Stay Secure with the Latest Linux Advisories

security advisorykernel updateprivilege escalation

Slackware: 2.2.16 Advisory Critical: Privilege Escalation Risks

Capabilities and other security vulnerabilities have been discovered. ===================================Kernel Version 2.2.16 Security Fixes =================================== The 2.2.16 release of the Linux kernel is available and includes a number of security fixes. The following list of fixes comes from the kernel release notes: ---------------------------------------------------------------------------- Capabilities - Fixes for serious setuid handling flaws when using restricted capability sets ELF loader - The ELF loader could be tricked by erroneous headers Procfs - Several /proc drivers failed to do correct sanity checking Readv/writev - Potential overflow bug fixed Signal Stacks - Exec failed to clear an existing alternate sigstack System 5 Shared Memory - If a user managed to attach a segment 65536 times bad things happened. TCP multiconnect hang - The TCP code had a bug that could cause the machine to hang. This was user exploitable. ----------------------------------------------------------------------------- We recommend that you read the above as a list of reasons to upgrade to 2.2.16, if you're running a 2.2.x kernel. The capabilities hole is especially nasty, as it allows a local user to gain root access from a program that normally drops root privileges. The standard pre-built Slackware kernels have been built from 2.2.16 source and are now available in Slackware-current: ftp://ftp.slackware.com/pub/slackware/slackware-current/kernels/ You will probably also need a new set of modules, available from: They are also available in packaged form in the slackware-current ftp tree (). The files, within that directory, are: a1/modules.tgz, a1/scsimods.tgz, a1/sndmods.tgz, a1/fsmods.tgz, and n1/netmods.tgz The kernel release notes are available here: https://www.linux.com . Kernel version 2.2.16 addresses critical vulnerabilities. Update advised for enhanced user safety and improved reliability.. Kernel Update, SlackwareSecurity, Capabilities Fixes, Privilege Escalation. . Severity: Critical. LinuxSecurity.com Team

Jun 10, 2000 •Critical Slackware