Linux kernel cpufreq information disclosure
| linux-cpufreq-info-disclosure (15951) |  Medium Risk |
Description:
Linux kernel could allow a local attacker to obtain sensitive information. A signedness error in the cpufreq proc handler could allow an attacker to obtain sensitive information, by reading kernel memory regions.
Consequences:
Obtain Information
Remedy:
For Mandrake Linux:
Upgrade to the latest kernel package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:050 : kernel for more information. See References.
Mandrake Linux 9.2: 2.4.22.32mdk-1-1mdk or later
Mandrake Linux 10.0: 2.4.25.5mdk-1-1mdk or later.
For Gentoo Linux:
Upgrade to the latest version of kernel, as listed in GLSA 200407-02. See References.
For Conectiva Linux:
Upgrade to the latest kernel package, as listed below.Refer to Conectiva Linux Security Announcement CLSA-2004:852 for more information. See References.
Conectiva Linux 10.0: 2.6.5-63255U10_1cl or later
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Conectiva Linux Security Announcement CLSA-2004:852: Fixes for kernel vulnerabilities.
- BID-10201: Linux Kernel CPUFreq Proc Handler Integer Handling Vulnerability
- CVE-2004-0228: Integer signedness error in the cpufreq proc handler (cpufreq_procctl) in Linux kernel 2.6 allows local users to gain privileges.
- GLSA-200407-02: Linux Kernel: Multiple vulnerabilities
- MDKSA-2004:050: Updated kernel packages fix multiple vulnerabilities
- SA11429: Linux Kernel setsockopt MCAST_MSFILTER Integer Overflow Vulnerability
- SA11464: Linux Kernel CPUFREQ Proc Handler Kernel Memory Disclosure Vulnerability
- SA11486: Linux Kernel Framebuffer Driver Direct Userspace Access Vulnerability
- SUSE-SA:2004:010: Linux Kernel: privilege escalation local DoS
Platforms Affected:
- Conectiva Linux 10
- Gentoo Linux
- Linux Kernel 2.6.0
- MandrakeSoft Mandrake Linux 10.0 AMD64
- MandrakeSoft Mandrake Linux 10.0
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux 9.2 AMD64
- Novell SuSE Linux Enterprise Server 7.0
- Novell UnitedLinux 1.0
- SUSE SuSE Linux 8.1
- SUSE SuSE Linux 9.0
- SuSE SuSE Linux Connectivity Server
- SuSE SuSE Linux Database Server
- SuSE SuSE Linux Desktop 1.0
- SuSE SuSE Linux Office Server
Reported:
Apr 23, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net