RHSA-2009:1223Executive Summary
| Summary | |
|---|---|
| Title | kernel security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2009:1223 | First vendor Publication | 2009-08-24 |
| Vendor | RedHat | Last vendor Modification | 2009-08-24 |
| Severity (Vendor) | Important | Revision | 02 |
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentification | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
Problem Description: Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, noarch, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, noarch, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, noarch, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, noarch, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated packages fix the following security issues: * a flaw was found in the SOCKOPS_WRAP macro in the Linux kernel. This macro did not initialize the sendpage operation in the proto_ops structure correctly. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges. (CVE-2009-2692, Important) * a flaw was found in the udp_sendmsg() implementation in the Linux kernel when using the MSG_MORE flag on UDP sockets. A local, unprivileged user could use this flaw to cause a local denial of service or escalate their privileges. (CVE-2009-2698, Important) Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for responsibly reporting these flaws. Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 516949 - CVE-2009-2692 kernel: uninit op in SOCKOPS_WRAP() leads to privesc 518034 - CVE-2009-2698 kernel: udp socket NULL ptr dereference |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2009-1223.html |
CWE : Common Weakness Enumeration
| id | Name |
|---|---|
| CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:8657 | |||
| Oval ID: | oval:org.mitre.oval:def:8657 | ||
| Title: | VMware kernel NULL pointer dereference vulnerability | ||
| Description: | The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-2692 |
Version: | 2 |
| Platform(s): | VMWare ESX Server 4 |
Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:11526 | |||
| Oval ID: | oval:org.mitre.oval:def:11526 | ||
| Title: | Service Console update for COS kernel | ||
| Description: | The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-2692 |
Version: | 3 |
| Platform(s): | VMWare ESX Server 3.5 |
Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8557 | |||
| Oval ID: | oval:org.mitre.oval:def:8557 | ||
| Title: | VMware kernel udp_sendmsg function vulnerability | ||
| Description: | The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-2698 |
Version: | 2 |
| Platform(s): | VMWare ESX Server 4 |
Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:11514 | |||
| Oval ID: | oval:org.mitre.oval:def:11514 | ||
| Title: | Service Console update for COS kernel | ||
| Description: | The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-2698 |
Version: | 3 |
| Platform(s): | VMWare ESX Server 3.5 |
Product(s): | |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
ExploitDB Exploits
| id | Description |
|---|---|
| 2009-09-02 | Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit |
| 2009-09-02 | Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit (x86/x64) |
| 2009-08-31 | Linux Kernel 2.6 < 2.6.19 (32bit) ip_append_data() ring0 Root Exploit |
| 2009-08-24 | Linux Kernel 2.4/2.6 sock_sendpage() ring0 Root Exploit (simple ver) |
| 2009-08-18 | Linux Kernel 2.x sock_sendpage() Local Root Exploit (Android Edition) |
Open Source Vulnerability Database (OSVDB)
| id | Description |
|---|---|
| 57462 | Linux Kernel net/ipv*/udp.c MSG_MORE Flag Local Privilege Escalation |
| 56992 | Linux Kernel Multiple Protocol proto_ops() Initialization NULL Dereference Lo... |
Metasploit Database
| id | Description |
|---|---|
| 2009-08-13 | Linux Kernel Sendpage Local Privilege Escalation |
(High)
