Vulnerability in fai-kernels linux-2.6 user-mode-linux
Summary
DSA-1428-1: fai-kernels linux-2.6 user-mode-linux - several vulnerabilities. Affects linux-2.6 versions < 2.6.18.dfsg.1-13etch5. Fixed in 2.6.18.dfsg.1-13etch5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fai-kernels package is a component of the Debian 4.0 (etch) ecosystem. It provides kernel packages for the Linux 2.6 kernel. The linux-2.6 package is the source package for the Linux kernel in Debian 4.0. The user-mode-linux package is a virtual machine that runs Linux as a user process. These packages are widely used in Debian-based systems and provide essential functionality for running Linux kernels and virtual machines.
Vulnerability Detail
Several vulnerabilities have been discovered in the Linux kernel used by fai-kernels, linux-2.6, and user-mode-linux packages. These vulnerabilities can lead to denial of service or the execution of arbitrary code. The specific vulnerabilities identified are as follows:
- CVE-2007-3104: A local denial of service vulnerability in sysfs can be exploited under memory pressure, causing an oops during a readdir operation.
- CVE-2007-4997: Certain drivers using the Linux kernel's ieee80211 layer are vulnerable to a remote denial of service attack through a malicious 802.11 frame.
- CVE-2007-5500: A coding error in the implementation of ptrace can be abused by a local user to cause an infinite loop in the kernel.
- CVE-2007-5904: The CIFS filesystem is susceptible to a denial of service attack caused by a buffer overflow when interacting with a malicious server.
These vulnerabilities have been fixed in the stable distribution by upgrading to version 2.6.18.dfsg.1-13etch5 of the linux-2.6 package.
How To Fix
Minimum fixed version
2.6.18.dfsg.1-13etch5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the kernel package to version 2.6.18.dfsg.1-13etch5 is crucial to mitigate the identified vulnerabilities. It is recommended to apply the fix as soon as possible and reboot the affected machines. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux-2.6 →
FAQ
These vulnerabilities can lead to denial of service attacks or the execution of arbitrary code, potentially compromising the security and stability of the affected systems.
No, only versions prior to 2.6.18.dfsg.1-13etch5 are affected. Upgrading to this version will address the vulnerabilities.
No specific workaround has been provided. It is recommended to apply the available fix by upgrading the kernel package.
Yes, CVE-2007-4997 allows for remote exploitation through a malicious 802.11 frame. The other vulnerabilities require local access to the system.
There are no known public exploits for these vulnerabilities at the time of this advisory.
Related vulnerabilities
Recent vulnerabilities recorded for linux-2.6.
