Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Information leak in the Linux kernel ext2 implementation
From: Arkoon Security Team (securityarkoon.net)
Date: Fri Apr 01 2005 - 06:59:42 CST
Description: Information leak in the Linux kernel ext2 implementation
Authors: Mathieu Lafon <mlafonarkoon.net>
Romain Francoise <rfrancoisearkoon.net>
Arkoon Security Team Advisory - March 25, 2005
The function ext2_make_empty() used in the Linux implementation of
the ext2 filesystem is vulnerable to an information leak. Upon
directory creation, a new block is obtained from kernel memory to
store the initial directory entries ('.' and '..'). This block is
used and written to disk uninitialized, leading to an information
leak in the block's slack space.
Depending on block size, up to 4072 (4096 - 2 * 12) bytes of kernel
memory can be leaked on each directory creation. This quantity
then decreases when additional entries are added to the directory
Note: since the ext2 implementation uses the dir-in-pagecache
design, any part of kernel memory is susceptible to be leaked, not
only old disk/filesystem data.
Leaked kernel memory can be found in ext2 filesystems; either on
hard drives, removable media (USB thumb drives, flash cards),
initrd images, UML filesystem images, etc...
A quick scan reveals that most ext2 images found on the Internet
contain information that was not meant to be distributed (ranging
from xterm scrollback data to email tidbits).
3. Affected versions
Linux 2.4.x series: all versions up to 2.4.29 (fixed in 2.4.30-rc2)
Linux 2.6.x series: all versions up to 18.104.22.168 (fixed in 22.214.171.124)
4. Vendor response
This vulnerability was acknowledged by the Kernel Security Team
(securitykernel.org) and fixed in versions 2.4.30-rc2 and 126.96.36.199.
The Common Vulnerabilities and Exposures (CVE) project has assigned
the name CAN-2005-0400 to this issue.
03/15/2005 - Vulnerability discovered
03/16/2005 - Vulnerability details sent to securitykernel.org
03/16/2005 - Vulnerability confirmed by kernel maintainers
03/25/2005 - Linux 188.8.131.52 released with fix
03/25/2005 - Linux 2.4.30-rc2 released with fix
04/01/2005 - Public disclosure
This vulnerability was discovered by Romain Francoise and Mathieu
Lafon of the Arkoon Security Team (http://www.arkoon.com/).
Thanks to Andrew Morton, Marcelo Tosatti, Linus Torvalds, Alan Cox
and Chris Wright for their quick response.
7. About us
Arkoon Network Security's Security Team provides security
intelligence to Arkoon's departments, partners and clients, and to
the security community at large.
For further information, see http://www.arkoon.com/.
8. Legal notices
Copyright (C) 2005 Arkoon Network Security
Disclaimer: this document and all information therein are provided
"as is" without warranty of any kind, whether express or implied.
Arkoon Network Security does not warrant or assume any legal
liability or responsibility for the accuracy or completeness of
this information, nor for the possible damage caused by the use of