A flaw was found in Linux kernel. A lack of size check in hugetlbmcopyatomicpte could cause denial of service.
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1e3921471354244f70fe268586ff94a97a6dd4df
References:
https://marc.info/?l=linux-mm&m=150819356125109
A flaw was found in the hugetlbmcopyatomicpte function in mm/hugetlb.c in the Linux kernel before 4.13. A superfluous implicit page unlock for VMSHARED hugetlbfs mapping could trigger a local denial of service (BUG).
A vulnerability was found in the RHEL7.2 kernel. When RHEL 7.2 is booted with UEFI Secure Boot enabled, securelevel is set. The kernel uses the state of securelevel to prevent userspace from inserting untrusted privileged code at runtime.
The ACPI tables provided by firmware can be overwritten using the initrd. From the kernel documentation:
If the ACPIINITRDTABLEOVERRIDE compile option is true, it is possible to override nearly any ACPI table provided by the BIOS with an instrumented, modified one.
RHEL 7.2 has CONFIGACPIINITRDTABLEOVERRIDE kernel config option enabled, and will load ACPI tables appended to the initrd, even if booted with UEFI Secure Boot enabled and securelevel set.
Upstream patch:
https://github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76
A race condition in netlink socket creation can trigger a kernel panic in netlinkrelease->moduleput for local users creating netlink sockets.
This issue is specific to Red Hat Enterprise Linux and does not affect upstream kernels. This issue was introduced in commit 3500659804251facce0cf4ee2ca657e0108e9a4f. This was introduced in kernel-3.10.0-304.el7 in the fix titled:
[net] netfilter: log: protect nflogregister against double registering.
It requires the nfnetlinklog module to be loaded to be effective.
This commit was introduced as part of a patchset that was required to backport netfilter functionality from upstream while attempting to maintain KABI. This flaw is RHEL specific.
On a system with memory-constrained cgroups, it is possible for a non-root user to lock up the system by continuously spawning new processes within a cgroup which is already in an OOM event.
Upstream patches:
The deadlock was inherent in the original memcg OOM killer design, so the entire rewrite of that mechanism is required for the fix:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=
759496ba6407c6994d6a5ce3a5e74937d7816208 3a13c4d761b4b979ba8767f42345fed3274991b0 519e52473ebe9db5cdef44670d5a97f1fd53d721 fb2a6fc56be66c169f8b80e07ed999ba453a2db2 3812c8c8f3953921ef18544110dafc3505c1ac62 4942642080ea82d99ab5b653abb9a12b7ba31f4a 84235de394d9775bfaa7fa9762a59d91fef0c1fc a0d8b00a3381f9d75764b3377590451cb0b4fe41 1f14c1ac19aa45118054b6d5425873c5c7fc23a1 3168ecbe1c04ec3feb7cb42388a17d7f047fe1a2
An XML eXternal Entity (XXE) flaw was found in Nokogiri, a Ruby gem for parsing HTML, XML, and SAX. Using external XML entities, a remote attacker could specify a URL in a specially crafted XML that, when parsed, would cause a connection to that URL to be opened.
A patch shipped with the 1.5.4 release of Nokogiri provided a "nonet" option to disable external connections. However, local file URLs could still be used to exploit this flaw. The 1.6.4 release of Nokogiri fixed this issue by using libxml2 2.9.0.
Additional information is detailed at:
https://github.com/sparklemotion/nokogiri/issues/693#issuecomment-68334768
CVE request and assignment:
http://seclists.org/oss-sec/2015/q1/57
Kernel panic is encountered when sctp stack receives duplicate asconf chunks.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b69040d8e39f20d5215a03502a8e8b4c6ab78395
Ovirt-engine did not verify key attributes from the the vdsm X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL certificate with invalid attributes that would otherwise prevent an certificate from being presented as valid
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject arbitrary web script or HTML via the "Max allowance" field in the "Set limit" form.
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote attackers to hijack the authentication of cumin users for unspecified requests.
cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users to bypass intended role restrictions and obtain sensitive information or perform privileged operations via unspecified vectors.
Cumin, as used in Red Hat Enterprise MRG 2.4, allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted Ajax update request.
