Title: Linux Kernel ELF Core Dump Local Buffer Overflow Vulnerability

Severity: HIGH

Description:

The Linux kernel supports the creation of coredumps for processes to help debug faulty applications. Coredumps are images of the memory space of aborted processes.

The Linux kernel is susceptible to a local buffer-overflow vulnerability when attempting to create ELF coredumps. This issue is due to an integer-overflow flaw that results in a kernel buffer overflow during a 'copy_from_user()' call.

Specifically, in 'elf_core_dump()', the length of the command-line arguments passed to the process that is generating the coredump is stored in a signed 32-bit integer variable, 'len'. This value is then compared with ELF_PRARGSZ to see if it's too large before using it as a length argument in a 'copy_to_user()' function call. This call takes an unsigned value, which means that if the 'len' variable is negative in 'elf_core_dump()', then 'copy_to_user()' will interpret the 'len' variable as a very large integer value, resulting in the overflowing of the destination kernel buffer.

To exploit this vulnerability, a malicious user creates a malicious ELF executable designed to create a negative 'len' variable in 'elf_core_dump()'.

This vulnerability may be exploited by local users to execute arbitrary machine code in the context of the kernel, facilitating privilege escalation.

**Update: This vulnerability does not exist in the 2.6 kernel tree.

Affected Products:

