Linux Kernel 2.4 O_DIRECT Processing Flaw May Disclose File System Information to Local Users
|
|
SecurityTracker Alert ID: 1006049 |
|
CVE Reference: CAN-2003-0018
(Links to External Site)
|
Date: Feb 6 2003
|
Impact: Denial of service via local system, Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): Kernel 2.4.10 and later
|
Description: A vulnerability was reported in the Linux 2.4 kernel. A local user may be able to read some information from the file system that the user is not authorized to read.
It is reported that there is a vulnerability in the O_DIRECT handling in Linux kernels 2.4.10 and later. An information leak may
allow a local user with write privileges to the file system to read information from the file system from previously deleted files.
The local user may also be able to corrupt the file system in a minor fashion that can reportedly be easily repaired by fsck.
|
Impact: A local user may be able to read portions of previously deleted files (belonging to other users) and may be able to cause minor file system corruption.
|
Solution: Vendors of the various Linux distributions are releasing fixes. See the Message History for Alerts covering individual vendor fixes.
According
to MITRE, the 2.4.18 kernel is affected.
[At the time of this entry, it was not clear exactly which version of the kernel contains
the fix.]
|
Vendor URL: www.kernel.org/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any)
|
Underlying OS: Linux (Caldera), Linux (Conectiva), Linux (Debian), Linux (EnGarde), Linux (Gentoo), Linux (HP Secure OS), Linux (Immunix), Linux (Mandrake), Linux (Progeny Debian), Linux (Red Hat), Linux (Slackware), Linux (Sun), Linux (SuSE), Linux (Trustix), Linux (Turbo Linux), Linux (Xandros)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 06 Feb 2003 01:15:50 -0500
Subject: O_DIRECT Bug in Linux Kernel 2.4.10 and later
|
RedHat reported that there is a vulnerability system O_DIRECT handling in Linux kernels 2.4.10 and
later. An information leak may allow a local user with write privileges to the file system to read
information from the file system from previously deleted files. The local user may also be able to
corrupt the file system in a minor fashion that can reportedly be easily repaired by fsck.
CVE: CAN-2003-0018
|
|
