ID

VAR-201205-0016

CVE

CVE-2011-3188

TITLE

Linux Kernel Authorization problem vulnerability

DESCRIPTION

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets. The NFSv4 implementation is one of the distributed file system protocols. Attackers with physical access to a system's USB ports could obtain elevated privileges using a specially crafted USB device. CVE-2011-0712 Rafael Dominguez Vega of MWR InfoSecurity reported an issue in the caiaq module, a USB driver for Native Instruments USB audio devices. Attackers with physical access to a system's USB ports could obtain elevated privileges using a specially crafted USB device. CVE-2011-2213 Dan Rosenberg discovered an issue in the INET socket monitoring interface. Updates for the hppa and ia64 architectures will be included in the upcoming 5.0.9 point release. However, given the high frequency at which low-severity security issues are discovered in the kernel and the resource requirements of doing an update, updates for lower priority issues will normally not be released for all kernels at the same time. Rather, they will be released in a staggered or "leap-frog" fashion. (CVE-2011-1833) Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494) Vasiliy Kulikov discovered that /proc/PID/io did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2497) It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. (CVE-2011-2695) Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. (CVE-2011-2905) Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. An attacker could use this flaw to possibly predict sequence numbers and inject packets. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 10.04 LTS: linux-image-2.6.32-319-ec2 2.6.32-319.39 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc), a standard system upgrade will automatically perform this as well. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: kernel security and bug fix update Advisory ID: RHSA-2011:1419-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1419.html Issue date: 2011-11-01 CVE Names: CVE-2011-3188 CVE-2011-3209 ===================================================================== 1. Summary: Updated kernel packages that fix two security issues and four bugs are now available for Red Hat Enterprise Linux 5.6 Extended Update Support. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5.6.z server) - i386, ia64, noarch, ppc, s390x, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: * The way IPv4 and IPv6 protocol sequence numbers and fragment IDs were generated could allow a man-in-the-middle attacker to inject packets and possibly hijack connections. Protocol sequence numbers and fragment IDs are now more random. (CVE-2011-3188, Moderate) * A flaw was found in the Linux kernel's clock implementation on 32-bit, SMP (symmetric multiprocessing) systems. A local, unprivileged user could use this flaw to cause a divide error fault, resulting in a denial of service. (CVE-2011-3209, Moderate) Red Hat would like to thank Dan Kaminsky for reporting CVE-2011-3188, and Yasuaki Ishimatsu for reporting CVE-2011-3209. In addition, this update fixes the following bugs: * When the Global File System 2 (GFS2) file system is suspended, its delete work queue is also suspended, along with any pending work on the queue. Prior to this update, if GFS2's transaction lock was demoted while the delete work queue was suspended, a deadlock could occur on the file system because the file system tried to flush the work queue in the lock demotion code. With this update, the delete work queue is no longer flushed by the lock demotion code, and a deadlock no longer occurs. Instead, the work queue is flushed by the unmount operation, so that pending work is properly completed. (BZ#733678) * A previously applied patch introduced a regression for third-party file systems that do not set the FS_HAS_IODONE2 flag, specifically, Oracle Cluster File System 2 (OCFS2). The patch removed a call to the aio_complete function, resulting in no completion events being processed, causing user-space applications to become unresponsive. This update reintroduces the aio_complete function call, fixing this issue. (BZ#734156) * Certain devices support multiple operation modes. For