Linux Kernel LDT Selector Local Privilege Escalation and Denial of Service Vulnerability
BID:31565
Info
Linux Kernel LDT Selector Local Privilege Escalation and Denial of Service Vulnerability
| Bugtraq ID: | 31565 |
| Class: | Design Error |
| CVE: |
CVE-2008-4410 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 03 2008 12:00AM |
| Updated: | Apr 13 2015 10:06PM |
| Credit: | Zachary Amsden |
| Vulnerable: |
S.u.S.E. openSUSE 11.0 Linux kernel 2.6.27 -rc8 Linux kernel 2.6.27 -rc6 Linux kernel 2.6.27 -rc5 Linux kernel 2.6.27 -rc2 Linux kernel 2.6.27 -rc1 Linux kernel 2.6.26 .4 Linux kernel 2.6.26 .3 Linux kernel 2.6.26 -rc6 Linux kernel 2.6.25 .9 Linux kernel 2.6.25 .8 Linux kernel 2.6.25 .7 Linux kernel 2.6.25 .6 Linux kernel 2.6.25 .5 Linux kernel 2.6.25 .15 Linux kernel 2.6.25 .13 Linux kernel 2.6.25 .12 Linux kernel 2.6.25 .11 Linux kernel 2.6.25 .10 Linux kernel 2.6.25 Linux kernel 2.6.24 .2 Linux kernel 2.6.24 .1 Linux kernel 2.6.24 -rc5 Linux kernel 2.6.24 -rc4 Linux kernel 2.6.24 -rc3 Linux kernel 2.6.23 .7 Linux kernel 2.6.23 .6 Linux kernel 2.6.23 .5 Linux kernel 2.6.23 .4 Linux kernel 2.6.23 .3 Linux kernel 2.6.23 .2 Linux kernel 2.6.23 -rc2 Linux kernel 2.6.23 -rc1 Linux kernel 2.6.23 Linux kernel 2.6.22 .8 Linux kernel 2.6.22 .7 Linux kernel 2.6.22 .6 Linux kernel 2.6.22 .5 Linux kernel 2.6.22 .4 Linux kernel 2.6.22 .3 Linux kernel 2.6.22 .2 Linux kernel 2.6.22 .17 Linux kernel 2.6.22 .16 Linux kernel 2.6.22 .15 Linux kernel 2.6.22 .14 Linux kernel 2.6.22 .13 Linux kernel 2.6.22 .12 Linux kernel 2.6.22 .11 Linux kernel 2.6.22 .1 Linux kernel 2.6.22 Linux kernel 2.6.21 4 Linux kernel 2.6.21 .7 Linux kernel 2.6.21 .6 Linux kernel 2.6.21 .3 Linux kernel 2.6.21 .2 Linux kernel 2.6.21 .1 Linux kernel 2.6.21 -git8 Linux kernel 2.6.21 Linux kernel 2.6.20 .9 Linux kernel 2.6.20 .8 Linux kernel 2.6.20 .5 Linux kernel 2.6.20 .4 Linux kernel 2.6.20 .15 Linux kernel 2.6.20 .1 Linux kernel 2.6.20 Linux kernel 2.6.19 .2 Linux kernel 2.6.19 .1 Linux kernel 2.6.19 -rc4 Linux kernel 2.6.19 -rc3 Linux kernel 2.6.19 -rc2 Linux kernel 2.6.19 -rc1 Linux kernel 2.6.19 Linux kernel 2.6.18 .4 Linux kernel 2.6.18 .3 Linux kernel 2.6.18 .1 Linux kernel 2.6.17 .9 Linux kernel 2.6.17 .8 Linux kernel 2.6.17 .7 Linux kernel 2.6.17 .6 Linux kernel 2.6.17 .5 Linux kernel 2.6.17 .4 Linux kernel 2.6.17 .3 Linux kernel 2.6.17 .2 Linux kernel 2.6.17 .14 Linux kernel 2.6.17 .13 Linux kernel 2.6.17 .12 Linux kernel 2.6.17 .11 Linux kernel 2.6.17 .10 Linux kernel 2.6.17 .1 Linux kernel 2.6.17 -rc5 Linux kernel 2.6.17 Linux kernel 2.6.16 27 Linux kernel 2.6.16 13 Linux kernel 2.6.16 .9 Linux kernel 2.6.16 .8 Linux kernel 2.6.16 .7 Linux kernel 2.6.16 .5 Linux kernel 2.6.16 .4 Linux kernel 2.6.16 .3 Linux kernel 2.6.16 .23 Linux kernel 2.6.16 .21 Linux kernel 2.6.16 .2 Linux kernel 2.6.16 .19 Linux kernel 2.6.16 .18 Linux kernel 2.6.16 .17 Linux kernel 2.6.16 .16 Linux kernel 2.6.16 .12 Linux kernel 2.6.16 .11 Linux kernel 2.6.16 .1 Linux kernel 2.6.16 -rc1 Linux kernel 2.6.16 Linux kernel 2.6.15 .6 Linux kernel 2.6.15 .4 Linux