The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions.
Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions.
The connector layer in the Linux kernel before 2.6.31.5 does not require the CAPSYSADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.
The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AFAPPLETALK socket, related to the atalkgetname function in net/appletalk/ddp.c; (2) an AFIRDA socket, related to the irdagetname function in net/irda/afirda.c; (3) an AFECONET socket, related to the econetgetname function in net/econet/afeconet.c; (4) an AFNETROM socket, related to the nrgetname function in net/netrom/afnetrom.c; (5) an AFROSE socket, related to the rosegetname function in net/rose/afrose.c; or (6) a raw CAN socket, related to the rawgetname function in net/can/raw.c.
Description of problem: 1) NET: llc, zero sockaddrllc struct sllcarphrd member of sockaddrllc might not be changed. Zero sllc before copying to the above layer's structure.
http://git.kernel.org/linus/3480c63bdf008e9289aab94418f43b9592978fff http://git.kernel.org/linus/28e9fc592cb8c7a43e4d3147b38be6032a0e81bc http://milw0rm.com/exploits/9513
Note that LLC sockets are restricted to root since v2.6.25-rc9 (see commit 3480c63b).
2) can: Fix rawgetname() leak rawgetname() can leak 10 bytes of kernel memory to user
http://git.kernel.org/linus/e84b90ae5eb3c112d1f208964df1d8156a538289
Note that this was introduced in v2.6.25-rc1.
3) irda: Fix irdagetname() leak irdagetname() can leak kernel memory to user.
http://git.kernel.org/linus/09384dfc76e526c3993c09c42e016372dc9dd22c
4) appletalk: fix atalkgetname() leak atalkgetname() can leak 8 bytes of kernel memory to user
http://git.kernel.org/linus/3d392475c873c10c10d6d96b94d092a34ebd4791 http://milw0rm.com/exploits/9521
5) netrom: Fix nrgetname() leak nrgetname() can leak kernel memory to user.
http://git.kernel.org/linus/f6b97b29513950bfbf621a83d85b6f86b39ec8db
6) econet: Fix econetgetname() leak econetgetname() can leak kernel memory to user.
http://git.kernel.org/linus/80922bbb12a105f858a8f0abb879cb4302d0ecaa
7) rose: Fix rosegetname() leak rosegetname() can leak kernel memory to user.
http://git.kernel.org/linus/17ac2e9c58b69a1e25460a568eae1b0dc0188c25
CVE request: http://article.gmane.org/gmane.comp.security.oss.general/2029 http://article.gmane.org/gmane.comp.security.oss.general/2033