink サブシステムの中の net/sched/cls_api.c の tcf_fill_node 関数が特定の tcm__pad2 構造体のメンバを初期化しないため、指定されないベクタを介してローカルユーザーがカーネルメモリから機密情報を取得できる可能性があります。注：この問題は、CVE-2005-4881 の修正が不完全なために存在します。（CVE-2009-3612）

2.6.31.4 以前の Linux カーネルの net/unix/af_unix.c により、ローカルユーザーが、abstract-namespace AF_UNIX リスニングソケットを作成し、このソケットでシャットダウン操作を実行してからこのソケットへの一連の接続操作を実行することで、サービス拒否（システムハングアップ）を引き起こす可能性があります。（CVE-2009-3621）

2.6.31.4 より前の Linux カーネルにおいて、KVM サブシステムにおける arch/x86/kvm/x86.c の kvm_dev_ioctl_get_supported_cpuid 関数の整数オーバーフローにより、ローカルユーザーが、kvm_arch_dev_ioctl 関数への KVM_GET_SUPPORTED_CPUID リクエストを介して、詳細不明な影響を与える可能性があります。
（CVE-2009-3638）

2.6.31-rc4 より前の Linux カーネルの NFSv4 クライアントの fs/nfs/nfs4proc.c の中の nfs4_proc_lock 関数により、リモート NFS サーバーで正しくないファイル属性を含むある種の応答が送信され、サービス拒否（NULL ポインターデリファレンスとパニック）を発生させ、NFSv4 状態のない開いているファイルの使用試行を引き起こす可能性があります。
（CVE-2009-3726）

2.6.32-rc8 およびおそらくそれ以前のバージョンの Linux カーネルにおける ipv4/ip_fragment.c の ip_frag_reasm 関数は、不適切な引数で IP_INC_STATS_BH を呼び出しているため、リモートの攻撃者が、ip_defrag 関数におそらく関連する長い IP パケットを介して、サービス拒否（NULL ポインターデリファレンスおよびハングアップ）を引き起こす可能性があります。（CVE-2009-1298）

カーネルを更新するには、以下の指示に従ってください：

http://www.mandriva.com/en/security/kernelupdate

注：Debian「lenny」の次回のリリースである Debian 5.0.4 には、 mmap_min_addr tunable に新たなデフォルト値があります。この変更により、「NULL ポインターデリファレンス」の脆弱性として知られているあるセキュリティ脆弱性のクラスに対して、さらなる予防手段が追加されますが、特定のアプリケーションを使用している場合はその値を上書きする必要があります。
5.0.4 に先立ってこの変更をローカルに行う（推奨）場合の手順など、この変更についての追加情報は、 https://wiki.debian.org/mmap_min_addr で入手できます。

Linux カーネルに複数の脆弱性が見つかりました。これにより、サービス拒否、機密メモリリーク、または権限昇格を引き起こすことがあります。Common Vulnerabilities and Exposures プロジェクトは次の問題を特定しています：

- CVE-2009-3228 Eric Dumazet 氏は、ネットワークパケットスケジューラで初期化されていないカーネルメモリのインスタンスを報告しました。ローカルユーザーは、この問題を悪用して、機密カーネルメモリの内容を読み取ることができる場合があります。

- CVE-2009-3238 Linus Torvalds 氏は、get_random_int() 関数に変更を行い、そのランダム性を向上させました。

- CVE-2009-3547 Earl Chew 氏は、pipe_rdwr_open 関数で NULL ポインターデリファレンスの問題を発見しました。ローカルユーザーは、この関数を使用して昇格された特権を取得できます。

- CVE-2009-3612 Jiri Pirko 氏は、netlink サブシステムでの構造体の初期化で誤字を発見しました。この誤字により、ローカルユーザーは、機密カーネルメモリにアクセスできる場合があります。

- CVE-2009-3620 Ben Hutchings 氏は、ATI Rage 128 グラフィックスアダプター用の DRM マネージャーで問題を発見しました。ローカルユーザーは、この脆弱性を悪用して、サービス拒否（NULL ポインターデリファレンス）を引き起こすことができる場合があります。

- CVE-2009-3621 Tomoki Sekiyama 氏は、UNIX ドメインソケットの実装で、デッドロックの条件を発見しました。ローカルユーザーは、この脆弱性を悪用して、サービス拒否（システムハング）を引き起こすことができます。

- CVE-2009-3638 David Wagner 氏は、i386 システムの KVM サブシステムにオーバーフローがあることを報告しました。/dev/kvm デバイスファイルにアクセスできるローカルユーザーが、この問題を悪用する可能性があります。

This update of QEMU KVM fixes the following bugs :

  - CVE-2009-3616: CVSS v2 Base Score: 8.5 use-after-free     bug in VNC code which might be used to execute code on     the host system injected from the guest system

  - CVE-2009-3638: CVSS v2 Base Score: 7.2 integer overflow     in kvm_dev_ioctl_get_supported_cpuid() 

  - CVE-2009-3640: CVSS v2 Base Score: 2.1     update_cr8_intercept() NULL pointer dereference

Update to kernel 2.6.27.38:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.38

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
42400	Fedora 11 : kernel-2.6.30.9-96.fc11 (2009-11032)	Nessus	Fedora Local Security Checks	2009/11/6	2021/1/11	high
44827	Debian DSA-1962-1 : kvm - 複数の脆弱性	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
42867	SuSE 11 Security Update : KVM (SAT Patch Number 1553)	Nessus	SuSE Local Security Checks	2009/11/23	2021/1/14	high
48161	Mandriva Linux Security Advisory : kernel (MDVSA-2009:329)	Nessus	Mandriva Local Security Checks	2010/7/30	2021/1/6	high
44792	Debian DSA-1927-1 : linux-2.6 - privilege escalation/denial of service/sensitive memory leak	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
43026	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : linux, linux-source-2.6.15 vulnerabilities (USN-864-1)	Nessus	Ubuntu Local Security Checks	2009/12/7	2021/1/19	high
44827	Debian DSA-1962-1 : kvm - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
48161	Mandriva Linux セキュリティアドバイザリ：カーネル（MDVSA-2009:329）	Nessus	Mandriva Local Security Checks	2010/7/30	2021/1/6	high
44792	Debian DSA-1927-1 : linux-2.6 - 権限昇格/サービス拒否/機密メモリリーク	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
42864	openSUSE Security Update : kvm (kvm-1547)	Nessus	SuSE Local Security Checks	2009/11/23	2021/1/14	high
42865	openSUSE Security Update : kvm (kvm-1545)	Nessus	SuSE Local Security Checks	2009/11/23	2021/1/14	high
42402	Fedora 10 : kernel-2.6.27.38-170.2.113.fc10 (2009-11038)	Nessus	Fedora Local Security Checks	2009/11/6	2021/1/11	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high