(SmoothWall Issues Fix) Linux Kernel mremap() Improper Bounds Checking Lets Local Users Gain Root Privileges
|
|
SecurityTracker Alert ID: 1008680 |
|
SecurityTracker URL: http://securitytracker.com/id/1008680
|
|
CVE Reference:
CAN-2003-0985
(Links to External Site)
|
Date: Jan 12 2004
|
Impact:
Denial of service via local system, Execution of arbitrary code via local system, Root access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.0
|
Description:
A vulnerability was reported in the Linux kernel do_mremap() function. A local user can gain elevated privileges.
Paul Starzetz and Wojciech Purczynski of iSEC Security Research reported that the mremap(2) system call does not perform proper bounds checking in the do_mremap() kernel code. A local user can reportedly cause the kernel to remap memory and create a virtual memory area that is 0 bytes in length.
According to the report, a local user can gain root privileges on the system through non-trivial exploit methods.
The original advisory is available at:
http://isec.pl/vulnerabilities/isec-0013-mremap.txt
|
Impact:
A local user can execute arbitrary code with root privileges. A local user can also cause denial of service conditions on the system.
|
Solution:
The vendor has released a fix (SmoothWall Express 2.0 fixes 1), available at:
http://smoothwall.org/p/2.0-fixes1.html
|
Vendor URL: smoothwall.org/security/advisories/SWP-2004.001.html (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 12 Jan 2004 20:38:26 +0000
Subject: SmoothWall Project Security Advisory SWP-2004:001
|
-------------------------------------------------------------
SmoothWall Project Security Advisory SWP-2004:001
-------------------------------------------------------------
Summary: Updates for SmoothWall Express to correct
local vulnerabilities in Linux kernel.
Importance: Critical
Issue: Possible local vulnerabilities
CVE Names: CAN-2003-0961, CAN-2003-0984, CAN-2003-0985
Released: 2004-01-12
SW-specific: no
Affected Products:
SmoothWall Express 2.0 (as shipped)
The products shown must be updated to the fix level as
shown above before applying any updates mentioned in this
advisory.
-------------------------------------------------------------
Description
-------------------------------------------------------------
Critical security vulnerabilities have been found in the
Linux kernel in the following areas:
- Locally exploitable vulnerabilities in memory management
code (do_brk(), mremap system calls)
- Improper structure initialisation in real time clock (RTC)
routines can result in leaked kernel data to user space
These vulnerabilities can result in privilege escalation or
unwanted availability of sensitive information.
-------------------------------------------------------------
Corrective Actions
-------------------------------------------------------------
You should download and install the required update for
your product(s). The updates can be downloaded from the
web links below, along with installation instructions and
any further caveats or updates.
SmoothWall Express 2.0 fixes 1
- http://smoothwall.org/p/2.0-fixes1.html
-------------------------------------------------------------
Further Information
-------------------------------------------------------------
CVE Candidate CAN-2003-0961
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0961
CVE Candidate CAN-2003-0984
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0984
CVE Candidate CAN-2003-0985
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0985
CERT(r) VU Note (do_brk())
- http://www.kb.cert.org/vuls/id/301156
CERT(r) VU Note (memory deallocation)
- http://www.kb.cert.org/vuls/id/935264
Linux Kernel do_brk() Lacks Argument Bound Checking
- http://isec.pl/vulnerabilities/isec-0012-do_brk.txt
Linux Kernel RTC Memory Leak
- http://xforce.iss.net/xforce/xfdb/13943
Linux Kernel do_mremap Local Privilege Escalation
- http://isec.pl/vulnerabilities/isec-0013-mremap.txt
Linux Kernel 2.4.23 Changelog
- http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.23
Linux Kernel 2.4.24 Changelog
- http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.24
|
|
