Linux Kernel L2CAP and HCI Setsockopt Memory Leak Information Disclosure Vulnerability

Bugtraq ID:	23594
Class:	Design Error
CVE:	CVE-2007-1353
Remote:	No
Local:	Yes
Published:	Apr 23 2007 12:00AM
Updated:	Mar 06 2008 05:51PM
Credit:	Ilja van Sprundel is credited with discovering the issue.
Vulnerable:	Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise SDK 9 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Enterprise Linux 5 Server Redhat Desktop 4.0 Redhat Desktop 3.0 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Redhat Advanced Workstation for the Itanium Processor 2.1 Linux kernel 2.4.34 Linux kernel 2.4.34 Linux kernel 2.4.34 Linux kernel 2.4.33 2 Linux kernel 2.4.33 .7 Linux kernel 2.4.33 .6 Linux kernel 2.4.33 .6 Linux kernel 2.4.33 .5 Linux kernel 2.4.33 .4 Linux kernel 2.4.33 .3 Linux kernel 2.4.33 .3 Linux kernel 2.4.33 .1 Linux kernel 2.4.33 -pre1 Linux kernel 2.4.33 Linux kernel 2.4.32 -pre2 Linux kernel 2.4.32 -pre1 Linux kernel 2.4.32 Linux kernel 2.4.31 -pre1 Linux kernel 2.4.31 Linux kernel 2.4.30 rc3 Linux kernel 2.4.30 rc2 Linux kernel 2.4.30 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 Linux kernel 2.4.29 -rc2 Linux kernel 2.4.29 -rc1 Linux kernel 2.4.29 Linux kernel 2.4.28 Linux kernel 2.4.27 -pre5 Linux kernel 2.4.27 -pre4 Linux kernel 2.4.27 -pre3 Linux kernel 2.4.27 -pre2 Linux kernel 2.4.27 -pre1 Linux kernel 2.4.27 Linux kernel 2.4.26 Linux kernel 2.4.25 Linux kernel 2.4.24 -ow1 Linux kernel 2.4.24 Linux kernel 2.4.23 -pre9 Linux kernel 2.4.23 -ow2 Linux kernel 2.4.23 Linux kernel 2.4.22 + Devil-Linux Devil-Linux 1.0.5 + Devil-Linux Devil-Linux 1.0.4 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Redhat Fedora Core1 + Slackware Linux 9.1 Linux kernel 2.4.21 pre7 Linux kernel 2.4.21 pre4 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 Linux kernel 2.4.21 pre1 Linux kernel 2.4.21 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + SuSE SUSE Linux Enterprise Server 8 Linux kernel 2.4.20 + CRUX CRUX Linux 1.0 + Gentoo Linux 1.4 + Gentoo Linux 1.2 + Redhat Linux 9.0 i386 + Slackware Linux 9.0 + WOLK WOLK 4.4 s Linux kernel 2.4.19 -pre6 Linux kernel 2.4.19 -pre5 Linux kernel 2.4.19 -pre4 Linux kernel 2.4.19 -pre3 Linux kernel 2.4.19 -pre2 Linux kernel 2.4.19 -pre1 Linux kernel 2.4.19 Linux kernel 2.4.18 pre-8 Linux kernel 2.4.18 pre-7 Linux kernel 2.4.18 pre-6 Linux kernel 2.4.18 pre-5 Linux kernel 2.4.18 pre-4 Linux kernel 2.4.18 pre-3 Linux kernel 2.4.18 pre-2 Linux kernel 2.4.18 pre-1 Linux kernel 2.4.18 x86 Linux kernel 2.4.18 Linux kernel 2.4.17 Linux kernel 2.4.16 Linux kernel 2.4.15 Linux kernel 2.4.14 Linux kernel 2.4.13 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Workstation 3.1.1 Linux kernel 2.4.12 Linux kernel 2.4.11 Linux kernel 2.4.10 + SuSE Linux 7.3 Linux kernel 2.4.9 Linux kernel 2.4.8 Linux kernel 2.4.7 + Redhat Linux 7.2 + SuSE Linux 7.2 + SuSE Linux 7.1 Linux kernel 2.4.6 Linux kernel 2.4.5 + Slackware Linux 8.0 Linux kernel 2.4.4 Linux kernel 2.4.3 Linux kernel 2.4.2 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha Linux kernel 2.4.1 Linux kernel 2.4 .0-test9 Linux kernel 2.4 .0-test8 Linux kernel 2.4 .0-test7 Linux kernel 2.4 .0-test6 Linux kernel 2.4 .0-test5 Linux kernel 2.4 .0-test4 Linux kernel 2.4 .0-test3 Linux kernel 2.4 .0-test2 Linux kernel 2.4 .0-test12 Linux kernel 2.4 .0-test11 Linux kernel 2.4 .0-test10 Linux kernel 2.4 .0-test1 Linux kernel 2.4 Linux kernel 2.4.33.5 Linux kernel 2.4.33.4 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Avaya SES 3.1 Avaya SES 3.0 Avaya SES 2.0 Avaya Modular Messaging (MAS) 3.0 Avaya Message Networking Avaya EMMC 1.017 Avaya Communication Manager 4.0 Avaya Communication Manager 3.1 Avaya Communication Manager 3.0 Avaya CCS 3.1.1 Avaya CCS 3.1 Avaya CCS 3.0 Avaya CCS 2.0 Avaya AES 4.0
Not Vulnerable:	Linux kernel 2.4.34.5

Linux Kernel L2CAP and HCI Setsockopt Memory Leak Information Disclosure Vulnerability

Linux Kernel is prone to an information-disclosure vulnerability because it fails to handle unexpected user-supplied input.

Successful exploits will allow attackers to view portions of kernel memory. Information harvested may be used in further attacks.

Kernel versions 2.4.34.2 and prior are vulnerable to this issue.

Linux Kernel L2CAP and HCI Setsockopt Memory Leak Information Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Linux Kernel L2CAP and HCI Setsockopt Memory Leak Information Disclosure Vulnerability

Solution:
The vendor released 2.4.34.3 to address this issue, but that version is apparently still vulnerable. The vendor has now released 2.4.34.5 to fix the problem.

Please see the references for more information.

Linux Kernel L2CAP and HCI Setsockopt Memory Leak Information Disclosure Vulnerability

References:

• RHSA-2007:0673-2 - Important: kernel security update (RedHat)
  
• Summary of changes from v2.4.34.4 to v2.4.34.5 (Linux)
  
• [DSA 1503-2] New Linux kernel 2.4.27 packages fix several issues (Debian)
  
• ASA-2007-287: kernel security update (RHSA-2007-0488) (Avaya Inc.)
  
• ASA-2007-404 - kernel security update (RHSA-2007-0672) (Avaya)
  
• RHSA-2007:0376-2 kernel security and bug fix update (Red Hat)
  
• RHSA-2007:0488-2 - kernel security update (Red Hat)
  
• RHSA-2007:0671-2: kernel security and bugfix update (Red Hat)
  
• RHSA-2007:0672-2 kernel security update (Red Hat)