This kernel update fixes the following security problems:
CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine.

CVE-2008-1615: On x86_64 a denial of service attack could be used by local attackers to immediately panic / crash the machine.

CVE-2008-2148: The permission checking in sys_utimensat was incorrect and local attackers could change the filetimes of files they do not own to the current time.

CVE-2008-1669: Fixed a SMP ordering problem in fcntl_setlk could potentially allow local attackers to execute code by timing file locking.

CVE-2008-1375: Fixed a dnotify race condition, which could be used by local attackers to potentially execute code.

CVE-2007-6282: A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets (default filtered by the firewall).

CVE-2008-1367: Clear the 'direction' flag before calling signal handlers. For specific not yet identified programs under specific timing conditions this could potentially have caused memory corruption or code execution.

And the following bugs (numbers are https://bugzilla.novell.com/ references) :

  - patches.fixes/input-add-amilo-pro-v-to-nomux.patch:
    Update the patch to include also 2030 model to nomux     list (bnc#389169).

  - patches.apparmor/fix-net.diff: AppArmor: fix Oops in     apparmor_socket_getpeersec_dgram() (bnc#378608).

  - patches.fixes/input-alps-update.patch: Input: fix the     AlpsPS2 driver (bnc#357881).

- patches.arch/cpufreq_fix_acpi_driver_on_BIOS_changes.patch: CPUFREQ:
Check against freq changes from the BIOS (334378).

- patches.fixes/ieee1394-limit-early-node-speed-to-host-interf ace-speed: ieee1394: limit early node speed to host interface speed (381304).

  - patches.fixes/forcedeth_realtec_phy_fix: Fix a     regression to the GA kernel for some forcedeth cards     (bnc#379478)

  - pci-revert-SMBus-unhide-on-nx6110.patch: Do not unhide     the SMBus on the HP Compaq nx6110, it's unsafe.

  - patches.drivers/e1000-disable-l1aspm.patch: Disable L1     ASPM power savings for 82573 mobile variants, it's     broken (bnc#254713, LTC34077).

  - patches.drivers/libata-improve-hpa-error-handling:
    libata: improve HPA error handling (365534).

  - rpm/kernel-binary.spec.in: Added Conflicts:
    libc.so.6()(64bit) to i386 arch (364433).

- patches.drivers/libata-disallow-sysfs-read-access-to-force-p aram:
libata: don't allow sysfs read access to force param (362599).

  - patches.suse/bonding-workqueue: Update to fix a hang     when closing a bonding device (342994).

  - patches.fixes/mptspi-dv-renegotiate-oops: mptlinux     crashes on kernel 2.6.22 (bnc#271749).

- patches.drivers/usb-update-sierra-and-option-device-ids-from

  -2.6.25-rc3.patch: USB: update sierra and option device   ids from 2.6.25-rc3 (343167).

  - patches.arch/x86-nvidia-timer-quirk: Disable again     (#302327) The PCI ID lists are not complete enough and     let's have the same crap as mainline for this for now.

  - patches.fixes/input-add-lenovo-3000-n100-to-nomux.patch:
    Input: add Lenovo 3000 N100 to nomux blacklist     (bnc#284013).

  - patches.suse/bonding-bh-locking: Add missing chunks. The     SLES10 SP1 version of the patch was updated in May 2007     but the openSuse 10.3 version was forgotten (260069).

- patches.fixes/knfsd-Allow-NFSv2-3-WRITE-calls-to-succeed-whe n-krb.patch: knfsd: Allow NFSv2/3 WRITE calls to succeed when krb5i etc is used. (348737).

- patches.fixes/md-fix-an-occasional-deadlock-in-raid5.patch: md: fix an occasional deadlock in raid5 (357088).

  - patches.drivers/libata-quirk_amd_ide_mode: PCI: modify     SATA IDE mode quirk (345124).

  - Fix section mismatch build failure w/ gcc 4.1.2. bug     #361086.

  - patches.drivers/libata-implement-force-parameter:
    libata: implement libata.force module parameter     (337610).

Lots of XEN Fixes (not detailed listed). Lots of RT Fixes (not detailed listed).

