Security
A kernel security hole
Security holes can sneak into code in surprising ways, even in highly scrutinized codebases. Perhaps even more surprising is how long they can persist in something as popular as the Linux kernel before someone notices. The release of stable kernels 2.6.22.16 and 2.6.23.14 this week are instructive for both of those reasons.
The bug that led to the releases is fixed by a two line patch, but might be exploitable to cause filesystem corruption. If it were a bug in a driver for an obscure piece of hardware, with relatively few users, it might have been less eye opening, but it was in the Virtual File System (VFS) layer of the kernel. VFS is the abstraction that allows all kernel filesystems to be used identically regardless of their underlying implementation. The open() system call is used to open any file on any type of filesystem; VFS is what makes that work.
In fact it is the open() path that is affected by the bug. Due to a faulty test, the bug allows directories to be opened for writing, which is generally a recipe for disaster. It could also allow a file on a read-only filesystem to be opened for writing – depending on the underlying filesystem implementation, that could lead to corruption. In both cases, they are only locally exploitable.
The bug was introduced in a change to support NFS in October of 2005 – more than two years ago; all kernels since 2.6.15 are affected. The change was aimed at making NFSv4 open calls be atomic (because an open is really a lookup followed by an open), but also did some code reorganization that changed the semantics of a flag variable. That variable was being used to determine the access mode for directories and read-only filesystems, so that change subtly broke the tests.
Part of the problem is that the tests are in a function called may_open(), which takes two flag parameters:
int may_open(struct nameidata *nd, int acc_mode, int flag)
The incorrect code was using flag in the tests when it should have
been using acc_mode. Each of them is a bitmask of values that, on
first glance, might be easy to confuse – each is related to permissions.
The bit values for each have names like FMODE_WRITE and
MAY_WRITE, which would seem to have a fair amount of overlap. This
may explain why the problem was not spotted at the time it was introduced.
There may be no easy solution to this kind of problem – other than more scrutiny. Using different types, rather than plain int, for each flag might have helped, but since the tests were using the right kind of bit values for flag, that is a somewhat hard sell.
Something unpleasant to consider in all of this is that this may not be the first time this problem has been noticed. It may just have been the first time it was noticed by someone who reported it. Folks with a malicious intent are much less inclined to report bugs. This particular bug is not one that would be particularly useful to attackers, but we would do well to remember that fixing a two year old hole means that systems were vulnerable for all that time. It is not only the good guys who can read code.
New vulnerabilities
apache: several vulnerabilities
| Package(s): | apache | CVE #(s): | CVE-2007-5000 CVE-2007-6388 CVE-2008-0005 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 15, 2008 | Updated: | July 29, 2008 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | A flaw was found in the mod_imap module. On sites where mod_imap was
enabled and an imagemap file was publicly available, a cross-site scripting
attack was possible. (CVE-2007-5000)
A flaw was found in the mod_status module. On sites where mod_status was enabled and the status pages were publicly available, a cross-site scripting attack was possible. (CVE-2007-6388) A flaw was found in the mod_proxy_ftp module. On sites where mod_proxy_ftp was enabled and a forward proxy was configured, a cross-site scripting attack was possible against Web browsers which did not correctly derive the response character set following the rules in RFC 2616. (CVE-2008-0005) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
claws-mail: insecure temp file
| Package(s): | claws-mail | CVE #(s): | CVE-2007-6208 | ||||
| Created: | January 10, 2008 | Updated: | January 16, 2008 | ||||
| Description: | Claws Mail creates temp files in an insecure manner. This can be used by a local attacker to make a symlink attack, allowing files with the local user's privileges to be overwritten. | ||||||
| Alerts: |
| ||||||
drupal: multiple vulnerabilities
| Package(s): | drupal | CVE #(s): | |||||||||
| Created: | January 14, 2008 | Updated: | January 16, 2008 | ||||||||
| Description: | From the Fedora advisory: Update to 5.6, security fixes: DRUPAL-SA-2008-005 DRUPAL-SA-2008-006 DRUPAL-SA-2008-007see http://drupal.org/security for more information. | ||||||||||
| Alerts: |
| ||||||||||
fail2ban: denial of service
| Package(s): | fail2ban | CVE #(s): | CVE-2007-4321 | ||||
| Created: | January 10, 2008 | Updated: | January 16, 2008 | ||||
| Description: | From the Debian alert: Daniel B. Cid discovered that fail2ban, a tool to block IP addresses that cause login failures, is too liberal about parsing SSH log files, allowing an attacker to block any IP address. | ||||||
| Alerts: |
| ||||||
gforge: SQL injection
| Package(s): | gforge | CVE #(s): | CVE-2008-0173 | ||||
| Created: | January 14, 2008 | Updated: | January 16, 2008 | ||||
| Description: | From the Debian advisory: It was discovered that Gforge, a collaborative development tool, did not properly sanitise some CGI parameters, allowing SQL injection in scripts related to RSS exports. | ||||||
| Alerts: |
| ||||||
httpd: cross-site scripting, denial of service
| Package(s): | httpd | CVE #(s): | CVE-2007-6421 CVE-2007-6422 | ||||||||||||||||||||||||||||||||
| Created: | January 15, 2008 | Updated: | April 4, 2008 | ||||||||||||||||||||||||||||||||
| Description: | A flaw was found in the mod_proxy_balancer module. On sites where
mod_proxy_balancer was enabled, a cross-site scripting attack against an
authorized user was possible. (CVE-2007-6421)
A flaw was found in the mod_proxy_balancer module. On sites where mod_proxy_balancer was enabled, an authorized user could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-6422) | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
kernel: denial of service vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2007-4133 CVE-2007-5093 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 12, 2008 | Updated: | November 20, 2008 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | The (1) hugetlb_vmtruncate_list and (2) hugetlb_vmtruncate functions
in fs/hugetlbfs/inode.c in the Linux kernel before 2.6.19-rc4 perform
certain prio_tree calculations using HPAGE_SIZE instead of PAGE_SIZE
units, which allows local users to cause a denial of service (panic)
via unspecified vectors.