Astaro Security Linux 2.0.0 16
Astaro Security Linux 2.0.0 23
Avaya CVLAN
Avaya Converged Communications Server 2.0.0
Avaya Integrated Management
Avaya Intuity LX
Avaya MN100
Avaya Modular Messaging (MSS) 1.1.0
Avaya Modular Messaging (MSS) 2.0.0
Avaya S8300 R2.0.0
Avaya S8300 R2.0.1
Avaya S8500 R2.0.0
Avaya S8500 R2.0.1
Avaya S8700 R2.0.0
Avaya S8700 R2.0.1
Avaya S8710 R2.0.0
Avaya S8710 R2.0.1
CRUX CRUX Linux 1.0.0
Caldera OpenLinux 2.3.0
Caldera OpenLinux 2.4.0
Caldera OpenLinux Server 3.1.0
Caldera OpenLinux Server 3.1.1
Caldera OpenLinux Workstation 3.1.0
Caldera OpenLinux Workstation 3.1.1
Conectiva Linux 10.0.0
Conectiva Linux 4.0.0
Conectiva Linux 4.0.0 es
Conectiva Linux 4.1.0
Conectiva Linux 4.2.0
Conectiva Linux 5.0.0
Conectiva Linux 5.1.0
Conectiva Linux 6.0.0
Conectiva Linux 7.0.0
Conectiva Linux 8.0.0
Conectiva Linux 9.0.0
Conectiva Linux Enterprise Edition 1.0.0
Conectiva Linux ecommerce
Conectiva Linux graficas
Debian Linux 2.2.0
Debian Linux 2.2.0 68k
Debian Linux 2.2.0 alpha
Debian Linux 2.2.0 arm
Debian Linux 2.2.0 powerpc
Debian Linux 2.2.0 sparc
Debian Linux 3.0.0 alpha
Debian Linux 3.0.0 arm
Debian Linux 3.0.0 hppa
Debian Linux 3.0.0 ia-32
Debian Linux 3.0.0 ia-64
Debian Linux 3.0.0 m68k
Debian Linux 3.0.0 mips
Debian Linux 3.0.0 mipsel
Debian Linux 3.0.0 ppc
Debian Linux 3.0.0 s/390
Debian Linux 3.0.0 sparc
Devil-Linux Devil-Linux 1.0.4
Devil-Linux Devil-Linux 1.0.5
Easy Software Products CUPS 1.1.20
EnGarde Secure Linux 1.0.1
Gentoo Linux 1.2.0
Gentoo Linux 1.4.0
Immunix Immunix OS 7+
Linux kernel 2.2.0
Linux kernel 2.2.0.x
Linux kernel 2.2.1
Linux kernel 2.2.10
Linux kernel 2.2.11
Linux kernel 2.2.12
Linux kernel 2.2.13
Linux kernel 2.2.14
Linux kernel 2.2.15
Linux kernel 2.2.15 pre16
Linux kernel 2.2.15 pre20
Linux kernel 2.2.16
Linux kernel 2.2.16 pre6
Linux kernel 2.2.17
Linux kernel 2.2.18
Linux kernel 2.2.19
Linux kernel 2.2.2
Linux kernel 2.2.20
Linux kernel 2.2.21
Linux kernel 2.2.22
Linux kernel 2.2.23
Linux kernel 2.2.24
Linux kernel 2.2.25
Linux kernel 2.2.26
Linux kernel 2.2.27 -rc1
Linux kernel 2.2.27 -rc2
Linux kernel 2.2.3
Linux kernel 2.2.4
Linux kernel 2.2.5
Linux kernel 2.2.6
Linux kernel 2.2.7
Linux kernel 2.2.8
Linux kernel 2.2.9
Linux kernel 2.3.0
Linux kernel 2.3.0 .x
Linux kernel 2.3.99
Linux kernel 2.3.99 -pre1
Linux kernel 2.3.99 -pre2
Linux kernel 2.3.99 -pre3
Linux kernel 2.3.99 -pre4
Linux kernel 2.3.99 -pre5
Linux kernel 2.3.99 -pre6
Linux kernel 2.3.99 -pre7
Linux kernel 2.4.0
Linux kernel 2.4.0 .0-test1
Linux kernel 2.4.0 .0-test10
Linux kernel 2.4.0 .0-test11
Linux kernel 2.4.0 .0-test12
Linux kernel 2.4.0 .0-test2
Linux kernel 2.4.0 .0-test3
Linux kernel 2.4.0 .0-test4
Linux kernel 2.4.0 .0-test5
Linux kernel 2.4.0 .0-test6
Linux kernel 2.4.0 .0-test7
Linux kernel 2.4.0 .0-test8
