(VMware Issues Fix) Linux Kernel do_mremap() Fails to Check do_munmap() Return Values, Allowing a Local User to Gain Root Privileges
|
|
SecurityTracker Alert ID: 1009635
|
|
CVE Reference: CAN-2004-0077
(Links to External Site)
|
Date: Apr 2 2004
|
Impact: Execution of arbitrary code via local system, Root access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): ESX Server 1.5.2, 2.0, and 2.0.1
|
Description: Another vulnerability was reported in the Linux kernel do_mremap() function. A local user can execute arbitrary code with root privileges.
Paul Starzetz discovered and reported that there is a missing return value check within the mremap(2) system call.
When resizing
or moving virtual memory areas, the function reportedly does not test the return value of the do_munmap() function. Cases where
the function fails (for example, due to the number of virtual memory areas being exceeded by the calling process) will not be properly
detected, according to the report. As a result, the kernel may move memory belonging to one process into memory space that is allocated
to another process.
Some other calls to the do_munmap() function are also not checked, the report said.
A local user can gain
root privileges on the target system.
The original advisory is available at:
http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt
|
Impact: A local user can gain root privileges on the target system.
|
Solution: VMware issued a security update for ESX Server 1.5.2, 2.0, and 2.0.1.
For ESX Server 2.0.1:
http://www.vmware.com/download/esx/esx201-7427update.html
For
ESX Server 2:
http://www.vmware.com/download/esx/esx20-7483update.html
For ESX Server 1.5.2 patch 5:
http://www.vmware.com/download/esx/esx152-7428update.html
|
Cause: Boundary error
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 01 Apr 2004 20:34:55 -0500
Subject: VMware security update
|
VMware issued a security update for ESX Server 1.5.2, 2.0, and 2.0.1 regarding CVE entries
CAN-2004-0077, CAN-2003-0961, and CAN-2003-0985.
For ESX Server 2.0.1:
http://www.vmware.com/download/esx/esx201-7427update.html
For ESX Server 2:
http://www.vmware.com/download/esx/esx20-7483update.html
For ESX Server 1.5.2 patch 5:
http://www.vmware.com/download/esx/esx152-7428update.html
|
|