  - Update to 2.6.22.18

  - removes upstreamed patch :

  - patches.fixes/vmsplice-pipe-exploit (CVE-2008-0600)

These updated packages fix the following security issues :

  - a possible kernel memory leak was found in the Linux     kernel Simple Internet Transition (SIT) INET6     implementation. This could allow a local unprivileged     user to cause a denial of service. (CVE-2008-2136,     Important)

  - a flaw was found in the Linux kernel setrlimit system     call, when setting RLIMIT_CPU to a certain value. This     could allow a local unprivileged user to bypass the CPU     time limit. (CVE-2008-1294, Moderate)

  - multiple NULL pointer dereferences were found in various     Linux kernel network drivers. These drivers were missing     checks for terminal validity, which could allow     privilege escalation. (CVE-2008-2812, Moderate)

These updated packages fix the following bugs :

  - the GNU libc stub resolver is a minimal resolver that     works with Domain Name System (DNS) servers to satisfy     requests from applications for names. The GNU libc stub     resolver did not specify a source UDP port, and     therefore used predictable port numbers. This could have     made DNS spoofing attacks easier.

The Linux kernel has been updated to implement random UDP source ports where none are specified by an application. This allows applications, such as those using the GNU libc stub resolver, to use random UDP source ports, helping to make DNS spoofing attacks harder.

  - when using certain hardware, a bug in UART_BUG_TXEN may     have caused incorrect hardware detection, causing data     flow to '/dev/ttyS1' to hang.

  - a 50-75% drop in NFS server rewrite performance,     compared to Red Hat Enterprise Linux 4.6, has been     resolved.

  - due a bug in the fast userspace mutex code, while one     thread fetched a pointer, another thread may have     removed it, causing the first thread to fetch the wrong     pointer, possibly causing a system crash.

  - on certain Hitachi hardware, removing the 'uhci_hcd'     module caused a kernel oops, and the following error :

BUG: warning at arch/ia64/kernel/iosapic.c:1001/iosapic_unregister_intr()

Even after the 'uhci_hcd' module was reloaded, there was no access to USB devices. As well, on systems that have legacy interrupts, 'acpi_unregister_gsi' incorrectly called 'iosapci_unregister_intr()', causing warning messages to be logged.

  - when a page was mapped with mmap(), and 'PROT_WRITE' was     the only 'prot' argument, the first read of that page     caused a segmentation fault. If the page was read after     it was written to, no fault occurred. This was     incompatible with the Red Hat Enterprise Linux 4     behavior.

  - due to a NULL pointer dereference in powernowk8_init(),     a panic may have occurred.

  - certain error conditions handled by the bonding sysfs     interface could have left rtnl_lock() unbalanced, either     by locking and returning without unlocking, or by     unlocking when it did not lock, possibly causing a     'kernel: RTNL: assertion failed at net/core/fib_rules.c'     error.

  - the kernel currently expects a maximum of six Machine     Check Exception (MCE) banks to be exposed by a CPU.
    Certain CPUs have 7 or more, which may have caused the     MCE to be incorrectly reported.

  - a race condition in UNIX domain sockets may have caused     recv() to return zero. For clusters, this may have     caused unexpected failovers.

  - msgrcv() frequently returned an incorrect     'ERESTARTNOHAND (514)' error number.

  - on certain Intel Itanium-based systems, when kdump was     configured to halt the system after a dump operation,     after the 'System halted.' output, the kernel continued     to output endless 'soft lockup' messages.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0612 advisory.

