A flaw was found in the Linux kernel loose validation of child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.

evince is missing a check on number of pages which can lead to a segmentation fault

A flaw was found in the Linux kernel's implementation of Logical Link Control and Adaptation Protocol (L2CAP), part of the Bluetooth stack. An attacker, within the range of standard Bluetooth transmissions, can create and send a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.

Google Guava versions 11.0 through 24.1 are vulnerable to unbounded memory allocation in the AtomicDoubleArray class (when serialized with Java serialization) and Compound Ordering class (when serialized with GWT serialization). An attacker could exploit applications that use Guava and deserialize untrusted data to cause a denial of service.

External References:

https://github.com/google/guava/wiki/CVE-2018-10237 https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion

Upstream Patch:

https://github.com/google/guava/commit/7ec8718f1e6e2814dabaa4b9f96b6b33a813101c

It was found that Picketlink implementation replaces special strings for obtaining attribute values with system property values in SAML messages while parsing. An attacker can misuse this to determine values of system properties at the attacked system by formatting the SAML request ID field to the chosen system property name of his liking, obtaining the property value in "InResponseTo" field in the response.

Upstream bug (for Keycloak):

https://issues.jboss.org/browse/KEYCLOAK-4160

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

Jan Bee of the Google Security Team reports:

The /usr/sbin/rhnregks fails to properly validate hostnames in certificates. This can result in man in the middle attacks.

Please note that this issue cannot easily be exploited to cause any significant damage to a system other then preventing registration from taking place properly which the attacker would be able to do in any event if the can man in the middle the connection.

Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.

Martin Holst Swende discovered a flaw in the way modheaders handled chunked requests. A remote attacker could use this flaw to bypass intended modheaders restrictions, allowing them to send requests to applications that include headers that should have been removed by modheaders.

Discussion and a possible patch is available from the following thread:

http://marc.info/?t=138219209900002&r=1&w=2

References:

http://martin.swende.se/blog/HTTPChunked.html

An information disclosure flaw was found in the way libuser, an user and group account administration library, performed movement of user's home directory. Previously, during the move the ownership of all the (sub)entries present in directory tree, to be moved, were changed from privileged user account to the effective user id of the user, the home directory should belong to. A local attacker could use this flaw to conduct hardlink attacks and possibly obtain unauthorized access to arbitrary system file.

This issue was found by Miloslav Trmač of Red Hat.

A TOCTOU (time-of-check time-of-use) race condition was found in the way libuser, a user and group account administration library, performed copying and removal of (user) directory trees. A local attacker, with permissions to write into particular directory, could use this flaw to conduct symbolic link attacks, leading to their ability to alter / remove directories outside of this directory (tree), if this directory was simultaneously modified (copied or removed) via libuser functionality.

This issue was found by Florian Weimer of Red Hat Product Security Team.

A flaw was found in the default error response for status code 400. This could be used by an attacker to expose "httpOnly" cookies, when no custom ErrorDocument was specified.

This affects all versions of Apache from 2.2.0 up to and including 2.2.21. It will be fixed upstream in 2.2.22 (via r1235454 [1]).

[1] http://svn.apache.org/viewvc?view=revision&revision=1235454

Apache 2.2 fixed a possible crash on shutdown if a child changes the sbtype field in the scoreboard. Since unprivileged children should not be able to affect the parent in this way, this is treated as a Low severity security issue [1].

The reporter has a nice writeup of the flaw as well [2].

[1] http://svn.apache.org/viewvc?view=revision&revision=1230065 [2] http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/

Reported internally.

static int gfslock(struct file file, int cmd, struct filelock fl) { .. if ((ip->idi.dimode & (SISGID | SIXGRP)) == SISGID) return -ENOLCK; .. }

This is a check for mandatory locking where the GFS locking code will skip the lock in case sgid bits are set for the file.

This is similar to bz 218777 which affected RHEL 4 NFS shares on the client. The reproducer from https://bugzilla.redhat.com/showbug.cgi?id=218777#c1 (private) can be used to crash a system mounting a GFS filesystem.

I was able to reproduce this on 2.6.18-164.11.1 with kmod-gfs-0.1.34-2.el5

----------- [cut here ] --------- [please bite here ] --------- Kernel BUG at fs/locks.c:2080 invalid opcode: 0000 [1] SMP last sysfs file: /kernel/dlm/gfs-sachin/id CPU 0 Modules linked in: gfs(U) lockdlm gfs2 dlm configfs netloop netbk blktap blkbk iptMASQUERADE iptablenat ipnat xtstate ipconntrack nfnetlink iptREJECT xttcpudp iptablefilter iptables xtables bridge autofs4 hidp rfcomm l2cap bluetooth lockd sunrpc iscsitcp bnx2i cnic uio cxgb3i cxgb3 8021q libiscsitcp ibiser libiscsi2 scsitransportiscsi2 scsitransportiscsi ibsrp rds ibsdp ibipoib ipoibhelper ipv6 xfrmnalgo cryptoapi rdmaucm rdmacm ibucm ibuverbs ibumad ibcm iwcm ibaddr ibsa ibmad ibcore loop dmemc dmroundrobin dmmultipath scsidh video hwmon backlight sbs i2cec i2ccore button battery asusacpi ac parportpc lp parport srmod sg joydev pcspkr i5000edac edacmc qla2xxx bnx2 atapiix libata scsitransportfc serialcore serioraw idecd cdrom dmraid45 dmmessage dmregionhash dmmemcache dmsnapshot dmzero dmmirror dmlog dmmod usbstorage shpchp mptsas mptscsih mptbase scsitransportsas sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihc

Pid: 12585, comm: crash Tainted: G 2.6.18-164.11.1.HOTFIX.el5xen #1 RIP: e030:[<ffffffff80227976>] [<ffffffff80227976>] locksremoveflock+0xe4/0x124 RSP: e02b:ffff88003ff5de28 EFLAGS: 00010246 RAX: ffff88005275b3f8 RBX: ffff88003fb405b0 RCX: 7fffffffffffffff RDX: 0000000000000000 RSI: 0000000000000007 RDI: ffffffff8052d800 RBP: ffff8800512d23c0 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88003ff5de28 R11: 00000000000000b0 R12: ffff88003fb404b0 R13: ffff88003fb404b0 R14: ffff8800545af0c0 R15: ffff88003fed64b0 FS: 00002b71ceb65210(0000) GS:ffffffff805ca000(0000) knlGS:0000000000000000 CS: e033 DS: 0000 ES: 0000 Process crash (pid: 12585, threadinfo ffff88003ff5c000, task ffff880060288040) Stack: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000003129 0000000000000000 0000000000000000 0000000000000000 Call Trace: [<ffffffff802132d8>] fput+0x94/0x198 [<ffffffff802240af>] filpclose+0x5c/0x64 [<ffffffff8021e2c7>] sysclose+0x88/0xbd [<ffffffff802602f9>] tracesys+0xab/0xb6

nfsd in the Linux kernel before 2.6.28.9 does not drop the CAPMKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the rootsquash option.

It was reported to secalert that the autofs defaults do not set the nodev NFS option.

bug 410031 notes the missing nosuid option by default for the /net autofs filesystems, the fix for that issue did not take into account that there was also a missing nodev option for these filesystems.

Without the nodev option, it is possible for an attacker to mount a remote filesystem which could give them access to various devices that should normally have restricted access, such as /dev/mem, and various hardware devices.

Acknowledgements:

Red Hat would like to thank Tim Baum for reporting this issue.

Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions, which allows local users to perform unauthorized named commands, such as causing a denial of service by stopping named.

Reported to the Red Hat Security Response Team via secalert:

"A stock install of RHEL5 and Fedora 8 (and possibly earlier versions) have /net managed by autofs (look at /etc/auto.master).

Unfortunately, the "nosuid" mount option is not specified, meaning that any system auto-mounted under /net may have arbitrary suid root binaries.

How to exploit this vulnerability: An attacker can set up an NFS server on a remote host, and connect to the vulnerable system with an unprivileged user account. From here, the attacker can change directory to /net/remote.host.tld/export on the vulnerable system, and execute arbitrary "setuid root" binaries that they have placed on their nfs server."

Acknowledgements:

Red Hat would like to thank Josh Lange for reporting this issue.

Unspecified vulnerability in the "stack unwinder fixes" in kernel in Red Hat Enterprise Linux 5, when running on AMD64 and Intel 64, allows local users to cause a denial of service via unknown vectors.

Due issue described in https://bugzilla.redhat.com/showbug.cgi?id=313681

open(OATOMICLOOKUP) leaks the dentry on the filesystems where drevalidate is implemented. i.e open ("/proc/self/exe", ORDONLY); open ("/proc/self/exe", ORDONLY | 02000000);

leaks one dentry.

By this way it's possible to eat all the memory on the node or overflow dentry->dcount.

Both RHEL4 and RHEL5 kernels are vulnerabled

Acknowledgements:

Red Hat would like to credit Vasily Averin for reporting this issue.

mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows local users to cause a denial of service (OOPS) via unspecified vectors.

reported via secalert

By default, the sealert program writes diagnostic messages to the file /tmp/sealert.log. It does not check to ensure that this file does not already exist, or that it is not a symbolic link. An unprivileged local attacker can exploit this flaw to cause arbitrary files writable by other users to be overwritten when those users run sealert. The sealert program is run automatically, without user action, as part of the default RHEL 5 GNOME desktop session. It does not appear to be possible for the attacker to cause arbitrary data to be written to sealert.log, but the previous contents of the file are erased.'

Directory traversal vulnerability in the containsdotdot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

The VNC server implementation in QEMU, as used by Xen and possibly other environments, allows local users of a guest operating system to read arbitrary files on the host operating system via unspecified vectors related to QEMU monitor mode, as demonstrated by mapping files to a CDROM device. NOTE: some of these details are obtained from third party information.

Description of problem:

Testsuite case in frysk exercises the kernel with tracing a small executable (using strace), where the executable exec's a given command in a separate thread. When that non-main thread completed, a kernel bug is triggered.

Version-Release number of selected component (if applicable):

kernel 2.6.19-1.2895.fc6

How reproducible:

About 3 out of 5 attempts.

Steps to Reproduce: 1. Compile threadexec.c (attached) 2. Issue the command: strace -f -o /dev/null ./threadexec /bin/echo hi | grep hi 3. Repeat a few times if necessary Actual results:

Program execution will print 'hi' on a single line. Kernel BUG will be reported in kernel messages.

Expected results:

Program execution should print 'hi' on a single line.

Additional info:

The bugzilla report for frysk is:

http://sourceware.org/bugzilla/showbug.cgi?id=3820

A similar earlier problem existed that prompted this test case to be written. The original frysk bug was:

http://sourceware.org/bugzilla/showbug.cgi?id=2130