Package name
kernel
Date
2006-02-21
Advisory ID
MDKSA-2006:044
Affected versions
CS3.0 i586 , CS2.1 i586 , CS3.0 x86_64 , CS2.1 x86_64

Problem description

A number of vulnerabilities have been discovered and corrected in the
Linux 2.4 kernel:

A numeric casting discrepancy in sdla_xfer could allow a local user to
read portions of kernel memory via a large len argument
(CVE-2004-2607).

The traps.c file executes stack segment faults on an exception stack,
which could allow a local user to cause an oops and stack fault
exception (CVE-2005-1767).

The find_target function in ptrace32.c does not properly handle a NULL
return value from another function, allowing local users to cause a
kernel crash/oops by running a 32-bit ltrace program with the -i option
on a 64-bit executable program (CVE-2005-2553).

A race condition in ip_vs_conn_flush, when running on SMP systems,
could allow a local attacker to cause null dereference DoS by causing
a connection timer to expire while the connection table is being
flushed before the appropriate lock is acquired (CVE-2005-3274).

The NAT code in ip_nat_proto_tcp.c and ip_nat_proto_udp.c incorrectly
declares a variable to be static, which could allow a remote attacker
to cause a Denial of Service via memory corruption by causing two
packets for the same protocol to be NATed at the same time
(CVE-2005-3275).

The IPv6 flowlabel handling code modified the wrong variable in certain
circumstances, which could allow a local user to corrupt kernel memory
or cause a Denial of Service (crash) by triggering a free of non-
allocated memory (CVE-2005-3806).

The wan/sdla.c file does not require CAP_SYS_RAWIO privilege for an
SDLA firmware upgrade with unknown impact and local attack vectors
(CVE-2006-0096).

The provided packages are patched to fix these vulnerabilities. All
users are encouraged to upgrade to these updated kernels.

To update your kernel, please follow the directions located at:

http://www.mandriva.com/en/security/kernelupdate

Updated packages

CS3.0 i586

 f8c290a53ea21a955fe6114b373ad955  corporate/3.0/RPMS/kernel-2.4.25.15mdk-1-1mdk.i586.rpm
 f67d0b16fab2a9b65a3c3fbc1610eec2  corporate/3.0/RPMS/kernel-enterprise-2.4.25.15mdk-1-1mdk.i586.rpm
 1ea0d6ecaa351549815392561ae965d2  corporate/3.0/RPMS/kernel-i686-up-4GB-2.4.25.15mdk-1-1mdk.i586.rpm
 8231bed47849ee958629d83568da47b7  corporate/3.0/RPMS/kernel-p3-smp-64GB-2.4.25.15mdk-1-1mdk.i586.rpm
 6a614b0ce30bf0b4f4b50e21792e8bdb  corporate/3.0/RPMS/kernel-smp-2.4.25.15mdk-1-1mdk.i586.rpm
 0ad53697afef69ca13a0fc792c6efd9b  corporate/3.0/RPMS/kernel-source-2.4.25-15mdk.i586.rpm
 fd3c84e8920a33682fa3715d7668addc  corporate/3.0/SRPMS/kernel-2.4.25.15mdk-1-1mdk.src.rpm

CS2.1 i586

 e883a30fa55371ccd1b00ca4b01fd51c  corporate/2.1/RPMS/kernel-2.4.19.50mdk-1-1mdk.i586.rpm
 0a2ea93df25c7a28a1e6abcabcff0eb7  corporate/2.1/RPMS/kernel-enterprise-2.4.19.50mdk-1-1mdk.i586.rpm
 b613dc1a696d76ff9ca6eadcea460f7e  corporate/2.1/RPMS/kernel-secure-2.4.19.50mdk-1-1mdk.i586.rpm
 66d27b21ab86b9bafb470a8f2e17132d  corporate/2.1/RPMS/kernel-smp-2.4.19.50mdk-1-1mdk.i586.rpm
 9c5a579d32d04a613ddac058e84c36e4  corporate/2.1/RPMS/kernel-source-2.4.19-50mdk.i586.rpm
 a28aa7696e74ba20b03d8e9c10eb7056  corporate/2.1/SRPMS/kernel-2.4.19.50mdk-1-1mdk.src.rpm

CS3.0 x86_64

 88f9773354bd930b5c031104cf456347  x86_64/corporate/3.0/RPMS/kernel-2.4.25.15mdk-1-1mdk.x86_64.rpm
 bc0227f1bd2cc07e87dd4163cbffae98  x86_64/corporate/3.0/RPMS/kernel-smp-2.4.25.15mdk-1-1mdk.x86_64.rpm
 50b06a0b86937e86c62cc010c353df5d  x86_64/corporate/3.0/RPMS/kernel-source-2.4.25-15mdk.x86_64.rpm
 fd3c84e8920a33682fa3715d7668addc  x86_64/corporate/3.0/SRPMS/kernel-2.4.25.15mdk-1-1mdk.src.rpm

CS2.1 x86_64

 f8fbbd7249b9b1ee1baf7a40d80a844c  x86_64/corporate/2.1/RPMS/kernel-2.4.19.50mdk-1-1mdk.x86_64.rpm
 41be7205227a55588da8439a44e638d1  x86_64/corporate/2.1/RPMS/kernel-secure-2.4.19.50mdk-1-1mdk.x86_64.rpm
 fe437c6ffcb28d9af41ceeba61ce690f  x86_64/corporate/2.1/RPMS/kernel-smp-2.4.19.50mdk-1-1mdk.x86_64.rpm
 0c8e74d0e3013cb0e72b41341defb869  x86_64/corporate/2.1/RPMS/kernel-source-2.4.19-50mdk.x86_64.rpm
 a28aa7696e74ba20b03d8e9c10eb7056  x86_64/corporate/2.1/SRPMS/kernel-2.4.19.50mdk-1-1mdk.src.rpm

References