example, EMC CLARiiON disk arrays support ALUA mode and their own vendor specific mode for failover. In Red Hat Enterprise Linux 5.5, a bug was discovered that prevented tools such as multipath from being able to select the device/hardware handler plug-in to use. This resulted in the application (for example, multipath) not working properly. With this update, the kernel has been modified to allow applications to select the device/hardware handler to use, thus resolving this issue. (BZ#739900) * This update improves the performance of delete/unlink operations in a GFS2 file system with large files by adding a layer of metadata read-ahead for indirect blocks. (BZ#743805) Users should upgrade to these updated packages, which contain backported patches to resolve these issues. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system. 5. Bugs fixed (http://bugzilla.redhat.com/): 732658 - CVE-2011-3188 kernel: net: improve sequence number generation 732878 - CVE-2011-3209 kernel: panic occurs when clock_gettime() is called 733678 - GFS2: recovery stuck on transaction lock [rhel-5.6.z] 739900 - scsi_dh_emc gives "error attaching hardware handler" for EMC active-active SANs [rhel-5.6.z] 6. Package List: Red Hat Enterprise Linux (v. 5.6.z server): Source: kernel-2.6.18-238.28.1.el5.src.rpm i386: kernel-2.6.18-238.28.1.el5.i686.rpm kernel-PAE-2.6.18-238.28.1.el5.i686.rpm kernel-PAE-debuginfo-2.6.18-238.28.1.el5.i686.rpm kernel-PAE-devel-2.6.18-238.28.1.el5.i686.rpm kernel-debug-2.6.18-238.28.1.el5.i686.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.i686.rpm kernel-debug-devel-2.6.18-238.28.1.el5.i686.rpm kernel-debuginfo-2.6.18-238.28.1.el5.i686.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.i686.rpm kernel-devel-2.6.18-238.28.1.el5.i686.rpm kernel-headers-2.6.18-238.28.1.el5.i386.rpm kernel-xen-2.6.18-238.28.1.el5.i686.rpm kernel-xen-debuginfo-2.6.18-238.28.1.el5.i686.rpm kernel-xen-devel-2.6.18-238.28.1.el5.i686.rpm ia64: kernel-2.6.18-238.28.1.el5.ia64.rpm kernel-debug-2.6.18-238.28.1.el5.ia64.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.ia64.rpm kernel-debug-devel-2.6.18-238.28.1.el5.ia64.rpm kernel-debuginfo-2.6.18-238.28.1.el5.ia64.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.ia64.rpm kernel-devel-2.6.18-238.28.1.el5.ia64.rpm kernel-headers-2.6.18-238.28.1.el5.ia64.rpm kernel-xen-2.6.18-238.28.1.el5.ia64.rpm kernel-xen-debuginfo-2.6.18-238.28.1.el5.ia64.rpm kernel-xen-devel-2.6.18-238.28.1.el5.ia64.rpm noarch: kernel-doc-2.6.18-238.28.1.el5.noarch.rpm ppc: kernel-2.6.18-238.28.1.el5.ppc64.rpm kernel-debug-2.6.18-238.28.1.el5.ppc64.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.ppc64.rpm kernel-debug-devel-2.6.18-238.28.1.el5.ppc64.rpm kernel-debuginfo-2.6.18-238.28.1.el5.ppc64.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.ppc64.rpm kernel-devel-2.6.18-238.28.1.el5.ppc64.rpm kernel-headers-2.6.18-238.28.1.el5.ppc.rpm kernel-headers-2.6.18-238.28.1.el5.ppc64.rpm kernel-kdump-2.6.18-238.28.1.el5.ppc64.rpm kernel-kdump-debuginfo-2.6.18-238.28.1.el5.ppc64.rpm kernel-kdump-devel-2.6.18-238.28.1.el5.ppc64.rpm s390x: kernel-2.6.18-238.28.1.el5.s390x.rpm kernel-debug-2.6.18-238.28.1.el5.s390x.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.s390x.rpm kernel-debug-devel-2.6.18-238.28.1.el5.s390x.rpm kernel-debuginfo-2.6.18-238.28.1.el5.s390x.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.s390x.rpm kernel-devel-2.6.18-238.28.1.el5.s390x.rpm kernel-headers-2.6.18-238.28.1.el5.s390x.rpm kernel-kdump-2.6.18-238.28.1.el5.s390x.rpm kernel-kdump-debuginfo-2.6.18-238.28.1.el5.s390x.rpm kernel-kdump-devel-2.6.18-238.28.1.el5.s390x.rpm x86_64: kernel-2.6.18-238.28.1.el5.x86_64.rpm kernel-debug-2.6.18-238.28.1.el5.x86_64.rpm kernel-debug-debuginfo-2.6.18-238.28.1.el5.x86_64.rpm kernel-debug-devel-2.6.18-238.28.1.el5.x86_64.rpm kernel-debuginfo-2.6.18-238.28.1.el5.x86_64.rpm kernel-debuginfo-common-2.6.18-238.28.1.el5.x86_64.rpm kernel-devel-2.6.18-238.28.1.el5.x86_64.rpm kernel-headers-2.6.18-238.28.1.el5.x86_64.rpm kernel-xen-2.6.18-238.28.1.el5.x86_64.rpm kernel-xen-debuginfo-2.6.18-238.28.1.el5.x86_64.rpm kernel-xen-devel-2.6.18-238.28.1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2011-3188.html https://www.redhat.com/security/data/cve/CVE-2011-3209.html https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFOsCp6XlSAg2UNWIIRAqjtAKC+6itwqo7i/nD2TiB5jAoly0MGowCfU9EU LGpVFEpzls46GkvOInRcpSo= =qH8Q -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . The text of the original advisory is reproduced for reference: Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2011-1020 Kees Cook discovered an issue in the /proc filesystem that allows local users to gain access to sensitive process information after execution of a setuid binary. CVE-2011-1576 Ryan Sweat discovered an issue in the VLAN implementation. CVE-2011-2484 Vasiliy Kulikov of Openwall discovered that the number of exit handlers that a process can register is not capped, resulting in local denial of service through resource exhaustion (cpu time and memory). CVE-2011-2491 Vasily Averin discovered an issue with the NFS locking implementation. A malicious NFS server can cause a client to hang indefinitely in an unlock call. CVE-2011-2492 Marek Kroemeke and Filip Palian discovered that uninitialized struct elements in the Bluetooth subsystem could lead to a leak of sensitive kernel memory through leaked stack memory. CVE-2011-2495 Vasiliy Kulikov of Openwall discovered that the io file of a process' proc directory was world-readable, resulting in local information disclosure of information such as password lengths. CVE-2011-2496 Robert Swiecki discovered that mremap() could be abused for local denial of service by triggering a BUG_ON assert. CVE-2011-2497 Dan Rosenberg discovered an integer underflow in the Bluetooth subsystem, which could lead to denial of service or privilege escalation. CVE-2011-2517 It was discovered that the netlink-based wireless configuration interface performed insufficient length validation when parsing SSIDs, resulting in buffer overflows. CVE-2011-2525 Ben Pfaff reported an issue in the network scheduling code. CVE-2011-2700 Mauro Carvalho Chehab of Red Hat reported a buffer overflow issue in the driver for the Si4713 FM Radio Transmitter driver used by N900 devices. CVE-2011-2723 Brent Meshier reported an issue in the GRO (generic receive offload) implementation. This can be exploited by remote users to create a denial of service (system crash) in certain network device configurations. CVE-2011-2905 Christian Ohm discovered that the 'perf' analysis tool searches for its config files in the current working directory. This could lead to denial of service or potential privilege escalation if a user with elevated privileges is tricked into running 'perf' in a directory under the control of the attacker. CVE-2011-2909 Vasiliy Kulikov of Openwall discovered that a programming error in the Comedi driver could lead to the information disclosure through leaked stack memory. CVE-2011-2918 Vince Weaver discovered that incorrect handling of software event overflows in the 'perf' analysis tool could lead to local denial of service. CVE-2011-2928 Timo Warns discovered that insufficient validation of Be filesystem images could lead to local denial of service if a malformed filesystem image is mounted. CVE-2011-3188 Dan Kaminsky reported a weakness of the sequence number generation in the TCP protocol implementation. This can be used by remote attackers to inject packets into an active session. CVE-2011-3191 Darren Lavender reported an issue in the Common Internet File System (CIFS). A malicious file server could cause memory corruption leading to a denial of service. This update also includes a fix for a regression introduced with the previous security fix for CVE-2011-1768 (Debian: #633738) For the stable distribution (squeeze), this problem has been fixed in version 2.6.32-35squeeze2. Updates for issues impacting the oldstable distribution (lenny) will be available soon. The following matrix lists additional source packages that were rebuilt for compatibility with or to take advantage of this update: Debian 6.0 (squeeze) user-mode-linux 2.6.32-1um-4+35squeeze2 We recommend that you upgrade your linux-2.6 and user-mode-linux packages. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . (CVE-2011-3188) Yogesh Sharma discovered that CIFS did not correctly handle UNCs that had no prefixpaths

AFFECTED PRODUCTS