SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Linux)  >   Linux Kernel Vendors:   [Multiple Authors/Vendors]
Linux Kernel 2.4 O_DIRECT Processing Flaw May Disclose File System Information to Local Users
SecurityTracker Alert ID:  1006049
SecurityTracker URL:  http://securitytracker.com/id/1006049
CVE Reference:   CVE-2003-0018   (Links to External Site)
Date:  Feb 6 2003
Impact:   Denial of service via local system, Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Kernel 2.4.10 and later
Description:   A vulnerability was reported in the Linux 2.4 kernel. A local user may be able to read some information from the file system that the user is not authorized to read.

It is reported that there is a vulnerability in the O_DIRECT handling in Linux kernels 2.4.10 and later. An information leak may allow a local user with write privileges to the file system to read information from the file system from previously deleted files. The local user may also be able to corrupt the file system in a minor fashion that can reportedly be easily repaired by fsck.

Impact:   A local user may be able to read portions of previously deleted files (belonging to other users) and may be able to cause minor file system corruption.
Solution:   Vendors of the various Linux distributions are releasing fixes. See the Message History for Alerts covering individual vendor fixes.

According to MITRE, the 2.4.18 kernel is affected.

[At the time of this entry, it was not clear exactly which version of the kernel contains the fix.]

Vendor URL:  www.kernel.org/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
(Red Hat Issues Fix) Linux Kernel 2.4 O_DIRECT Processing Flaw May Disclose File System Information to Local Users
Red Hat has released a fix.
(Mandrake Issues Fix) Linux Kernel 2.4 O_DIRECT Processing Flaw May Disclose File System Information to Local Users
Mandrake has released a fix.



 Source Message Contents

Subject:  O_DIRECT Bug in Linux Kernel 2.4.10 and later


RedHat reported that there is a vulnerability system O_DIRECT handling in Linux kernels 2.4.10 and
later.  An information leak may allow a local user with write privileges to the file system to read
information from the file system from previously deleted files.  The local user may also be able to
corrupt the file system in a minor fashion that can reportedly be easily repaired by fsck.

CVE:  CAN-2003-0018


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC