shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.

As per the upstream advisory:

OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack.

OpenSSL 1.0.0 users should upgrade to 1.0.0m. OpenSSL 1.0.1 users should upgrade to 1.0.1h.

Acknowledgements:

Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Felix Gröbert and Ivan Fratrić of Google as the original reporters of this issue.

As per the upstream advisory:

By sending an invalid DTLS handshake to an OpenSSL DTLS client, the code can be made to recurse, eventually crashing in a DoS attack.

Only applications using OpenSSL as a DTLS client are affected.

OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8za OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0m. OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1h. .

Acknowledgements:

Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Imre Rad of Search-Lab as the original reporter of this issue.

sosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive with an fstab file potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.

An integer overflow flaw was found in the way samba read an EA list provided by the client. A malicious client could send a specially crafted EA list that wraps perfectly on a 32-bit boundary, causing the server to loop and re-process the list. This can cause Denial of Service via memory exhaustion.

Reference:

https://bugzilla.samba.org/showbug.cgi?id=10010 (curently private)

A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file.

Due to a problem with the patch used to correct a problem with LDAP servers not correctly returning an opaque cookie to check for additional results when getting paged results from a server on 64-bit PowerPC and IBM System z platforms (RHBA-2012:0264), it was possible for a user to cause a denial of service of the autofs service. While this may not impact mounts that have already been mounted (other than preventing mount expiration), it will prevent any future mount requests from being processed until autofs is restarted.

It was discovered that the formatted printing functionality in glibc did not properly restrict the use of alloca(). A remote attacker could provide a specially crafted sequence of format specifiers, leading to a crash or, potentially, FORTIFYSOURCE format string protection mechanism bypass, when processed.

The dissectpacket function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file.

Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command. NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs.

Description of problem: Dom0 crashes when installing GPLPV drivers on Windows 2008 R2 guest.

Xen version: 3.1.2-194.11.3.el5 Dom0 kernel: 2.6.18-194.11.3.el5xen GPLPV: gplpvVista2008x640.11.0.213.msi and older

Redirected to serial console output:

Unable to handle kernel NULL pointer dereference at 0000000000000108 RIP: [<ffffffff8883f03f>] :blkbk:updateblkifstatus+0x21f/0x2ae PGD 0 Oops: 0000 [1] SMP last sysfs file: /class/net/lo/ifindex CPU 2 Modules linked in: tun xfs ocfs2(U) iptMASQUERADE netloop iptablenat ipnat netbk blktap blkbk mptctl mptbase ipmiwatchdog ipmisi(U) ipmidevintf(U) ipmimsghandler(U) autofs4 hidp l2cap bluetooth ocfs2dlmfs(U) ocfs2dlm(U) ocfs2nodemanager(U) configfs lockd sunrpc bonding ipconntracknetbiosns iptREJECT xtstate ipconntrack nfnetlink xtphysdev bridge iptablefilter iptables ip6tREJECT xttcpudp ip6tablefilter ip6tables xtables ipv6 xfrmnalgo cryptoapi be2iscsi ibiser rdmacm ibcm iwcm ibsa ibmad ibcore ibaddr iscsitcp bnx2i(U) cnic(U) cxgb3i cxgb3 libiscsitcp libiscsi2 scsitransportiscsi2 scsitransportiscsi loop dmroundrobin dmmultipath scsidh video backlight sbs powermeter hwmon i2cec i2ccore dellwmi wmi button battery asusacpi ac parportpc lp parport srmod cdrom sg serioraw pcspkr hpilo serialcore bnx2x(U) 8021q dmraid45 dmmessage dmregionhash dmmemcache dmsnapshot dmzero dmmirror dmlog dmmod usbstorage shpchp cciss(U) sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihcd Pid: 69, comm: xenwatch Tainted: G 2.6.18-194.11.3.el5xen 0000001 RIP: e030:[<ffffffff8883f03f>] [<ffffffff8883f03f>] :blkbk:updateblkifstatus+0x21f/0x2ae RSP: e02b:ffff88003e413df0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88003db2f620 RCX: 0000000000000003 RDX: ffffffffff578000 RSI: fffffffffffffffb RDI: 0000000000000000 RBP: ffff880031227b70 R08: 00000000ffffffff R09: 0000000000000020 R10: 00000000ffffffff R11: 0000000000000000 R12: ffff8800087edb40 R13: 0000000000000000 R14: ffff880000e0bcf0 R15: ffffffff8029c1ef FS: 00002b79280d26e0(0000) GS:ffffffff805d2100(0000) knlGS:0000000000000000 CS: e033 DS: 0000 ES: 0000 Process xenwatch (pid: 69, threadinfo ffff88003e412000, task ffff88003e3ea080) Stack: 2e6b6361626b6c62 0000006364682e33 ffff880000000025 ffff8800087edb40 ffff880034383c00 ffff8800087edb40 ffff880034383c00 ffffffff8883f2eb 6669636570736e75 737361202c646569 Call Trace: [<ffffffff8883f2eb>] :blkbk:frontendchanged+0x21d/0x226 [<ffffffff803b9c78>] xenwatchthread+0x0/0x135 [<ffffffff803b90ca>] xenwatchhandlecallback+0x15/0x48 [<ffffffff803b9d94>] xenwatchthread+0x11c/0x135 [<ffffffff8029c407>] autoremovewakefunction+0x0/0x2e [<ffffffff8029c1ef>] keventdcreatekthread+0x0/0xc4 [<ffffffff80233be4>] kthread+0xfe/0x132 [<ffffffff80260b2c>] childrip+0xa/0x12 [<ffffffff8029c1ef>] keventdcreatekthread+0x0/0xc4 [<ffffffff80233ae6>] kthread+0x0/0x132 [<ffffffff80260b22>] childrip+0x0/0x12

Code: 48 8b b8 08 01 00 00 e8 b3 f6 a7 f7 85 c0 89 c6 74 0d 48 8b RIP [<ffffffff8883f03f>] :blkbk:updateblkifstatus+0x21f/0x2ae RSP <ffff88003e413df0> CR2: 0000000000000108 <0>Kernel panic - not syncing: Fatal exception (XEN) Domain 0 crashed: rebooting machine in 5 seconds.

http://bugs.centos.org/bugviewadvancedpage.php?bugid=4517

Acknowledgements:

Red Hat would like to thank Vladymyr Denysov for reporting this issue.

The udpqueuercvskb function in net/ipv4/udp.c in a certain Red Hat build of the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (deadlock and system hang) by sending UDP traffic to a socket that has a crafted socket filter, a related issue to CVE-2010-4158.

arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure (VMCS) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when an Intel platform without Extended Page Tables (EPT) functionality is used, accesses VMCS fields without verifying hardware support for these fields, which allows local users to cause a denial of service (host OS crash) by requesting a VMCS dump for a fully virtualized Xen guest.

ibutils packages as shipped in Red Hat Enterprise Linux 4 and 5 are built to use insecure RPATH set in the ELF header of the ibmssh command.

This issue can possibly be exploited by a local attacker to run arbitrary code as some other user if victim user can be convinced to run ibmssh command in an attacker controlled directory with specially crafted content.

Affected binary: /usr/bin/ibmssh RPATH: refix/lib