    - [tty] add NULL pointer checks (Aristeu Rozanski ) [453425 453154] {CVE-2008-2812}
    - [net] sctp: make sure sctp_addr does not overflow (David S. Miller ) [452482 452483] {CVE-2008-2826}
    - [sys] sys_setrlimit: prevent setting RLIMIT_CPU to 0 (Neil Horman ) [437121 437122] {CVE-2008-1294}
    - [net] sit: exploitable remote memory leak (Jiri Pirko ) [446038 446039] {CVE-2008-2136}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix utrace dead_engine ops race

  - fix ptrace_attach leak

  - CVE-2007-5093: kernel PWC driver DoS

  - CVE-2007-6282: IPSec ESP kernel panics

  - CVE-2007-6712: kernel: infinite loop in highres timers     (kernel hang)

  - CVE-2008-1615: kernel: ptrace: Unprivileged crash on     x86_64 %cs corruption

  - CVE-2008-1294: kernel: setrlimit(RLIMIT_CPUINFO) with     zero value doesn't inherit properly across children

  - CVE-2008-2136: kernel: sit memory leak

  - CVE-2008-2812: kernel: NULL ptr dereference in multiple     network drivers due to missing checks in tty code

  - restore     linux-2.6-x86-clear-df-flag-for-signal-handlers.patch

  - restore linux-2.6-utrace.patch /     linux-2.6-xen-utrace.patch

  - Kernel security erratas for OVM 2.1.2 from bz#5932 :

  - CVE-2007-6063: isdn: fix possible isdn_net buffer     overflows

  - CVE-2007-3104 Null pointer to an inode in a dentry can     cause an oops in sysfs_readdir

  - CVE-2008-0598: write system call vulnerability

  - CVE-2008-1375: kernel: race condition in dnotify

  - CVE-2008-0001: kernel: filesystem corruption by     unprivileged user via directory truncation

  - CVE-2008-2358: dccp: sanity check feature length

  - CVE-2007-5938: NULL dereference in iwl driver

  - RHSA-2008:0508: kernel: [x86_64] The string instruction     version didn't zero the output on exception.

  - kernel: clear df flag for signal handlers

  - fs: missing dput in do_lookup error leaks dentries

  - sysfs: fix condition check in sysfs_drop_dentry

  - sysfs: fix race condition around sd->s_dentry

  - ieee80211: off-by-two integer underflow

a. Service Console update for DHCP and third-party library update    for DHCP client.

   DHCP is an Internet-standard protocol by which a computer can be    connected to a local network, ask to be given configuration    information, and receive from a server enough information to    configure itself as a member of that network.

   A stack-based buffer overflow in the script_write_params method in    ISC DHCP dhclient allows remote DHCP servers to execute arbitrary    code via a crafted subnet-mask option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0692 to this issue.

   An insecure temporary file use flaw was discovered in the DHCP    daemon's init script ('/etc/init.d/dhcpd'). A local attacker could    use this flaw to overwrite an arbitrary file with the output of the    'dhcpd -t' command via a symbolic link attack, if a system    administrator executed the DHCP init script with the 'configtest',    'restart', or 'reload' option.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1893 to this issue.

b. Updated Service Console package kernel

   Service Console package kernel update to version    kernel-2.4.21-58.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-4210, CVE-2008-3275, CVE-2008-0598,    CVE-2008-2136, CVE-2008-2812, CVE-2007-6063, CVE-2008-3525 to the    security issues fixed in kernel-2.4.21-58.EL

c. JRE Security Update

   JRE update to version 1.5.0_18, which addresses multiple security    issues that existed in earlier releases of JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_17: CVE-2008-2086, CVE-2008-5347, CVE-2008-5348,    CVE-2008-5349, CVE-2008-5350, CVE-2008-5351, CVE-2008-5352,    CVE-2008-5353, CVE-2008-5354, CVE-2008-5356, CVE-2008-5357,    CVE-2008-5358, CVE-2008-5359, CVE-2008-5360, CVE-2008-5339,    CVE-2008-5342, CVE-2008-5344, CVE-2008-5345, CVE-2008-5346,    CVE-2008-5340, CVE-2008-5341, CVE-2008-5343, and CVE-2008-5355.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the following names to the security issues fixed in    JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,    CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099,    CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103,    CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6712     Johannes Bauer discovered an integer overflow condition     in the hrtimer subsystem on 64-bit systems. This can be     exploited by local users to trigger a denial of service     (DoS) by causing the kernel to execute an infinite loop.

  - CVE-2008-1615     Jan Kratochvil reported a local denial of service     condition that permits local users on systems running     the amd64 flavor kernel to cause a system crash.