Linux kernel 2.4.0 .0-test9
Linux kernel 2.4.1
Linux kernel 2.4.10
Linux kernel 2.4.11
Linux kernel 2.4.12
Linux kernel 2.4.13
Linux kernel 2.4.14
Linux kernel 2.4.15
Linux kernel 2.4.16
Linux kernel 2.4.17
Linux kernel 2.4.18
Linux kernel 2.4.18 pre-1
Linux kernel 2.4.18 pre-2
Linux kernel 2.4.18 pre-3
Linux kernel 2.4.18 pre-4
Linux kernel 2.4.18 pre-5
Linux kernel 2.4.18 pre-6
Linux kernel 2.4.18 pre-7
Linux kernel 2.4.18 pre-8
Linux kernel 2.4.18 x86
Linux kernel 2.4.19
Linux kernel 2.4.19 -pre1
Linux kernel 2.4.19 -pre2
Linux kernel 2.4.19 -pre3
Linux kernel 2.4.19 -pre4
Linux kernel 2.4.19 -pre5
Linux kernel 2.4.19 -pre6
Linux kernel 2.4.2
Linux kernel 2.4.20
Linux kernel 2.4.21
Linux kernel 2.4.21 pre1
Linux kernel 2.4.21 pre4
Linux kernel 2.4.21 pre7
Linux kernel 2.4.22
Linux kernel 2.4.23
Linux kernel 2.4.23 -ow2
Linux kernel 2.4.23 -pre9
Linux kernel 2.4.24
Linux kernel 2.4.24 -ow1
Linux kernel 2.4.25
Linux kernel 2.4.26
Linux kernel 2.4.27
Linux kernel 2.4.27 -pre1
Linux kernel 2.4.27 -pre2
Linux kernel 2.4.27 -pre3
Linux kernel 2.4.27 -pre4
Linux kernel 2.4.27 -pre5
Linux kernel 2.4.28
Linux kernel 2.4.29
Linux kernel 2.4.29 -rc1
Linux kernel 2.4.29 -rc2
Linux kernel 2.4.3
Linux kernel 2.4.30
Linux kernel 2.4.30 rc2
Linux kernel 2.4.30 rc3
Linux kernel 2.4.31 -pre1
Linux kernel 2.4.4
Linux kernel 2.4.5
Linux kernel 2.4.6
Linux kernel 2.4.7
Linux kernel 2.4.8
Linux kernel 2.4.9
Linux kernel 2.5.0 .0
Linux kernel 2.5.1
Linux kernel 2.5.10
Linux kernel 2.5.11
Linux kernel 2.5.12
Linux kernel 2.5.13
Linux kernel 2.5.14
Linux kernel 2.5.15
Linux kernel 2.5.16
Linux kernel 2.5.17
Linux kernel 2.5.18
Linux kernel 2.5.19
Linux kernel 2.5.2
Linux kernel 2.5.20
Linux kernel 2.5.21
Linux kernel 2.5.22
Linux kernel 2.5.23
Linux kernel 2.5.24
Linux kernel 2.5.25
Linux kernel 2.5.26
Linux kernel 2.5.27
Linux kernel 2.5.28
Linux kernel 2.5.29
Linux kernel 2.5.3
Linux kernel 2.5.30
Linux kernel 2.5.31
Linux kernel 2.5.32
Linux kernel 2.5.33
Linux kernel 2.5.34
Linux kernel 2.5.35
Linux kernel 2.5.36
Linux kernel 2.5.37
Linux kernel 2.5.38
Linux kernel 2.5.39
Linux kernel 2.5.4
Linux kernel 2.5.40
Linux kernel 2.5.41
Linux kernel 2.5.42
Linux kernel 2.5.43
Linux kernel 2.5.44
Linux kernel 2.5.45
Linux kernel 2.5.46
Linux kernel 2.5.47
Linux kernel 2.5.48
Linux kernel 2.5.49
Linux kernel 2.5.5
Linux kernel 2.5.50
Linux kernel 2.5.51
Linux kernel 2.5.52
Linux kernel 2.5.53
Linux kernel 2.5.54
Linux kernel 2.5.55
Linux kernel 2.5.56
Linux kernel 2.5.57
Linux kernel 2.5.58
Linux kernel 2.5.59
Linux kernel 2.5.6
Linux kernel 2.5.60
Linux kernel 2.5.61
Linux kernel 2.5.62
Linux kernel 2.5.63
Linux kernel 2.5.64
Linux kernel 2.5.65
Linux kernel 2.5.66
Linux kernel 2.5.67
Linux kernel 2.5.68
Linux kernel 2.5.69
Linux kernel 2.5.7
