[kernel-sec-discuss] r1495 - active
Michael Gilbert
gilbert-guest at alioth.debian.org
Thu Sep 17 18:52:22 UTC 2009
Author: gilbert-guest
Date: 2009-09-17 18:52:22 +0000 (Thu, 17 Sep 2009)
New Revision: 1495
Added:
active/CVE-2008-4609
active/CVE-2009-2695
Modified:
active/CVE-2009-3234
Log:
new issues and some info
Added: active/CVE-2008-4609
===================================================================
--- active/CVE-2008-4609 (rev 0)
+++ active/CVE-2008-4609 2009-09-17 18:52:22 UTC (rev 1495)
@@ -0,0 +1,24 @@
+Candidate: CVE-2008-4609
+Description:
+ The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft
+ Windows, (4) Cisco products, and probably other operating systems allows remote
+ attackers to cause a denial of service (connection queue exhaustion) via multiple
+ vectors that manipulate information in the TCP state table, as demonstrated by
+ sockstress.
+References:
+ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4609
+Ubuntu-Description:
+Notes:
+ - apparently some fundamental flaws in tcp. microsoft patched this in versions >xp.
+ - lots of speculation but not much definitive. not sure whether its too big of a deal.
+ - just denial-of-services?
+Bugs:
+upstream:
+linux-2.6:
+2.6.18-etch-security:
+2.6.24-etch-security:
+2.6.26-lenny-security:
+2.6.15-dapper-security:
+2.6.22-gutsy-security:
+2.6.24-hardy-security:
+2.6.27-intrepid-security:
Added: active/CVE-2009-2695
===================================================================
--- active/CVE-2009-2695 (rev 0)
+++ active/CVE-2009-2695 2009-09-17 18:52:22 UTC (rev 1495)
@@ -0,0 +1,25 @@
+Candidate: CVE-2009-2695
+Description:
+ The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that
+ target page zero and other low memory addresses, which allows local users to gain
+ privileges by exploiting NULL pointer dereference vulnerabilities, related to (1)
+ the default configuration of the allow_unconfined_mmap_low boolean in SELinux on
+ Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes
+ allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a
+ requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4)
+ interaction between the mmap_min_addr protection mechanism and certain application
+ programs.
+References:
+ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2695
+Ubuntu-Description:
+Notes:
+Bugs:
+upstream:
+linux-2.6:
+2.6.18-etch-security:
+2.6.24-etch-security:
+2.6.26-lenny-security:
+2.6.15-dapper-security:
+2.6.22-gutsy-security:
+2.6.24-hardy-security:
+2.6.27-intrepid-security:
Modified: active/CVE-2009-3234
===================================================================
--- active/CVE-2009-3234 2009-09-17 17:17:13 UTC (rev 1494)
+++ active/CVE-2009-3234 2009-09-17 18:52:22 UTC (rev 1495)
@@ -1,11 +1,15 @@
-Candidate:
+Candidate: CVE-2009-3234
Description:
+ "If we pass a big size data over perf_counter_open() syscall, the kernel
+ will copy this data to a small buffer, it will cause kernel crash."
References:
+ http://www.openwall.com/lists/oss-security/2009/09/16/1
Ubuntu-Description:
Notes:
+ kernel/perf_counter.c was introduced in commit 0793a61d (v2.6.31-rc1)
Bugs:
upstream: pending (2.6.32-rc2) [b3e62e3]
-linux-2.6:
+linux-2.6: needed
2.6.18-etch-security: N/A "vulnerable code not present"
2.6.24-etch-security: N/A "vulnerable code not present"
2.6.26-lenny-security: N/A "vulnerable code not present"
More information about the kernel-sec-discuss
mailing list