  - CVE-2008-2136     Paul Harks discovered a memory leak in the Simple     Internet Transition (SIT) code used for IPv6 over IPv4     tunnels. This can be exploited by remote users to cause     a denial of service condition.

  - CVE-2008-2137     David Miller and Jan Lieskovsky discovered issues with     the virtual address range checking of mmaped regions on     the sparc architecture that may be exploited by local     users to cause a denial of service.

This kernel update fixes quite a number of security problems :

  - A remote attacker could crash the IPSec/IPv6 stack by     sending a bad ESP packet. This requires the host to be     able to receive such packets (default filtered by the     firewall). (CVE-2007-6282)

  - A problem in SIT IPv6 tunnel handling could be used by     remote attackers to immediately crash the machine.
    (CVE-2008-2136)

  - On x86_64 a denial of service attack could be used by     local attackers to immediately panic / crash the     machine. (CVE-2008-1615)

  - An information leakage during coredumping of root     processes was fixed. (CVE-2007-6206)

  - Fixed a SMP ordering problem in fcntl_setlk could     potentially allow local attackers to execute code by     timing file locking. (CVE-2008-1669)

  - Fixed a dnotify race condition, which could be used by     local attackers to potentially execute code.
    (CVE-2008-1375)

  - A ptrace bug could be used by local attackers to hang     their own processes indefinitely. (CVE-2007-5500)

  - Clear the 'direction' flag before calling signal     handlers. For specific not yet identified programs under     specific timing conditions this could potentially have     caused memory corruption or code execution.
    (CVE-2008-1367)

  - The isdn_ioctl function in isdn_common.c allowed local     users to cause a denial of service via a crafted ioctl     struct in which ioctls is not null terminated, which     triggers a buffer overflow. (CVE-2007-6151)

Non security related changes :

OCFS2 was updated to version v1.2.9-1-r3100.

Also a huge number of bugs were fixed. Please refer to the RPM changelog for a detailed list.

Dirk Nehring discovered that the IPsec protocol stack did not correctly handle fragmented ESP packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2007-6282)

Johannes Bauer discovered that the 64bit kernel did not correctly handle hrtimer updates. A local attacker could request a large expiration value and cause the system to hang, leading to a denial of service. (CVE-2007-6712)

Tavis Ormandy discovered that the ia32 emulation under 64bit kernels did not fully clear uninitialized data. A local attacker could read private kernel memory, leading to a loss of privacy. (CVE-2008-0598)

Jan Kratochvil discovered that PTRACE did not correctly handle certain calls when running under 64bit kernels. A local attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2008-1615)

Wei Wang discovered that the ASN.1 decoding routines in CIFS and SNMP NAT did not correctly handle certain length values. Remote attackers could exploit this to execute arbitrary code or crash the system.
(CVE-2008-1673)

Paul Marks discovered that the SIT interfaces did not correctly manage allocated memory. A remote attacker could exploit this to fill all available memory, leading to a denial of service. (CVE-2008-2136)

David Miller and Jan Lieskovsky discovered that the Sparc kernel did not correctly range-check memory regions allocated with mmap. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2008-2137)

The sys_utimensat system call did not correctly check file permissions in certain situations. A local attacker could exploit this to modify the file times of arbitrary files which could lead to a denial of service. (CVE-2008-2148)

Brandon Edwards discovered that the DCCP system in the kernel did not correctly check feature lengths. A remote attacker could exploit this to execute arbitrary code. (CVE-2008-2358)

A race condition was discovered between ptrace and utrace in the kernel. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2008-2365)

The copy_to_user routine in the kernel did not correctly clear memory destination addresses when running on 64bit kernels. A local attacker could exploit this to gain access to sensitive kernel memory, leading to a loss of privacy. (CVE-2008-2729)

The PPP over L2TP routines in the kernel did not correctly handle certain messages. A remote attacker could send a specially crafted packet that could crash the system or execute arbitrary code.
(CVE-2008-2750)

Gabriel Campana discovered that SCTP routines did not correctly check for large addresses. A local user could exploit this to allocate all available memory, leading to a denial of service. (CVE-2008-2826).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues :

* a possible kernel memory leak was found in the Linux kernel Simple Internet Transition (SIT) INET6 implementation. This could allow a local unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

* a flaw was found in the Linux kernel setrlimit system call, when setting RLIMIT_CPU to a certain value. This could allow a local unprivileged user to bypass the CPU time limit. (CVE-2008-1294, Moderate)

* multiple NULL pointer dereferences were found in various Linux kernel network drivers. These drivers were missing checks for terminal validity, which could allow privilege escalation. (CVE-2008-2812, Moderate)

These updated packages fix the following bugs :

* the GNU libc stub resolver is a minimal resolver that works with Domain Name System (DNS) servers to satisfy requests from applications for names. The GNU libc stub resolver did not specify a source UDP port, and therefore used predictable port numbers. This could have made DNS spoofing attacks easier.

The Linux kernel has been updated to implement random UDP source ports where none are specified by an application. This allows applications, such as those using the GNU libc stub resolver, to use random UDP source ports, helping to make DNS spoofing attacks harder.

* when using certain hardware, a bug in UART_BUG_TXEN may have caused incorrect hardware detection, causing data flow to '/dev/ttyS1' to hang.

* a 50-75% drop in NFS server rewrite performance, compared to Red Hat Enterprise Linux 4.6, has been resolved.

* due a bug in the fast userspace mutex code, while one thread fetched a pointer, another thread may have removed it, causing the first thread to fetch the wrong pointer, possibly causing a system crash.

* on certain Hitachi hardware, removing the 'uhci_hcd' module caused a kernel oops, and the following error :

BUG: warning at arch/ia64/kernel/iosapic.c:1001/iosapic_unregister_intr()

Even after the 'uhci_hcd' module was reloaded, there was no access to USB devices. As well, on systems that have legacy interrupts, 'acpi_unregister_gsi' incorrectly called 'iosapci_unregister_intr()', causing warning messages to be logged.

* when a page was mapped with mmap(), and 'PROT_WRITE' was the only 'prot' argument, the first read of that page caused a segmentation fault. If the page was read after it was written to, no fault occurred. This was incompatible with the Red Hat Enterprise Linux 4 behavior.

* due to a NULL pointer dereference in powernowk8_init(), a panic may have occurred.

* certain error conditions handled by the bonding sysfs interface could have left rtnl_lock() unbalanced, either by locking and returning without unlocking, or by unlocking when it did not lock, possibly causing a 'kernel: RTNL: assertion failed at net/core/fib_rules.c' error.

* the kernel currently expects a maximum of six Machine Check Exception (MCE) banks to be exposed by a CPU. Certain CPUs have 7 or more, which may have caused the MCE to be incorrectly reported.

* a race condition in UNIX domain sockets may have caused recv() to return zero. For clusters, this may have caused unexpected failovers.

* msgrcv() frequently returned an incorrect 'ERESTARTNOHAND (514)' error number.

* on certain Intel Itanium-based systems, when kdump was configured to halt the system after a dump operation, after the 'System halted.' output, the kernel continued to output endless 'soft lockup' messages.

Red Hat Enterprise Linux 5 users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

This update addresses the following security issues :

  - Tavis Ormandy discovered a deficiency in the Linux     kernel 32-bit and 64-bit emulation. This could allow a     local, unprivileged user to prepare and run a specially     crafted binary which would use this deficiency to leak     uninitialized and potentially sensitive data.
    (CVE-2008-0598, Important)

  - a possible kernel memory leak was found in the Linux     kernel Simple Internet Transition (SIT) INET6     implementation. This could allow a local, unprivileged     user to cause a denial of service. (CVE-2008-2136,     Important)

  - missing capability checks were found in the SBNI WAN     driver which could allow a local user to bypass intended     capability restrictions. (CVE-2008-3525, Important)

  - the do_truncate() and generic_file_splice_write()     functions did not clear the setuid and setgid bits. This     could allow a local, unprivileged user to obtain access     to privileged information. (CVE-2008-4210, Important)

