Linux kernel ISO9660 denial of service

kernel-iso9660-dos (30029) The risk level is classified as LowLow Risk

Description:

The Linux kernel is vulnerable to a denial of service caused by improper handling of corrupted data structures by the isofs_get_blocks() function when mounting a corrupted filesystem. By performing a read on a specially-crafted ISO9660 filesystem, a local attacker can cause an infinite loop in the isofs_get_blocks() function, resulting in a denial of service.

Platforms Affected:

  • Canonical, Ubuntu 5.10
  • Canonical, Ubuntu 6.06 LTS
  • Canonical, Ubuntu 6.10
  • Debian, Debian Linux 3.1
  • Linux, Kernel 2.6.0 test5
  • Linux, Kernel 2.6.0 test4
  • Linux, Kernel 2.6.0 test3
  • Linux, Kernel 2.6.0 test2
  • Linux, Kernel 2.6.0 test11
  • Linux, Kernel 2.6.0 test10
  • Linux, Kernel 2.6.0 test1
  • Linux, Kernel 2.6.0 test6
  • Linux, Kernel 2.6.0 test7
  • Linux, Kernel 2.6.0 test8
  • Linux, Kernel 2.6.0 test9
  • Linux, Kernel 2.6.0 test9-cvs
  • Linux, Kernel 2.6.1 rc1
  • Linux, Kernel 2.6.1
  • Linux, Kernel 2.6.1 rc2
  • Linux, Kernel 2.6.10
  • Linux, Kernel 2.6.10 rc2
  • Linux, Kernel 2.6.11
  • Linux, Kernel 2.6.11 rc2
  • Linux, Kernel 2.6.11 rc4
  • Linux, Kernel 2.6.11 rc3
  • Linux, Kernel 2.6.11.11
  • Linux, Kernel 2.6.11.12
  • Linux, Kernel 2.6.11.4
  • Linux, Kernel 2.6.11.5
  • Linux, Kernel 2.6.11.6
  • Linux, Kernel 2.6.11.7
  • Linux, Kernel 2.6.11.8
  • Linux, Kernel 2.6.12 rc4
  • Linux, Kernel 2.6.12 rc1
  • Linux, Kernel 2.6.12
  • Linux, Kernel 2.6.12 rc5
  • Linux, Kernel 2.6.12.1
  • Linux, Kernel 2.6.12.2
  • Linux, Kernel 2.6.12.3
  • Linux, Kernel 2.6.12.4
  • Linux, Kernel 2.6.12.5
  • Linux, Kernel 2.6.12.6
  • Linux, Kernel 2.6.13 rc4
  • Linux, Kernel 2.6.13 rc1
  • Linux, Kernel 2.6.13
  • Linux, Kernel 2.6.13 rc6
  • Linux, Kernel 2.6.13 rc7
  • Linux, Kernel 2.6.13.1
  • Linux, Kernel 2.6.13.2
  • Linux, Kernel 2.6.13.3
  • Linux, Kernel 2.6.13.4
  • Linux, Kernel 2.6.14 rc4
  • Linux, Kernel 2.6.14 rc3
  • Linux, Kernel 2.6.14 rc1
  • Linux, Kernel 2.6.14
  • Linux, Kernel 2.6.14 rc2
  • Linux, Kernel 2.6.14.1
  • Linux, Kernel 2.6.14.2
  • Linux, Kernel 2.6.14.3
  • Linux, Kernel 2.6.14.4
  • Linux, Kernel 2.6.14.5
  • Linux, Kernel 2.6.15
  • Linux, Kernel 2.6.15 rc1
  • Linux, Kernel 2.6.15 rc3
  • Linux, Kernel 2.6.15 rc2
  • Linux, Kernel 2.6.15.1
  • Linux, Kernel 2.6.15.2
  • Linux, Kernel 2.6.15.3
  • Linux, Kernel 2.6.15.4
  • Linux, Kernel 2.6.15.5
  • Linux, Kernel 2.6.16 rc1
  • Linux, Kernel 2.6.16
  • Linux, Kernel 2.6.16.1
  • Linux, Kernel 2.6.16.11
  • Linux, Kernel 2.6.16.12
  • Linux, Kernel 2.6.16.13
  • Linux, Kernel 2.6.16.19
  • Linux, Kernel 2.6.16.23
  • Linux, Kernel 2.6.16.27
  • Linux, Kernel 2.6.16.7
  • Linux, Kernel 2.6.16.9
  • Linux, Kernel 2.6.17
  • Linux, Kernel 2.6.17 rc5
  • Linux, Kernel 2.6.17.1
  • Linux, Kernel 2.6.17.10
  • Linux, Kernel 2.6.17.11
  • Linux, Kernel 2.6.17.12
  • Linux, Kernel 2.6.17.13
  • Linux, Kernel 2.6.17.14
  • Linux, Kernel 2.6.17.3
  • Linux, Kernel 2.6.17.5
  • Linux, Kernel 2.6.17.6
  • Linux, Kernel 2.6.17.7
  • Linux, Kernel 2.6.17.8
  • Linux, Kernel 2.6.18
  • Linux, Kernel 2.6.18.1
  • Linux, Kernel 2.6.19 rc1
  • Linux, Kernel 2.6.2
  • Linux, Kernel 2.6.3
  • Linux, Kernel 2.6.4
  • Linux, Kernel 2.6.5
  • Linux, Kernel 2.6.6
  • Linux, Kernel 2.6.6 rc1
  • Linux, Kernel 2.6.7
  • Linux, Kernel 2.6.7 rc1
  • Linux, Kernel 2.6.8 rc1
  • Linux, Kernel 2.6.8 rc3
  • Linux, Kernel 2.6.8 rc2
  • Linux, Kernel 2.6.8
  • Linux, Kernel 2.6.9
  • MandrakeSoft, Mandrake Linux 2006 X86_64
  • MandrakeSoft, Mandrake Linux 2006
  • MandrakeSoft, Mandrake Linux 2007 X86_64
  • MandrakeSoft, Mandrake Linux 2007
  • MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
  • MandrakeSoft, Mandrake Linux Corporate Server 4.0
  • Novell, Linux Desktop 9
  • Novell, Linux POS 9
  • Novell, Open Enterprise Server
  • Novell, Open Enterprise Server
  • RedHat, Enterprise Linux 4 AS
  • RedHat, Enterprise Linux 4 Desktop
  • RedHat, Enterprise Linux 4 WS
  • RedHat, Enterprise Linux 4 ES
  • SuSE, Linux Enterprise Server 9
  • SuSE, SuSE SLED 10
  • SuSE, SuSE SLES 10
  • SuSE, SuSE SLES 9

Remedy:

For Mandriva Linux:
Refer to Mandriva Linux Security Advisory MDKSA-2007:012 for patch, upgrade, or suggested workaround information. See References.

For Red Hat Linux (kernel):
Refer to RHSA-2007:0014 for patch, upgrade, or suggested workaround information. See References.

For Ubuntu Linux:
Refer to USN-416-1 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

Consequences:

Denial of Service

References:

  • MOKB-05-11-2006, Linux 2.6.x ISO9660 __find_get_block_slow() denial of service at http://www.securiteam.com/mokb/projects.info-pull.com/mokb/MOKB-05-11-2006.html.
  • The The Linux Kernel Archives Web site, The Linux Kernel Archives at http://www.kernel.org/.
  • ASA-2007-063: kernel security update (RHSA-2007-0014)
  • BID-20920: Linux Kernel ISO9660 Denial of Service Vulnerability
  • CVE-2006-5757: Race condition in the __find_get_block_slow function in the ISO9660 filesystem in Linux 2.6.18 and possibly other versions allows local users to cause a denial of service (infinite loop) by mounting a crafted ISO9660 filesystem containing malformed data structures.
  • DSA-1304: kernel-source-2.6.8 -- several vulnerabilities
  • MDKSA-2007:002: Updated kernel packages fix multiple vulnerabilities and bugs
  • MDKSA-2007:012: Updated kernel packages fix multiple vulnerabilities and bugs
  • RHSA-2007-0014: Important: kernel security update
  • SA22702: Linux Kernel ISO9660 Local Denial of Service
  • SA22746: Fedora Core ISO9660 Local Denial of Service
  • SA24206: Avaya Products Kernel Multiple Vulnerabilities
  • SUSE-SA:2006:079: Linux kernel security problems
  • USN-416-1: Linux kernel vulnerabilities
  • USN-416-2: nvidia-glx-config regression
  • VUPEN/ADV-2006-4359: Linux Kernel isofs_get_blocks() ISO9660 Local Denial of Service Vulnerability

Reported:

Nov 05, 2006

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page