Linux kernel dnotify privilege escalation
| linux-kernel-dnotify-privilege-escalation (42131) |  High Risk |
Description:
Linux kernel could allow a local attacker to gain elevated privileges on the system, caused by a race condition error in the dnotify subsystem between the fcntl() and close() calls. An attacker could exploit this vulnerability to gain root privileges or cause the system to crash.
Platforms Affected:
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 7.04
- Canonical, Ubuntu 7.10
- Canonical, Ubuntu 8.04 LTS
- Debian, Debian Linux 4.0
- Linux, Kernel 2.6.0 test4
- Linux, Kernel 2.6.0 test3
- Linux, Kernel 2.6.0 test2
- Linux, Kernel 2.6.0 test11
- Linux, Kernel 2.6.0 test5
- Linux, Kernel 2.6.0 test6
- Linux, Kernel 2.6.0 test7
- Linux, Kernel 2.6.0 test8
- Linux, Kernel 2.6.0 test9
- Linux, Kernel 2.6.0 test9-cvs
- Linux, Kernel 2.6.10
- Linux, Kernel 2.6.11.10
- Linux, Kernel 2.6.11.12
- Linux, Kernel 2.6.11.4
- Linux, Kernel 2.6.11.5
- Linux, Kernel 2.6.11.6
- Linux, Kernel 2.6.11.7
- Linux, Kernel 2.6.11.8
- Linux, Kernel 2.6.11.9
- Linux, Kernel 2.6.15
- Linux, Kernel 2.6.18
- Linux, Kernel 2.6.20
- Linux, Kernel 2.6.20.1
- Linux, Kernel 2.6.20.11
- Linux, Kernel 2.6.20.13
- Linux, Kernel 2.6.20.2
- Linux, Kernel 2.6.20.3
- Linux, Kernel 2.6.21 rc3
- Linux, Kernel 2.6.21 rc4
- Linux, Kernel 2.6.21 rc5
- Linux, Kernel 2.6.21 rc6
- Linux, Kernel 2.6.21 rc7
- Linux, Kernel 2.6.21
- Linux, Kernel 2.6.23.1
- Linux, Kernel 2.6.23.14
- Linux, Kernel 2.6.23.9
- Linux, Kernel 2.6.24 rc2
- Linux, Kernel 2.6.3
- Linux, Kernel 2.6.4
- Linux, Kernel 2.6.5
- Linux, Kernel 2.6.6 rc1
- Linux, Kernel 2.6.6
- Linux, Kernel 2.6.7
- Linux, Kernel 2.6.8
- MandrakeSoft, Mandrake Linux 2007.1 X86_64
- MandrakeSoft, Mandrake Linux 2007.1
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux 2008.1
- MandrakeSoft, Mandrake Linux 2008.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft, Mandrake Multi Network Firewall 2.0
- Novell, Linux Desktop 9
- Novell, Linux POS 9
- Novell, OpenSUSE 10.2
- Novell, OpenSUSE 10.3
- Novell, SLE SDK 10 SP1
- Novell, SUSE Linux Enterprise 10 SP1 DEBUGINFO
- Novell, SUSE Linux Enterprise Desktop 10 SP1
- Novell, SUSE Linux Enterprise Server 10 SP1
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux 5 Client
- SuSE, SuSE SLES 9
- VMware, ESX Server 3.0.1
- VMware, ESX Server 3.0.2
- VMware, ESX Server 3.5
Remedy:
Upgrade to the latest version of Linux kernel (2.6.25.1 or later), available from The Linux Kernel Archives Web site. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Gain Privileges
References:
- The Linux Kernel Archives Web site, ChangeLog-2.6.25.1 at http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.1.
- The Linux Kernel Archives Web site, The Linux Kernel Archives at http://www.kernel.org/.
- VMware Security-Announce Mailing List, Mon Jul 28 18:11:35 PDT 2008, VMSA-2008-00011 Updated ESX service console packages for Samba and vmnix at http://lists.vmware.com/pipermail/security-announce/2008/000023.html.
- ASA-2008-203: kernel security and bug fix update (RHSA-2008-0211)
- ASA-2008-225: kernel security and bug fix update (RHSA-2008-0237)
- BID-29003: Linux Kernel 'dnotify.c' Local Race Condition Vulnerability
- CVE-2008-1375: Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.
- DSA-1565: linux-2.6 -- several vulnerabilities
- MDVSA-2008:104: Updated kernel packages fix vulnerabilities
- MDVSA-2008:105: Updated kernel packages fix vulnerabilities
- MDVSA-2008:167: kernel
- RHSA-2008-0211: Important: kernel security and bug fix update
- RHSA-2008-0233: Important: kernel security and bug fix update
- RHSA-2008-0237: Important: kernel security and bug fix update
- SA30044: Linux Kernel Multiple Vulnerabilities
- SA30108: Linux Kernel Multiple Vulnerabilities
- SA31246: VMware ESX Server update for Samba and vmnix
- SECTRACK ID: 1019959: Linux Kernel Directory Notification Subsytem Race Condition Lets Local Users Deny Service and Potentially Gain Elevated Privileges
- SUSE-SA:2008:030: Linux kernel security update
- SUSE-SA:2008:031: Linux kernel security problems
- SUSE-SA:2008:032: SUSE Linux Enterprise 10 SP1 Linux kernel
- USN-614-1: Linux kernel vulnerabilities
- USN-618-1: Linux kernel vulnerabilities
- VUPEN/ADV-2008-1406: Linux Kernel Local Privilege Escalation and Memory Corruption Issues
- VUPEN/ADV-2008-1452: Linux Kernel Privilege Escalation and Denial of Service Vulnerabilities
- VUPEN/ADV-2008-2222: VMware ESX Server Security Update Fixes Multiple Vulnerabilities
Reported:
May 01, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net