A new release of Linux 2.0.36 fixes some security vulnerabilities.
17 Dec. 1998
Summary
Linux, a free UNIX operating system originally created by Linus Torvalds with the assistance of developers around the world, got itself a moderate security upgrade with the release of Linux kernel 2.0.36.
The new version of the Linux kernel fixes the following:
1) Several Denial of Service attacks coming from untrusted local users were fixed.
2) It was possible to crash the IP masquerading daemon, making it possible to execute arbitrary code.
3) mmap (a function that allows the mapping of files or devices into the memory) was upgraded to provide better security. The security upgrade restricts mmap when dealing with "append only" files to reading maps only. Previous kernel versions also did this, but it was possible to use mprotect() to change the mapping to Read/Write. Linux kernel 2.0.36 fixes this hole.
4) The readv/writev problem: The functions readv/writev (functions which allowed reading and writing vectors) could cause a crash. Linux uses "NULL" to indicate that no method is available for read/write operations. The readv/writev calls neglected to check this, and so a writev() to a device that has no write method crashed the program usually creating quite a mess...
5) The fencepost error in the syscall return path problem was fixed. x86 syscall returns are fun because many things can fault in supervisor space if the user process did something stupid, or another thread does things like play with the local descriptor table between the call and return. The Linux kernel catches such faults and tidies up. There was a small range of code that it mistakenly considered as not part of the return path.
6) When interpreting PC partition tables there were a couple of places where you end up doing (something+1) and dividing by it. A partition table with 65535 listed for cylinders caused divide by zero errors. Linux kernel 2.0.36 fixes this.
7) An unchecked size/offset assumption in the masquerading code could in theory lead to a crash. Linux 2.0.36 fixes this.
The security patches list was produced by: Alan Cox.