kernel 2.6.15 .3 Linux kernel 2.6.15 .2 Linux kernel 2.6.15 .1 Linux kernel 2.6.15 -rc6 Linux kernel 2.6.15 -rc5 Linux kernel 2.6.15 -rc4 Linux kernel 2.6.15 -rc3 Linux kernel 2.6.15 -rc2 Linux kernel 2.6.15 -rc1 Linux kernel 2.6.15 Linux kernel 2.6.14 .5 Linux kernel 2.6.14 .4 Linux kernel 2.6.14 .3 Linux kernel 2.6.14 .2 Linux kernel 2.6.14 .1 Linux kernel 2.6.14 -rc4 Linux kernel 2.6.14 -rc3 Linux kernel 2.6.14 -rc2 Linux kernel 2.6.14 -rc1 Linux kernel 2.6.14 Linux kernel 2.6.13 .4 Linux kernel 2.6.13 .3 Linux kernel 2.6.13 .2 Linux kernel 2.6.13 .1 Linux kernel 2.6.13 -rc7 Linux kernel 2.6.13 -rc6 Linux kernel 2.6.13 -rc4 Linux kernel 2.6.13 -rc1 Linux kernel 2.6.13 Linux kernel 2.6.12 .6 Linux kernel 2.6.12 .5 Linux kernel 2.6.12 .4 Linux kernel 2.6.12 .3 Linux kernel 2.6.12 .22 Linux kernel 2.6.12 .2 Linux kernel 2.6.12 .12 Linux kernel 2.6.12 .1 Linux kernel 2.6.12 -rc5 Linux kernel 2.6.12 -rc4 Linux kernel 2.6.12 -rc1 Linux kernel 2.6.12 Linux kernel 2.6.11 .8 Linux kernel 2.6.11 .7 Linux kernel 2.6.11 .6 Linux kernel 2.6.11 .5 Linux kernel 2.6.11 .4 Linux kernel 2.6.11 .12 Linux kernel 2.6.11 .11 Linux kernel 2.6.11 -rc4 Linux kernel 2.6.11 -rc3 Linux kernel 2.6.11 -rc2 Linux kernel 2.6.11 Linux kernel 2.6.10 rc2 Linux kernel 2.6.10 Linux kernel 2.6.9 Linux kernel 2.6.8 rc3 Linux kernel 2.6.8 rc2 Linux kernel 2.6.8 rc1 Linux kernel 2.6.8 Linux kernel 2.6.7 rc1 Linux kernel 2.6.7 Linux kernel 2.6.6 rc1 Linux kernel 2.6.6 Linux kernel 2.6.5 Linux kernel 2.6.4 Linux kernel 2.6.3 Linux kernel 2.6.2 Linux kernel 2.6.1 -rc2 Linux kernel 2.6.1 -rc1 Linux kernel 2.6.1 Linux kernel 2.6 .10 Linux kernel 2.6 -test9-CVS Linux kernel 2.6 -test9 Linux kernel 2.6 -test8 Linux kernel 2.6 -test7 Linux kernel 2.6 -test6 Linux kernel 2.6 -test5 Linux kernel 2.6 -test4 Linux kernel 2.6 -test3 Linux kernel 2.6 -test2 Linux kernel 2.6 -test11 Linux kernel 2.6 -test10 Linux kernel 2.6 -test1 Linux kernel 2.6 Linux kernel 2.6.8.1 Linux kernel 2.6.26.1 Linux kernel 2.6.26-rc5-git1 Linux kernel 2.6.25.4 Linux kernel 2.6.25.3 Linux kernel 2.6.25.2 Linux kernel 2.6.25.1 Linux kernel 2.6.24.6 Linux kernel 2.6.24-rc2 Linux kernel 2.6.24-rc1 Linux kernel 2.6.23.14 Linux kernel 2.6.23.10 Linux kernel 2.6.23.1 Linux kernel 2.6.23.09 Linux kernel 2.6.22-rc7 Linux kernel 2.6.22-rc1 Linux kernel 2.6.21-RC6 Linux kernel 2.6.21-RC5 Linux kernel 2.6.21-RC4 Linux kernel 2.6.21-RC3 Linux kernel 2.6.20.3 Linux kernel 2.6.20.2 Linux kernel 2.6.20.13 Linux kernel 2.6.20.11 Linux kernel 2.6.20-rc2 Linux kernel 2.6.20-2 Linux kernel 2.6.18-8.1.8.el5 Linux kernel 2.6.18-53 Linux kernel 2.6.18 Linux kernel 2.6.15.5 Linux kernel 2.6.15.11 Linux kernel 2.6.15-27.48 Linux kernel 2.6.11.4 |
| Not Vulnerable: |
Linux kernel 2.6.27 -rc8-git5 |
Discussion
Linux Kernel LDT Selector Local Privilege Escalation and Denial of Service Vulnerability
The Linux kernel is prone to a local vulnerability that may result in privilege escalation or a denial of service. This issue involves LDT (Local Descriptor Table) selectors in the VMI (Virtual Machine Interface).
Successfully exploiting this issue allows local attackers to trigger kernel crashes, denying service to legitimate users. Attackers can also use LDT selector functions to gain elevated privileges. This can result in the complete compromise of the VMI guest.
Versions prior to the Linux kernel 2.6.27-rc8-git5 running as a VMI guest are vulnerable.
The Linux kernel is prone to a local vulnerability that may result in privilege escalation or a denial of service. This issue involves LDT (Local Descriptor Table) selectors in the VMI (Virtual Machine Interface).
Successfully exploiting this issue allows local attackers to trigger kernel crashes, denying service to legitimate users. Attackers can also use LDT selector functions to gain elevated privileges. This can result in the complete compromise of the VMI guest.
Versions prior to the Linux kernel 2.6.27-rc8-git5 running as a VMI guest are vulnerable.
Exploit / POC
Linux Kernel LDT Selector Local Privilege Escalation and Denial of Service Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Linux Kernel LDT Selector Local Privilege Escalation and Denial of Service Vulnerability
Solution:
The vendor has committed fixes to the Git repository. Please see the references for more information.
S.u.S.E. openSUSE 11.0
Solution:
The vendor has committed fixes to the Git repository. Please see the references for more information.
S.u.S.E. openSUSE 11.0
-
S.u.S.E. kernel-debug-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- debug-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-debug-2.6.25.18-0.2.x86_64.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/x86_64/kerne l-debug-2.6.25.18-0.2.x86_64.rpm -
S.u.S.E. kernel-default-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- default-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-default-2.6.25.18-0.2.ppc.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/ppc/kernel-d efault-2.6.25.18-0.2.ppc.rpm -
S.u.S.E. kernel-default-2.6.25.18-0.2.x86_64.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/x86_64/kerne l-default-2.6.25.18-0.2.x86_64.rpm -
S.u.S.E. kernel-docs-2.6.25.18-0.2.noarch.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/noarch/kerne l-docs-2.6.25.18-0.2.noarch.rpm -
S.u.S.E. kernel-kdump-2.6.25.18-0.2.ppc.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/ppc/kernel-k dump-2.6.25.18-0.2.ppc.rpm -
S.u.S.E. kernel-pae-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- pae-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-ppc64-2.6.25.18-0.2.ppc.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/ppc/kernel-p pc64-2.6.25.18-0.2.ppc.rpm -
S.u.S.E. kernel-ps3-2.6.25.18-0.2.ppc.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/ppc/kernel-p s3-2.6.25.18-0.2.ppc.rpm -
S.u.S.E. kernel-rt-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- rt-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-rt-2.6.25.18-0.2.x86_64.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/x86_64/kerne l-rt-2.6.25.18-0.2.x86_64.rpm -
S.u.S.E. kernel-rt_debug-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- rt_debug-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-rt_debug-2.6.25.18-0.2.x86_64.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/x86_64/kerne l-rt_debug-2.6.25.18-0.2.x86_64.rpm -
S.u.S.E. kernel-source-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- source-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-source-2.6.25.18-0.2.ppc.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/ppc/kernel-s ource-2.6.25.18-0.2.ppc.rpm -
S.u.S.E. kernel-source-2.6.25.18-0.2.x86_64.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/x86_64/kerne l-source-2.6.25.18-0.2.x86_64.rpm -
S.u.S.E. kernel-syms-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- syms-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-syms-2.6.25.18-0.2.ppc.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/ppc/kernel-s yms-2.6.25.18-0.2.ppc.rpm -
S.u.S.E. kernel-syms-2.6.25.18-0.2.x86_64.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/x86_64/kerne l-syms-2.6.25.18-0.2.x86_64.rpm -
S.u.S.E. kernel-vanilla-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- vanilla-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-vanilla-2.6.25.18-0.2.ppc.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/ppc/kernel-v anilla-2.6.25.18-0.2.ppc.rpm -
S.u.S.E. kernel-vanilla-2.6.25.18-0.2.x86_64.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/x86_64/kerne l-vanilla-2.6.25.18-0.2.x86_64.rpm -
S.u.S.E. kernel-xen-2.6.25.18-0.2.i586.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/kernel- xen-2.6.25.18-0.2.i586.rpm -
S.u.S.E. kernel-xen-2.6.25.18-0.2.x86_64.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/x86_64/kerne l-xen-2.6.25.18-0.2.x86_64.rpm
References
Linux Kernel LDT Selector Local Privilege Escalation and Denial of Service Vulnerability
References:
References:
- CVE request: kernel: x86: Fix broken LDT access in VMI (Eugene Teo)
- Linux Homepage (Linux)
- x86: Fix broken LDT access in VMI (Zachary Amsden)