A flaw was found in the way cumin parsed POST request data. A remote attacker could potentially use this flaw to perform SQL injection attacks on cumin's database.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
A denial of service flaw was found in the way Condor's policy definition evaluator processed certain policy definitions. If an administrator used an attribute defined on a job in any of the following condorstartd policies (CONTINUE, KILL, PREEMPT, SUSPEND), a remote Condor service user could use this flaw to cause a denial of the condorstartd service by submitting a Condor job that caused certain policy definition to be evaluated to either ERROR or UNDEFINED states.
Workaround: =========== Check for UNDEFINED & ERROR in the policy configuration.
Multiple format string flaws were found in Condor:
a) when the XML message log format was requested in Condor submit job by remote Condor user and that user attempted to write a specially-crafted message into user log file via condorhold tool it could lead to condorschedd daemon crash, or, potentially arbitrary code execution with the privileges of the 'condor' user []. Also this way an attacker could potentially prevent other Condor jobs from being scheduled and ever executed,
b) request for file transfer by remote Condor user to transmit a file, with specially-crafted name, could lead to child process of condorschedd daemon to crash (repeated process, where condorschedd daemon would fork a child process to handle the request, the child to crash, while trying to handle it and condorschedd daemon to fork another child since the particular Condor job still have not been completed successfully).
Upstream bug report (mentioning only one attack vector): [1] https://condor-wiki.cs.wisc.edu/index.cgi/tktview?tn=2660
General upstream patch (addressing among these flaws also couple of compiler warning problems): [2] http://condor-git.cs.wisc.edu/?p=condor.git;a=commitdiff;h=5e5571d1a431eb3c61977b6dd6ec90186ef79867
-- [] Arbitrary code execution was possible only on systems, where Condor daemons were not compiled with FORTIFYSOURCE protection mechanism. On systems with this protection enabled, particular flaw would lead to Condor service crash only.
A flaw was discovered in cumin where it would log broker authentication credentials to the cumin log file. A local user exploiting this flaw could connect to the broker outside of cumin's control and perform certain operations such as scheduling jobs, setting attributes on jobs, as well as holding, releasing or removing jobs. The user could also use this to, depending on the defined ACLs of the broker, manipulate message queues and other privileged operations.
It was found that vsftpd, Very Secure FTP daemon, when the network namespace (CONFIGNETNS) support was activated in the kernel, used to create a new network namespace per connection. A remote attacker could use this flaw to cause memory pressure (kernel OOM killer protection mechanism to be activated and potentially terminate vsftpd or arbitrary [vsftpd independent] process, which satisfied the OOM killer process selection algorithm).
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629373 [2] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/720095
Public PoC (from [2]): ======================
The test is started in this way:
$ for i in 1 2 3 4 5 6 7 8 ; do ./feedftp $i >/dev/null & done
What is observed during the test is that /proc/vmallocinfo grows continually with lines like the following being added:
0xffffe8ffff800000-0xffffe8ffffa00000 2097152 pcpugetvmareas+0x0/0x790 vmalloc 0xffffe8ffffa00000-0xffffe8ffffc00000 2097152 pcpugetvmareas+0x0/0x790 vmalloc 0xffffe8ffffc00000-0xffffe8ffffe00000 2097152 pcpugetvmareas+0x0/0x790 vmalloc
vsftpd bug: https://bugzilla.redhat.com/showbug.cgi?id=711134
Proposed patches (but has connection rates problem): http://patchwork.ozlabs.org/patch/88217/
It was reported [1], [2] that Apache QPID would crash due to a NULL pointer dereference when a remote, authenticated user attempted to redeclare an existing exchange and add a new alternate exchange. This would result in a denial of service condition of the server. This was corrected upstream by r811188 [3].
[1] https://issues.apache.org/jira/browse/QPID-2080 [2] https://bugzilla.redhat.com/showbug.cgi?id=517751 [3] http://svn.apache.org/viewvc?revision=811188&view=revision
It was reported [1] that Apache QPID would crash when receiving data from a client that is not valid AMQP data, resulting in a shut down of the cluster rather than the client being disconnected. This was corrected upstream by r785788 [2].
[1] https://bugzilla.redhat.com/showbug.cgi?id=506580 [2] http://svn.apache.org/viewvc?revision=785788&view=revision
Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users to queue jobs as an arbitrary user, and thereby gain privileges, by using a Condor command-line tool to modify an unspecified job attribute.