Linux kernel 2.5.8
Linux kernel 2.5.9
Linux kernel 2.6.0
Linux kernel 2.6.0 -test1
Linux kernel 2.6.0 -test10
Linux kernel 2.6.0 -test11
Linux kernel 2.6.0 -test2
Linux kernel 2.6.0 -test3
Linux kernel 2.6.0 -test4
Linux kernel 2.6.0 -test5
Linux kernel 2.6.0 -test6
Linux kernel 2.6.0 -test7
Linux kernel 2.6.0 -test8
Linux kernel 2.6.0 -test9
Linux kernel 2.6.0 -test9-CVS
Linux kernel 2.6.0 .10
Linux kernel 2.6.1
Linux kernel 2.6.1 -rc1
Linux kernel 2.6.1 -rc2
Linux kernel 2.6.10
Linux kernel 2.6.10 rc2
Linux kernel 2.6.11
Linux kernel 2.6.11 -rc2
Linux kernel 2.6.11 -rc3
Linux kernel 2.6.11 -rc4
Linux kernel 2.6.11 .5
Linux kernel 2.6.11 .6
Linux kernel 2.6.11 .7
Linux kernel 2.6.11 .8
Linux kernel 2.6.12 -rc4
Linux kernel 2.6.2
Linux kernel 2.6.3
Linux kernel 2.6.4
Linux kernel 2.6.5
Linux kernel 2.6.6
Linux kernel 2.6.6 rc1
Linux kernel 2.6.7
Linux kernel 2.6.7 rc1
Linux kernel 2.6.8
Linux kernel 2.6.8 rc1
Linux kernel 2.6.8 rc2
Linux kernel 2.6.8 rc3
Linux kernel 2.6.9
MandrakeSoft Corporate Server 1.0.1
MandrakeSoft Corporate Server 2.1.0
MandrakeSoft Corporate Server 2.1.0 x86_64
MandrakeSoft Corporate Server 3.0.0
MandrakeSoft Corporate Server 3.0.0 x86_64
MandrakeSoft Linux Mandrake 10.0.0
MandrakeSoft Linux Mandrake 10.0.0 amd64
MandrakeSoft Linux Mandrake 10.1.0
MandrakeSoft Linux Mandrake 10.1.0 x86_64
MandrakeSoft Linux Mandrake 10.2.0
MandrakeSoft Linux Mandrake 10.2.0 x86_64
MandrakeSoft Linux Mandrake 6.0.0
MandrakeSoft Linux Mandrake 6.1.0
MandrakeSoft Linux Mandrake 7.0.0
MandrakeSoft Linux Mandrake 7.1.0
MandrakeSoft Linux Mandrake 7.2.0
MandrakeSoft Linux Mandrake 8.0.0
MandrakeSoft Linux Mandrake 8.0.0 ppc
MandrakeSoft Linux Mandrake 8.1.0
MandrakeSoft Linux Mandrake 8.2.0
MandrakeSoft Linux Mandrake 8.2.0 ppc
MandrakeSoft Linux Mandrake 9.0.0
MandrakeSoft Linux Mandrake 9.1.0
MandrakeSoft Linux Mandrake 9.1.0 ppc
MandrakeSoft Linux Mandrake 9.2.0
MandrakeSoft Linux Mandrake 9.2.0 amd64
MandrakeSoft Multi Network Firewall 2.0.0
MandrakeSoft Single Network Firewall 7.2.0
RedHat Advanced Workstation for the Itanium Processor 2.1.0
RedHat Advanced Workstation for the Itanium Processor 2.1.0 IA64
RedHat Desktop 3.0.0
RedHat Enterprise Linux AS 2.1
RedHat Enterprise Linux AS 2.1 IA64
RedHat Enterprise Linux AS 3
RedHat Enterprise Linux ES 2.1
RedHat Enterprise Linux ES 2.1 IA64
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux WS 2.1 IA64
RedHat Enterprise Linux WS 3
RedHat Fedora Core1
RedHat Fedora Core2
RedHat Fedora Core3
RedHat Fedora Core4
RedHat Linux 6.0.0
RedHat Linux 6.0.0 alpha
RedHat Linux 6.0.0 sparc
RedHat Linux 6.1.0 alpha
RedHat Linux 6.1.0 i386
RedHat Linux 6.1.0 sparc
RedHat Linux 6.2.0
RedHat Linux 6.2.0 alpha
RedHat Linux 6.2.0 i386
RedHat Linux 6.2.0 sparc
RedHat Linux 7.0.0
