Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
If a single descriptor crosses a region, the second chunk length should be decremented by size translated so far, instead it includes the full descriptor length. A privileged guest user could use this flaw to crash the host or, potentially, corrupt host memory.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85
Buffer overflow in the nfs4getacluncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4acl extended attribute of a pathname on an NFSv4 filesystem.
Access to /dev/cpu//msr was protected only using filesystem checks. A local uid 0 (root) user with all capabilities dropped could use this flaw to execute arbitrary code in kernel mode.
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=c903f0456bc69176912dee6dd25c6a66ee1aed00
References: http://grsecurity.net/~spender/msr32.c
Last updated 24 July 2024
A flaw was found in the way xeniret() used userspace alterable %ds. An unprivileged local guest user in the 32-bit PV Xen domain could use this flaw to crash the guest or, potentially, escalate their privileges.
Acknowledgements:
This issue was discovered by Andrew Jones of Red Hat.
Last updated 24 July 2024
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
Last updated 24 July 2024
Last updated 24 July 2024
A flaw was found in the way Linux kernel's device-mapper subsystem, under certain conditions, interpreted data written to snapshot block devices. Snapshots are constructed from a single "cow" (copy-on-write) device that contains a mixture of data and metadata, and the bug involves a user writing a data block that is later incorrectly interpreted as metadata controlling how blocks are mapped.
An attacker could construct a mapping to read data from disk blocks in 'free space' that is normally inaccessible.
Please note that apart from having security consequences (data leak), this bug is also a data corruptor.
Acknowledgements:
Red Hat would like to thank Fujitsu for reporting this issue.
ISSUE DESCRIPTION =================
Xen PCI backend driver does not perform proper sanity checks on the device's state.
Which in turn allows the generic MSI code (called by Xen PCI backend) to be called incorrectly leading to hitting BUG conditions or causing NULL pointer exceptions in the MSI code.
To exploit this the guest can craft specific sequence of XENPCIOP operations which will trigger this.
Furthermore the frontend can also craft an continous stream of XENPCIOPenablemsi which will trigger an continous stream of WARN() messages triggered by the MSI code leading to the logging in the initial domain to exhaust disk space.
Lastly there is also missing check to verify whether the device has memory decoding enabled set at the start of the day leading the initial domain "accesses to the respective MMIO or I/O port ranges would - - on PCI Express devices - [which can] lead to Unsupported Request responses. The treatment of such errors is platform specific." (from XSA-120). Note that if XSA-120 'addendum' patch has been applied this particular sub-issue is not exploitable.
IMPACT ======
Malicious guest administrators can cause denial of service. If driver domains are not in use, the impact is a host crash.
Only x86 systems are vulnerable. ARM systems are not vulnerable.
VULNERABLE SYSTEMS ==================
This bug affects systems using Linux as the driver domain, including non-disaggregated systems using Linux as dom0.
Linux versions v3.1 and onwards are vulnerable due to supporting PCI pass-through backend driver.
PV and HVM guests which have been granted access to physical PCI devices (PCI passthrough') can take advantage of this vulnerability.
Furthermore, the vulnerability is only applicable when the passed-through PCI devices are MSI-capable or MSI-X. (Most modern devices are).
MITIGATION ==========
Not using PCI passthrough for PV and HVM guests. Note that for HVM guests QEMU is used for PCI passthrough - however the toolstack sets up also the 'PV' PCI which the guest can utilize if it chooses to do so.
External References:
http://xenbits.xen.org/xsa/advisory-157.html
Acknowledgements:
Red Hat would like to thank the Xen project for reporting this issue.
A flaw was found in the way ansi cprng implementation in the Linux kernel processed non-block size aligned requests. If several small requests are made that are less than the instances block size, the remainder for loop code doesn't increment randdatavalid in the last iteration, meaning that the last bytes in the randdata buffer gets reused on the subsequent smaller-than-a-block request for random data.
Acknowledgements:
Red Hat would like to thank Stephan Mueller for reporting this issue.
A flaw was found in the way Linux kernel's SCTP network protocol implementation handled duplicate cookies. A transient empty association is created while processing the duplicate cookie chunk that userspace could query, potentially leading to NULL pointer dereference. A remote attacker able to initiate SCTP connection to the system could use this flaw to create transient conditions that could lead to remote system crash if remote system user is querying SCTP connection info at the time these conditions exist.
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f2815633504b442ca0b0605c16bf3d88a3a0fcea
Last updated 24 July 2024
Last updated 24 July 2024
fs/proc/root.c in the procfs implementation in the Linux kernel before 3.2 does not properly interact with CLONENEWPID clone system calls, which allows remote attackers to cause a denial of service (reference leak and memory consumption) by making many connections to a daemon that uses PID namespaces to isolate clients, as demonstrated by vsftpd.
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116) 192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72 22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340) 192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364) fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp 1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
References: https://bugzilla.kernel.org/showbug.cgi?id=24412
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=95ee62083cb6453e056562d91f597552021e6ae7
An SCTP server doing ASCONF will panic on malformed INIT ping-of-death in the form of:
------------ INIT[PARAM: SETPRIMARYIP] ------------>
A remote attacker could use this flaw to crash the system by sending a maliciously prepared SCTP packet in order to trigger a NULL pointer dereference on the server.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=e40607cbe270a9e8360907cb1e62ddf0736e4864
Acknowledgements:
This issue was discovered by Liu Wei of Red Hat.
It was found that Linux kernel's sctp stack is prone to remotely triggerable memory pressure issue caused by excessive queueing.
A remote attacker could use this flaw to cause denial-of-service conditions on the system.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=26b87c7881006311828bb0ab271a551a62dcceb4
It was found that reporting emulation failures to user space could lead to either a local (CVE-2014-7842) or a L2->L1 (CVE-2010-5313) denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain systems, HPET is mapped to userspace as part of vdso (vvar) and thus an unprivileged user may generate MMIO transactions (and enter the emulator) this way.
journalunmapbuffer()'s zapbuffer: code clears a lot of buffer head state ala discardbuffer(), but does not touch Delay or Unwritten as discardbuffer() does.
This can be problematic in some areas of the ext4 code which assume that if they have found a buffer marked unwritten or delay, then it's a live one. They do not check whether a buffer is mapped, so jbd2's partial teardown can be problematic if they assume that this buffer head is still valid.
(Mounting without a journal also avoids the bug, because with no journal we go to unmapbuffer(), which does the right thing).
An unprivileged local user could use this flaw to crash the system.
Florian Weimer of the Red Hat Product Security Team discovered that hypervkvpd would exit when it processed a spoofed Netlink packet that had been sent from an untrusted local user, in the following code:
len = recvfrom(fd, kvprecvbuffer, sizeof(kvprecvbuffer), 0, addrp, &addrl);
if (len < 0 || addr.nlpid) { syslog(LOGERR, "recvfrom failed; pid:%u error:%d %s", addr.nlpid, errno, strerror(errno)); close(fd); return -1; }
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
A flaw was found in the way skbrecvdatagram() processed skbs with no payload when MSGPEEK was requested. An unprivileged local user could use this flaw to cause local denial of service.
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=77c1090
References: http://seclists.org/oss-sec/2013/q1/310
Buffer overflow in the ozcdevwrite function in drivers/staging/ozwpa ...
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024