The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 relies on user space to close the device, which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries, unless the attacker can convince the victim to unplug the affected device. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
libxml2: denial of service
| Package(s): | libxml2 | CVE #(s): | CVE-2007-6284 | ||||||||||||||||||||||||||||||||||||
| Created: | January 11, 2008 | Updated: | January 31, 2008 | ||||||||||||||||||||||||||||||||||||
| Description: | A denial of service flaw was found in the way libxml2 processes certain content. If an application linked against libxml2 processes malformed XML content, it could cause the application to stop responding. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
moodle: cross-site scripting
| Package(s): | moodle | CVE #(s): | CVE-2008-0123 | ||||||||||||
| Created: | January 16, 2008 | Updated: | November 12, 2008 | ||||||||||||
| Description: | Moodle suffers from a cross-site scripting vulnerability which is only open during the install process. | ||||||||||||||
| Alerts: |
| ||||||||||||||
openafs: denial of service
| Package(s): | openafs | CVE #(s): | CVE-2007-6599 | ||||||||||||
| Created: | January 10, 2008 | Updated: | January 25, 2008 | ||||||||||||
| Description: | From the Gentoo advisory: Russ Allbery, Jeffrey Altman, Dan Hyde and Thomas Mueller discovered a race condition due to an improper handling of the clients callbacks lists. A remote attacker could construct cases which trigger the race condition, resulting in a server crash. | ||||||||||||||
| Alerts: |
| ||||||||||||||
paramiko: insecure random pool usage
| Package(s): | paramiko | CVE #(s): | CVE-2008-0299 | ||||||||||||
| Created: | January 16, 2008 | Updated: | March 4, 2008 | ||||||||||||
| Description: | Programs which keep more than one paramiko connection open may leak random pool information. | ||||||||||||||
| Alerts: |
| ||||||||||||||
R: buffer overflows
| Package(s): | R | CVE #(s): | |||||
| Created: | January 10, 2008 | Updated: | January 16, 2008 | ||||
| Description: | The R language has a copy of PCRE, that has a number of buffer overflow and memory corruption vulnerabilities. If an attacker creates specially crafted regular expressions, it may be possible to create a denial of service, execute arbitrary code or disclose unauthorized information. | ||||||
| Alerts: |
| ||||||
xfce4: multiple vulnerabilities
| Package(s): | xfce4 | CVE #(s): | CVE-2007-6531 CVE-2007-6532 | ||||
| Created: | January 10, 2008 | Updated: | January 16, 2008 | ||||
| Description: | From the Gentoo alert: Gregory Andersen reported that the Xfce4 panel does not correctly calculate memory boundaries, leading to a stack-based buffer overflow in the launcher_update_panel_entry() function (CVE-2007-6531). Daichi Kawahata reported libxfcegui4 did not copy provided values when creating "SessionClient" structs, possibly leading to access of freed memory areas (CVE-2007-6532). | ||||||
| Alerts: |
| ||||||
xine-lib: buffer overflow
| Package(s): | xine-lib | CVE #(s): | CVE-2008-0225 | ||||||||||||||||||||||||||||
| Created: | January 16, 2008 | Updated: | August 7, 2008 | ||||||||||||||||||||||||||||
| Description: | xine-lib contains a buffer overflow which could be exploited (via a specially-crafted stream) to execute arbitrary code; see this advisory for more information. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>