RedHat Linux 7.0.0 alpha
RedHat Linux 7.0.0 i386
RedHat Linux 7.0.0 sparc
RedHat Linux 7.1.0
RedHat Linux 7.1.0 alpha
RedHat Linux 7.1.0 i386
RedHat Linux 7.1.0 ia64
RedHat Linux 7.2.0
RedHat Linux 7.2.0 alpha
RedHat Linux 7.2.0 i386
RedHat Linux 7.2.0 ia64
RedHat Linux 7.3.0
RedHat Linux 8.0.0
RedHat Linux 9.0.0 i386
S.u.S.E. Linux 6.0.0
S.u.S.E. Linux 6.1.0
S.u.S.E. Linux 6.1.0 alpha
S.u.S.E. Linux 6.3.0
S.u.S.E. Linux 6.3.0 alpha
S.u.S.E. Linux 6.3.0 ppc
S.u.S.E. Linux 6.4.0
S.u.S.E. Linux 6.4.0 alpha
S.u.S.E. Linux 6.4.0 ppc
S.u.S.E. Linux 7.0.0
S.u.S.E. Linux 7.1.0
S.u.S.E. Linux 7.2.0
S.u.S.E. Linux 7.3.0
S.u.S.E. Linux 8.0.0
S.u.S.E. Linux 8.1.0
S.u.S.E. Linux Connectivity Server
S.u.S.E. Linux Database Server
S.u.S.E. Linux Enterprise Server 7
S.u.S.E. Linux Enterprise Server 8
S.u.S.E. Linux Enterprise Server 9
S.u.S.E. Linux Firewall on CD
S.u.S.E. Linux Office Server
S.u.S.E. Linux Openexchange Server
S.u.S.E. Linux Personal 8.2.0
S.u.S.E. Linux Personal 9.0.0
S.u.S.E. Linux Personal 9.0.0 x86_64
S.u.S.E. Linux Personal 9.1.0
S.u.S.E. Linux Personal 9.1.0 x86_64
S.u.S.E. Linux Personal 9.2.0
S.u.S.E. Linux Personal 9.2.0 x86_64
S.u.S.E. SuSE eMail Server 3.1.0
S.u.S.E. SuSE eMail Server III
SCO eDesktop 2.4.0
SCO eServer 2.3.1
SGI ProPack 3.0.0
SGI ProPack 3.0.0 SP1
SGI ProPack 3.0.0 SP2
SGI ProPack 3.0.0 SP3
SGI ProPack 3.0.0 SP4
SGI ProPack 3.0.0 SP5
SGI ProPack 3.0.0 SP6
Slackware Linux -current
Slackware Linux 4.0.0
Slackware Linux 7.0.0
Slackware Linux 7.1.0
Slackware Linux 8.0.0
Slackware Linux 9.0.0
Slackware Linux 9.1.0
SmoothWall Express 2.0.0
Sun Cobalt Qube 3
Sun Cobalt RaQ 4
Sun Cobalt RaQ 550
Sun Cobalt RaQ XTR
Sun Linux 5.0.0
Sun Linux 5.0.3
Sun Linux 5.0.5
Trustix Secure Enterprise Linux 2.0.0
Trustix Secure Linux 1.1.0
Trustix Secure Linux 1.2.0
Trustix Secure Linux 1.5.0
Trustix Secure Linux 2.0.0
Trustix Secure Linux 2.1.0
Trustix Secure Linux 2.2.0
Trustix Secure Linux 3.0.0
Turbolinux Turbolinux Server 7.0.0
Turbolinux Turbolinux Server 8.0.0
Turbolinux Turbolinux Workstation 7.0.0
Turbolinux Turbolinux Workstation 8.0.0
Ubuntu Ubuntu Linux 4.1.0 ia32
Ubuntu Ubuntu Linux 4.1.0 ia64
Ubuntu Ubuntu Linux 4.1.0 ppc
Ubuntu Ubuntu Linux 5.0.0 4 amd64
Ubuntu Ubuntu Linux 5.0.0 4 i386
Ubuntu Ubuntu Linux 5.0.0 4 powerpc
WOLK WOLK 4.4.0 s
WireX Immunix OS 6.2.0
WireX Immunix OS 7.0.0
WireX Immunix OS 7.0.0 -Beta
Xpdf Xpdf 3.0.0 0
libpng libpng 1.0.15
libpng libpng3 1.2.5

References:

Avaya: ASA-2005-120 - Vulnerabilities in Linux Kernel
LWN: 2.6 isn't vulnerable
RedHat: RHSA-2005:472-05 - kernel security update

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.

J-Security Center

Title: Linux Kernel ELF Core Dump Local Buffer Overflow Vulnerability

Severity: HIGH

Description:

Affected Products:

References: