Linux Kernel SEARCH_BINARY_HANDLER Local Denial of Service Vulnerability

Bugtraq ID:	16320
Class:	Design Error
CVE:	CVE-2005-2708
Remote:	No
Local:	Yes
Published:	Jun 28 2005 12:00AM
Updated:	Nov 13 2006 08:16PM
Credit:	Reported by blossom.
Vulnerable:	Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 Linux kernel 2.4.32 -pre2 Linux kernel 2.4.32 -pre1 Linux kernel 2.4.32 Linux kernel 2.4.31 -pre1 Linux kernel 2.4.31 Linux kernel 2.4.30 rc3 Linux kernel 2.4.30 rc2 Linux kernel 2.4.30 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 Linux kernel 2.4.29 -rc2 Linux kernel 2.4.29 -rc1 Linux kernel 2.4.29 Linux kernel 2.4.28 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Linux kernel 2.4.27 -pre5 Linux kernel 2.4.27 -pre4 Linux kernel 2.4.27 -pre3 Linux kernel 2.4.27 -pre2 Linux kernel 2.4.27 -pre1 Linux kernel 2.4.27 Linux kernel 2.4.26 Linux kernel 2.4.25 Linux kernel 2.4.24 -ow1 Linux kernel 2.4.24 Linux kernel 2.4.23 -pre9 Linux kernel 2.4.23 -ow2 Linux kernel 2.4.23 + Trustix Secure Linux 2.0 Linux kernel 2.4.22 + Devil-Linux Devil-Linux 1.0.5 + Devil-Linux Devil-Linux 1.0.4 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Redhat Fedora Core1 + Slackware Linux 9.1 Linux kernel 2.4.21 pre7 Linux kernel 2.4.21 pre4 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 Linux kernel 2.4.21 pre1 Linux kernel 2.4.21 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + SuSE SUSE Linux Enterprise Server 8 Linux kernel 2.4.20 + CRUX CRUX Linux 1.0 + Gentoo Linux 1.4 + Gentoo Linux 1.2 + Redhat Linux 9.0 i386 + Slackware Linux 9.0 + WOLK WOLK 4.4 s Linux kernel 2.4.19 -pre6 Linux kernel 2.4.19 -pre5 Linux kernel 2.4.19 -pre4 Linux kernel 2.4.19 -pre3 Linux kernel 2.4.19 -pre2 Linux kernel 2.4.19 -pre1 Linux kernel 2.4.19 + Conectiva Linux Enterprise Edition 1.0 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Multi Network Firewall 2.0 + Mandriva Linux Mandrake 9.0 + Slackware Linux -current + SuSE Linux 8.1 + SuSE SUSE Linux Enterprise Server 8 + SuSE SUSE Linux Enterprise Server 7 Linux kernel 2.4.18 pre-8 Linux kernel 2.4.18 pre-7 Linux kernel 2.4.18 pre-6 Linux kernel 2.4.18 pre-5 Linux kernel 2.4.18 pre-4 Linux kernel 2.4.18 pre-3 Linux kernel 2.4.18 pre-2 Linux kernel 2.4.18 pre-1 Linux kernel 2.4.18 x86 + Debian Linux 3.0 ia-32 Linux kernel 2.4.18 + Astaro Security Linux 2.0 23 + Astaro Security Linux 2.0 16 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 + Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Linux 8.0 + Redhat Linux 7.3 + S.u.S.E. Linux Connectivity Server + S.u.S.E. Linux Database Server 0 + S.u.S.E. Linux Firewall on CD + S.u.S.E. Linux Office Server + S.u.S.E. Linux Personal 8.2 + S.u.S.E. SuSE eMail Server 3.1 + S.u.S.E. SuSE eMail Server III + SuSE Linux 8.1 + SuSE Linux 8.0 + SuSE Linux 7.3 + SuSE Linux 7.2 + SuSE Linux 7.1 + SuSE Linux Openexchange Server + SuSE SUSE Linux Enterprise Server 8 + SuSE SUSE Linux Enterprise Server 7 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 Linux kernel 2.4.17 Linux kernel 2.4.16 + Sun Cobalt RaQ 550 Linux kernel 2.4.15 Linux kernel 2.4.14 Linux kernel 2.4.13 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Workstation 3.1.1 Linux kernel 2.4.12 Linux kernel 2.4.11 Linux kernel 2.4.10 + SuSE Linux 7.3 Linux kernel 2.4.9 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Sun Linux 5.0.5 + Sun Linux 5.0.3 + Sun Linux 5.0 Linux kernel 2.4.8 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 Linux kernel 2.4.7 + Redhat Linux 7.2 + SuSE Linux 7.2 + SuSE Linux 7.1 Linux kernel 2.4.6 Linux kernel 2.4.5 + Slackware Linux 8.0 Linux kernel 2.4.4 + SuSE Linux 7.2 Linux kernel 2.4.3 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 Linux kernel 2.4.2 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha Linux kernel 2.4.1 Linux kernel 2.4 .0-test9 Linux kernel 2.4 .0-test8 Linux kernel 2.4 .0-test7 Linux kernel 2.4 .0-test6 Linux kernel 2.4 .0-test5 Linux kernel 2.4 .0-test4 Linux kernel 2.4 .0-test3 Linux kernel 2.4 .0-test2 Linux kernel 2.4 .0-test12 Linux kernel 2.4 .0-test11 Linux kernel 2.4 .0-test10 Linux kernel 2.4 .0-test1 Linux kernel 2.4
Not Vulnerable:	Linux kernel 2.4.33 -pre1

Linux Kernel SEARCH_BINARY_HANDLER Local Denial of Service Vulnerability

Linux kernel is susceptible to a local denial-of-service vulnerability.

This issue presents itself in the 'search_binary_handler' function of 'exec.c'.

This issue allows local users to crash the kernel due to a panic, denying service to legitimate users.

Linux kernel 2.4 versions on 64-bit x86 architectures prior to 2.4.33-pre1 are affected.

Linux Kernel SEARCH_BINARY_HANDLER Local Denial of Service Vulnerability

A proof of concept is available at the following location:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=161925

Linux Kernel SEARCH_BINARY_HANDLER Local Denial of Service Vulnerability

Solution:

The vendor has released kernel version 2.4.33-pre1 to address this issue.

Please see the referenced advisories for more information:

- Red Hat has released advisory RHSA-2006:0140-9 to address various issues in Red Hat Enterprise Linux 3.
- Red Hat has released advisory RHSA-2006:0190-5 to address this and other issues.


Linux kernel 2.4.27

• Trustix kernel-2.4.33.3-1tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates


• Trustix kernel-BOOT-2.4.33.3-1tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates


• Trustix kernel-doc-2.4.33.3-1tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates


• Trustix kernel-smp-2.4.33.3-1tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates


• Trustix kernel-source-2.4.33.3-1tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates


• Trustix kernel-utils-2.4.33.3-1tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates

Linux Kernel SEARCH_BINARY_HANDLER Local Denial of Service Vulnerability

References:

• Bugzilla Bug 161925 ? CVE-2005-2708 user code panics kernel in exec.c (blossom)
  
• kernel.org Homepage. (Linux Kernel)
  
• RHSA-2006:0140-9 - kernel security update (RedHat)
  
• RHSA-2006:0190-5 - kernel security update (RedHat)
  
• Summary of changes from v2.4.32 to v2.4.33-pre1 (kernel.org)