rPath Security Advisory: 2007-0050-1
Published: 2007-03-06
Products: rPath Linux 1
Rating: Major
Exposure Level Classification:
Local Deterministic Vulnerability
Updated Versions:
kernel=/conary.rpath.com@rpl:devel//1/2.6.19.7-0.1-1
References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5753
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0006
https://issues.rpath.com/browse/RPL-1097
https://issues.rpath.com/browse/RPL-1106
Description:
Previous versions of the kernel package are vulnerable to multiple
local user attacks.
One vulnerability is a local user denial of service (system crash)
due to a bug in the key_alloc_serial() function.
The second vulnerability is a local user attack in which a call to
the listxattr() system call on a bad inode will at least corrupt
memory in the calling process, and may allow a malicious program
to read protected kernel memory (information exposure, possibly
enabling other vulnerabilities), system crash, or even executing
arbitrary code provided by the attacker. Bad inodes are not present
on most systems, so in practice the attack will require that the
user be able to mount a filesystem.
