Debian Security Advisory DSA 450-1                     security@debian.org 
Debian -- Security Information                              Martin Schulze
February 27th, 2004                      Debian -- Debian security FAQ 
- --------------------------------------------------------------------------

Package        : kernel-source-2.4.19, kernel-patch-2.4.19-mips
Vulnerability  : several vulnerabilities
Problem-Type   : local
Debian-specific: no
CVE ID         : CAN-2003-0961 CAN-2003-0985 CAN-2004-0077

Several local root exploits have been discovered recently in the Linux
kernel.  This security advisory updates the mips kernel 2.4.19 for
Debian GNU/Linux.  The Common Vulnerabilities and Exposures project
identifies the following problems that are fixed with this update:

CAN-2003-0961:

   An integer overflow in brk() system call (do_brk() function) for
   Linux allows a local attacker to gain root privileges.  Fixed
   upstream in Linux 2.4.23.

CAN-2003-0985:

   Paul Starzetz discovered a flaw in bounds checking in mremap() in
   the Linux kernel (present in version 2.4.x and 2.6.x) which may
   allow a local attacker to gain root privileges.  Version 2.2 is not
   affected by this bug.  Fixed upstream in Linux 2.4.24.

CAN-2004-0077:

   Paul Starzetz and Wojciech Purczynski of isec.pl discovered a
   critical security vulnerability in the memory management code of
   Linux inside the mremap(2) system call.  Due to missing function
   return value check of internal functions a local attacker can gain
   root privileges.  Fixed upstream in Linux 2.4.25 and 2.6.3.

For the stable distribution (woody) these problems have been fixed in
version 2.4.19-0.020911.1.woody3 of mips images and version
2.4.19-4.woody1 of kernel source.

For the unstable distribution (sid) this problem will be fixed soon
with the next upload of a 2.4.19 kernel image and in version
2.4.22-0.030928.3 for 2.4.22.

We recommend that you upgrade your Linux kernel packages immediately.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

      
      Size/MD5 checksum:      672 7bbdd141827b2a7c6e5d3dc0ec1419aa
      
      Size/MD5 checksum:    40736 2a4fa2f28b3af1ba4247255cf1cab05d
      
      Size/MD5 checksum: 32000211 237896fbb45ae652cc9c5cecc9b746da

      
      Size/MD5 checksum:      792 767aee163c5c3fccbddf1f917d06488c
      
      Size/MD5 checksum:  1020287 80c1f72a99eaf113161c589ec49b06f6

  Architecture independent components:

      
      Size/MD5 checksum:  1782662 b8ade5f98fcb9f3a5627d688467eddcb
      
      Size/MD5 checksum: 25892640 b22804d26e298f7f02e51d48d31da2dc

      
      Size/MD5 checksum:  1020394 ba072ba9f904251c7327ccbeedaa8f20

  Big endian MIPS architecture:

      
      Size/MD5 checksum:  3918150 d1d65ee7cfabcf71efc5d06ac78f6319
      
      Size/MD5 checksum:  2075108 8f41b6344fe92ba16e69a623c8e3a9b7
      
      Size/MD5 checksum:  2075486 e53315d4e51e49d809e83191d945a4f8
      
      Size/MD5 checksum:    12842 b65ca394f3fe542c68787794ee5a4337


  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb  Debian -- Security Information  stable/updates main
For dpkg-ftp:    dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and  http://packages.debian.org/

Debian: kernel MIPs platform update

February 27, 2004
Several local root exploits have been discovered recently in the Linux 2.4.x kernel.

Summary

Several local root exploits have been discovered recently in the Linux
kernel. This security advisory updates the mips kernel 2.4.19 for
Debian GNU/Linux. The Common Vulnerabilities and Exposures project
identifies the following problems that are fixed with this update:

CAN-2003-0961:

An integer overflow in brk() system call (do_brk() function) for
Linux allows a local attacker to gain root privileges. Fixed
upstream in Linux 2.4.23.

CAN-2003-0985:

Paul Starzetz discovered a flaw in bounds checking in mremap() in
the Linux kernel (present in version 2.4.x and 2.6.x) which may
allow a local attacker to gain root privileges. Version 2.2 is not
affected by this bug. Fixed upstream in Linux 2.4.24.

CAN-2004-0077:

Paul Starzetz and Wojciech Purczynski of isec.pl discovered a
critical security vulnerability in the memory management code of
Linux inside the mremap(2) system call. Due to missing function
return value check of internal functions a local attacker can gain
...

Read the Full Advisory

Severity
Package : kernel-source-2.4.19, kernel-patch-2.4.19-mips
CVE ID : CAN-2003-0961 CAN-2003-0985 CAN-2004-0077

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved