CVE-2014-9585

The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD...

CVE-2014-9585

The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD...

OracleVM 3.3 : glibc (OVMSA-2014-0017)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, - Don't use alloca in addgetnetgrentX 1087789. - Adjust...

glibc security, bug fix, and enhancement update

2.12-1.149 - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, 2.12-1.148 - Switch gettimeofday from INTUSE to libchiddenproto 1099025. 2.12-1.147 - Fix stack overflow due to large AFINET6 requests...

SuSE 11.3 Security Update : glibc (SAT Patch Number 9262)

This update for the GNU Lib C fixes security issues, some bugs and introduces one new feature. The following security issues have been fixed : - Various potential stack overflows in getaddrinfo and others were fixed. bnc844309. CVE-2013-4357 - A stack frame overflow in getaddrinfo when called wit...

Oracle Linux 5 : kernel (ELSA-2008-0233)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0233 advisory. - Update: fs fix race condition in dnotify Alexander Viro 439758 CVE-2008-1375 - Update: xen ia64: ftp stress test fixes between HVM/Dom0 Tetsu Yamamot...

The story of the Linux kernel 3.x...

The story of the Linux kernel 3.x... In 2005 everybody was exited about possibility of bypass ASLR on all Linux 2.6 kernels because of the new concept called VDSO Virtual Dynamic Shared Object. More information about this story can be found at the following link:...

Analyzing ASLR in Android Ice Cream Sandwich 4.0

When I first saw the release notes for the new Android Ice Cream Sandwich ICS platform, I was excited to see that Google mentioned that “Android 4.0 now provides address space layout randomization”. For the uninitiated, ASLR randomizes where various areas of memory eg. stack, heap, libs, etc are...

kernel security and bug fix update

2.6.18-238.5.1.0.1.el5 - scsi fix scsi hotplug and rescan race orabug 10260172 - fix filpclose race Joe Jin orabug 10335998 - fix missing aiocomplete in endio Joel Becker orabug 10365195 - make xenkbd.abspointer=1 by default orabug 67188919 - xen check to see if hypervisor supports memory...

Design/Logic Flaw

The Linux kernel 2.6.9 through 2.6.17 on the x8664 and amd64 platforms allows local users to cause a denial of service panic via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object VDSO page and then triggers a segmentation fault...

CVE-2009-4271

CVE-2009-4271 affects Linux kernel 2.6.9–2.6.17 on x86_64/amd64. A local unprivileged user can trigger a NULL pointer dereference when a crafted 32-bit process calls mprotect on the Virtual Dynamic Shared Object (VDSO) page, potentially causing a kernel panic (DoS). The issue is tied to memory pr...

CVE-2009-4271

The Linux kernel 2.6.9 through 2.6.17 on the x8664 and amd64 platforms allows local users to cause a denial of service panic via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object VDSO page and then triggers a segmentation fault...

kernel: 32bit process on 64bit system can trigger a kernel panic

The Linux kernel 2.6.9 through 2.6.17 on the x8664 and amd64 platforms allows local users to cause a denial of service panic via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object VDSO page and then triggers a segmentation fault...

kernel security and bug fix update

2.6.9-89.0.23.0.1 - XEN fix cpu hotplug crash Joe Jin orabug 7521308 - XEN Bring up vcpus before khelper init Joe Jin orabug 7521308 - XEN flush the tlb cache immediately Dave McCracken, Scott Shi orabug 9138767 - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug...

Debian DSA-1687-1 : linux-2.6 - denial of service/privilege escalation

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-3527 Tavis Ormandy reported a local DoS and potential privilege escalation...

DSA-1687-1 fai-kernels linux-2.6 user-mode-linux - several vulnerabilities

Bulletin has no description...

Linux Kernel VDSO本地权限提升漏洞

BUGTRAQ ID: 32099 CVECAN ID: CVE-2008-3527 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的arch/i386/kernel/sysenter.c没有正确地实现虚拟动态共享对象（vDSO），本地攻击者可以通过调用installspecialmapping、syscall和syscall32nopage函数获得权限提升或导致拒绝服务。 Linux kernel 2.6.x Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

openSUSE 10 Security Update : kernel (kernel-5751)

This kernel update fixes various bugs and also several security issues : CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP AUTH availability. This might be exploited remotely for a denial of service crash attack. CVE-2008-3833: The genericfilesplicewrite function in...

Linux Kernel VDSO未明特权提升漏洞

BUGTRAQ ID: 32099 CVE ID：CVE-2008-3527 CNCVE ID：CNCVE-20083527 Linux是一款开放源代码的操作系统。 Linux虚拟动态共享对象vDSO实现存在边界检查错误，本地攻击者可以利用漏洞对系统进行拒绝服务攻击或提升特权。 目前没有详细漏洞细节提供。 RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux 5 server Linux kernel 2.6.19 1 Linux kernel 2.6.19 .2 Linux kernel 2.6.19 .1...

CVE-2008-3527

arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects vDSO implementation in the Linux kernel before 2.6.21 does not properly check boundaries, which allows local users to gain privileges or cause a denial of service via unspecified vectors, related to the installspecialmapping,...