DSA-1304: Vulnerabilities in kernel-source-2.6.8
Summary
DSA-1304: kernel-source-2.6.8 - several. Affects kernel-source-2.6.8 versions < 2.6.8-16sarge7. Fixed in 2.6.8-16sarge7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-source-2.6.8 package is a part of the Debian 3.1 (sarge) ecosystem. It provides the source code for the Linux kernel version 2.6.8. The Linux kernel is the core component of the operating system, responsible for managing system resources and providing essential functionality. However, several vulnerabilities have been discovered in this version of the kernel, which may lead to denial of service or the execution of arbitrary code.
Vulnerability Detail
The vulnerabilities in kernel-source-2.6.8 include:
- CVE-2005-4811: A local denial of service (system crash) issue in the hugepage code.
- CVE-2006-4814: A potential local denial of service (deadlock) in the mincore function due to improper lock handling.
- CVE-2006-4623: A remote denial of service (crash) in the dvb driver triggered by a ULE package with an SNDU length of 0.
- CVE-2006-5753: A local memory corruption vulnerability resulting from misinterpretation of return values when operating on marked bad inodes.
- CVE-2006-5754: A local denial of service (crash) vulnerability due to incorrect initialization of nr_pages in aio_setup_ring().
- CVE-2006-5757: A potential local denial of service exploitable by a malicious user with privileges to mount and read a corrupted iso9660 filesystem.
- CVE-2006-6053: A potential local denial of service exploitable by a malicious user with privileges to mount and read a corrupted ext3 filesystem.
- CVE-2006-6056: A potential local denial of service exploitable by a malicious user with privileges to mount and read a corrupted hfs filesystem on systems with SELinux hooks enabled.
- CVE-2006-6060: A potential local denial of service (infinite loop) exploitable by a malicious user with privileges to mount and read a corrupted NTFS filesystem.
- CVE-2006-6106: Multiple buffer overflows in the Bluetooth subsystem, allowing remote denial of service (crash) and potential execution of arbitrary code.
- CVE-2006-6535: An invalid error path in dev_queue_xmit() that can be exploited by a local user to cause data corruption.
- CVE-2007-0958: A vulnerability allowing local users to read otherwise unreadable files by triggering a core dump while using PT_INTERP.
- CVE-2007-1357: A vulnerability in the appletalk subsystem that can be triggered to crash systems with the appletalk module loaded via a malformed frame.
- CVE-2007-1592: Sharing of flow labels between listening sockets and child sockets, leading to a denial of service (Oops) when exploited by local users.
These vulnerabilities pose a risk of system crashes, data corruption, and potential execution of arbitrary code.
How To Fix
Minimum fixed version
2.6.8-16sarge7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kernel-source-2.6.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workarounds have been mentioned for these vulnerabilities.
Conclusion
The kernel-source-2.6.8 package in the Debian 3.1 (sarge) ecosystem is affected by multiple vulnerabilities that can result in system crashes, data corruption, and potential execution of arbitrary code. It is crucial to upgrade the kernel package immediately and reboot the machine to mitigate these risks. For further assistance, please reach out to DevNack.com.
See every vulnerability recorded for kernel-source-2.6.8 →
FAQ
These vulnerabilities can lead to system crashes, data corruption, and potential execution of arbitrary code.
Some vulnerabilities can be exploited by local users with specific privileges, while others can be exploited remotely.
There is no information provided about known instances of exploitation.
No, upgrading the kernel package is necessary to fix these vulnerabilities.
For further support on vulnerability remediation, please contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-source-2.6.8.
