-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ************************************************************************************ Netwosix Linux Security Advisory #2004-0003 <http://www.netwosix.org> - ----------------------------------------------------------------------------------- Package name: linux kernel Summary: Linux kernel do_mremap VMA limit local privilege escalation vulnerability. Date: 2004-02-20 Affected versions: Netwosix 1.0 ************************************************************************************ - -> Package description: - ------------------------ Linux Kernel. The core of the Linux Operative System. - -> Problem description: - ------------------------ Linux kernel do_mremap VMA limit local privilege escalation vulnerability. A critical security vulnerability has been found in the Linux kernel memory management code inside the mremap(2) system call due to missing function return value check. This bug is completely unrelated to the mremap bug disclosed on 05-01-2004 except concerning the same internal kernel function code. - -> Action: - ------------------------ Download the latest Linux Kernel (2.6.3) or use the patches available from the Linux Kernel official site. - - http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.3.tar.bz2 - - http://www.kernel.org/pub/linux/kernel/v2.6/patch-2.6.3.bz2 To build a new kernel: Move your file into /usr/src and follow this instructions. # tar xjf linux-2.6.3.tar.bz2 # cd /usr/src/linux-2.6.3 # make # make modules # make modules_install # cp arch/i386/boot/bzImage /vmlinuz # cp System.map / To patch the kernel: # mv patch-2.6.3.bz2 /usr/src/linux-2.6.1 # bzip2 -d patch-2.6.3.bz2 # patch -p1 < patch-2.6.3 # make # make modules # make modules_install # cp arch/i386/boot/bzImage /vmlinuz # cp System.map / - -> References - --------------------- Specific references for this advisory: http://www.isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt - -> About Linux Netwosix: - --------------------------------- Linux Netwosix is a powerful and optimized Linux distribution for servers and Network Security related jobs. It can also be used for special operations such as penetration testing with its big collection of security oriented software and sources. It's a light distribution created for the requirements of every SysAdmin and it's very portable and highly configurable. Our philosophy is to give greater liberty for configuration to the SysAdmin. Only in this way can he/she configure a powerful and stable server machine. Linux Netwosix also has a powerful ports system (Nepote) similar to the xBSD systems but more flexible and usable. - -> Questions? - --------------------- Check out our mailing lists: <http://www.netwosix.org/mailing.html> The advisory itself is available at <http://www.netwosix.org/adv03.html> - -------------------------------------------------- Vincenzo Ciaglia - Linux Netwosix Security Advisories <ciaglia@netwosix.org> - <http://www.netwosix.org> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFANo4t6jz9pGuz4koRAhGsAJ9Ze0JtbHdPjHyGsKO+mY/6pq/vNQCfSalt 26phZTdx3d2M4uiQvcgyc4I= =dMHb -----END PGP SIGNATURE-----
