AusCERT - AA-2007.0099 -- [Linux] -- Linux kernel vulnerable to multiple denial of service

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
AA-2007.0099 -- [Linux] -- Linux kernel vulnerable to multiple denial of service
Date: 10 September 2008
References: ESB-2008.0922 ESB-2008.1060

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2007.0099                  AUSCERT Advisory

                                  [Linux]
           Linux kernel vulnerable to multiple denial of service
                             10 September 2008
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Linux kernel 2.6
Operating System:     Linux variants
Impact:               Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-4997 CVE-2007-6716
Member content until: Friday, December 07 2007

Revision History:  September 10 2008: Updated with additional CVE
                    November  9 2007: Initial Release

OVERVIEW:

	A number of vulnerabilities have been identified in the Linux
        kernel, which could cause a Denial of Service.        


IMPACT:

        The National Vulnerability Database [1], gives the following
        information regarding these vulnerabilities:
 
         o CVE-2007-4997: 'Integer underflow in the ieee80211_rx function 
           in net/ieee80211/ieee80211_rx.c in the Linux kernel 2.6.x 
           before 2.6.23 allows remote attackers to cause a denial of 
           service (crash) via a crafted SKB length value in a runt 
           IEEE 802.11 frame when the IEEE80211_STYPE_QOS_DATA flag is 
           set, aka an "off-by-two error."' [2].

         o CVE-2007-6716: 'fs/direct-io.c in the dio subsystem in the Linux 
           kernel before 2.6.23 does not properly zero out the dio struct, 
           which allows local users to cause a denial of service (OOPS), as 
           demonstrated by a certain fio test.' [3]
        


MITIGATION:

        The vulnerability detailed in CVE-2007-4997 has been fixed in version
        2.6.23 [4].

        Most Linux distributions have not yet released updated kernel packages
        fixing this vulnerability. System administrators are advised to check
        with their vendor for the availability of packages. Updated kernel
        source code is available from kernel.org.


REFERENCES:

        [1] National Vulnerability Database
            http://nvd.nist.gov/

        [2] Vulnerability Summary CVE-2007-4997
            http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4997

        [3] Vulnerability Summary CVE-2007-6716
            http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6716
 
        [4] kernel v2.6 ChangeLog-2.6.23
            http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSMdq5ih9+71yA2DNAQLAVAP9ESSd29TRT/X/gJY5feAxHDgWuqpTUiX6
qrL3XotpZDlmQaSmceUrd1LWsMwSfqjA16I3sNHDHyGFgxhTuDd1kAs5DrhpvbcD
kPk7W/4Bg03CrGhMHhTxIa04hZ0hB5Zm7jqt2LcULXOFfasYuqzVgXmOjMqc0WSd
QRR5yKozeO0=
=zXMe
-----END PGP SIGNATURE-----