Last updated 24 July 2024

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSLOPNETSCAPEREUSECIPHERCHANGEBUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

http://lkml.org/lkml/2010/11/23/395

Reported by Vegard Nossum: "I found this program lying around on my laptop. It kills my box (2.6.35) instantly by consuming a lot of memory (allocated by the kernel, so the process doesn't get killed by the OOM killer). As far as I can tell, the memory isn't being freed when the program exits either. Maybe it will eventually get cleaned up the UNIX socket garbage collector thing, but in that case it doesn't get called quickly enough to save my machine at least."

Reproducer: http://lkml.org/lkml/2010/11/23/395 Partial fix: http://lkml.org/lkml/2010/11/23/450 Remaining fix: http://marc.info/?l=linux-netdev&m=129059035929046&w=2

From Eric Dumazet: "we can eat all LOWMEM memory before unixgc() being called from unixreleasesock(). Moreover, the thread blocked in unixgc() can consume huge amount of time to perform cleanup because of huge working set.

One way to handle this is to have a sensible limit on unixtotinflight, tested from waitforunixgc() and to force a call to unixgc() if this limit is hit.

This solves the OOM and also reduce overall latencies, and should not slowdown normal workloads."

Acknowledgements:

Red Hat would like to thank Vegard Nossum for reporting this issue.

plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.

Due to integer underflow and overflow issues when determining the number of pages required for maliciously crafted I/O requests, a local user could send a device ioctl that results in the sequential allocation of a very large number of pages, causing the OOM killer to be invoked and crashing the system:

Proposed patch: http://git.kernel.org/?p=linux/kernel/git/axboe/linux-2.6-block.git;a=commit;h=cb4644cac4a2797afc847e6c92736664d4b0ea34

Acknowledgements:

Red Hat would like to thank Dan Rosenberg for reporting this issue.

Description of problem: Upstream commit dab5855 ("perfcounter: Add mmap event hooks to mprotect()") is fundamentally wrong as mprotectfixup() can free 'vma' due to merging. Fix the problem by moving perfeventmmap() hook to mprotectfixup(). In certain scenario, a local, unprivileged user could use this flaw to trigger a denial of service.

Upstream commit: http://git.kernel.org/linus/63bfd7384b119409685a17d5c58f0b56e5dc03da

Description of problem: gdthioctlalloc() takes the size variable as an int. copyfromuser() takes the size variable as an unsigned long. gen.datalen and gen.senselen are unsigned longs. On x8664 longs are 64 bit and ints are 32 bit.

We could pass in a very large number and the allocation would truncate the size to 32 bits and allocate a small buffer. Then when we do the copyfromuser(), it would result in a memory corruption.

Reference: http://ns3.spinics.net/lists/linux-scsi/msg47361.html

Upstream: http://git.kernel.org/linus/f63ae56e4e97fb12053590e41a4fa59e7daa74a4

drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.

Invoking ioctl(KVMRUN) while having invalid selector in fs and/or gs register (via LDT modifications) forces kernel to panic (DoS).

Description of problem: The sndctlnew() function in sound/core/control.c allocates space for a sndkcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC device (on many distros, this is group "audio") via the SNDRVCTLIOCTLELEMADD and SNDRVCTLIOCTLELEMREPLACE ioctls.

Upstream commit: http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git;a=commitdiff;h=5591bf07225523600450edd9e6ad258bb877b779

Acknowledgements:

Red Hat would like to thank Dan Rosenberg for reporting this issue.

Abcm2ps upstream has released latest v5.9.13 version, fixing "yet more multiple unspecified vulnerabilities": [1] http://moinejf.free.fr/abcm2ps-5.txt

Current versions of abcm2ps package, present in Fedora release of 11, 12, and 13, are v5.9.5 based (and potentially vulnerable).

Please rebase to new version to overcome these.

The kgacceptkrb5 function in krb5/acceptseccontext.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.

Last updated 24 July 2024

The ipevictor function in ipfragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via crafted fragmented packets.

It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command.

The pngdecompresschunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

Quoting httpd 2.2 security page: http://httpd.apache.org/security/vulnerabilities22.html#2.2.15

low: Request header information leak CVE-2010-0434

A bug in the handling of headers in subrequests could lead to a reuse of memory. In a multithreaded MPM this could possibly cause an information leak from other requests being handled by a different thread.

Affects: 2.2.0 - 2.2.14

Upstream bug: https://issues.apache.org/bugzilla/showbug.cgi?id=48359

Upstream commits (2.2.x branch): http://svn.apache.org/viewvc?view=revision&revision=917867 http://svn.apache.org/viewvc?view=revision&revision=918427

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5983 to the following vulnerability:

Untrusted search path vulnerability in the PySysSetArgv API function in Python before 2.6 prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983 http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg586010.html http://www.openwall.com/lists/oss-security/2009/01/26/2 http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html