  - a buffer overflow flaw was found in Integrated Services     Digital Network (ISDN) subsystem. A local, unprivileged     user could use this flaw to cause a denial of service.
    (CVE-2007-6063, Moderate)

  - multiple NULL pointer dereferences were found in various     Linux kernel network drivers. These drivers were missing     checks for terminal validity, which could allow     privilege escalation. (CVE-2008-2812, Moderate)

  - a deficiency was found in the Linux kernel virtual     filesystem (VFS) implementation. This could allow a     local, unprivileged user to attempt file creation within     deleted directories, possibly causing a denial of     service. (CVE-2008-3275, Moderate)

This update also fixes the following bugs :

  - the incorrect kunmap function was used in     nfs_xdr_readlinkres. kunmap() was used where     kunmap_atomic() should have been. As a consequence, if     an NFSv2 or NFSv3 server exported a volume containing a     symlink which included a path equal to or longer than     the local system's PATH_MAX, accessing the link caused a     kernel oops. This has been corrected in this update.

  - mptctl_gettargetinfo did not check if pIoc3 was NULL     before using it as a pointer. This caused a kernel panic     in mptctl_gettargetinfo in some circumstances. A check     has been added which prevents this.

  - lost tick compensation code in the timer interrupt     routine triggered without apparent cause. When running     as a fully-virtualized client, this spurious triggering     caused the 64-bit version of Red Hat Enterprise Linux 3     to present highly inaccurate times. With this update the     lost tick compensation code is turned off when the     operating system is running as a fully-virtualized     client under Xen or VMware&reg;.

From Red Hat Security Advisory 2008:0973 :

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update addresses the following security issues :

* Tavis Ormandy discovered a deficiency in the Linux kernel 32-bit and 64-bit emulation. This could allow a local, unprivileged user to prepare and run a specially crafted binary which would use this deficiency to leak uninitialized and potentially sensitive data.
(CVE-2008-0598, Important)

* a possible kernel memory leak was found in the Linux kernel Simple Internet Transition (SIT) INET6 implementation. This could allow a local, unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

* missing capability checks were found in the SBNI WAN driver which could allow a local user to bypass intended capability restrictions.
(CVE-2008-3525, Important)

* the do_truncate() and generic_file_splice_write() functions did not clear the setuid and setgid bits. This could allow a local, unprivileged user to obtain access to privileged information.
(CVE-2008-4210, Important)

* a buffer overflow flaw was found in Integrated Services Digital Network (ISDN) subsystem. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2007-6063, Moderate)

* multiple NULL pointer dereferences were found in various Linux kernel network drivers. These drivers were missing checks for terminal validity, which could allow privilege escalation. (CVE-2008-2812, Moderate)

* a deficiency was found in the Linux kernel virtual filesystem (VFS) implementation. This could allow a local, unprivileged user to attempt file creation within deleted directories, possibly causing a denial of service. (CVE-2008-3275, Moderate)

This update also fixes the following bugs :

* the incorrect kunmap function was used in nfs_xdr_readlinkres.
kunmap() was used where kunmap_atomic() should have been. As a consequence, if an NFSv2 or NFSv3 server exported a volume containing a symlink which included a path equal to or longer than the local system's PATH_MAX, accessing the link caused a kernel oops. This has been corrected in this update.

* mptctl_gettargetinfo did not check if pIoc3 was NULL before using it as a pointer. This caused a kernel panic in mptctl_gettargetinfo in some circumstances. A check has been added which prevents this.

* lost tick compensation code in the timer interrupt routine triggered without apparent cause. When running as a fully-virtualized client, this spurious triggering caused the 64-bit version of Red Hat Enterprise Linux 3 to present highly inaccurate times. With this update the lost tick compensation code is turned off when the operating system is running as a fully-virtualized client under Xen or VMware(r).

All Red Hat Enterprise Linux 3 users should install this updated kernel which addresses these vulnerabilities and fixes these bugs.

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update addresses the following security issues :

* Tavis Ormandy discovered a deficiency in the Linux kernel 32-bit and 64-bit emulation. This could allow a local, unprivileged user to prepare and run a specially crafted binary which would use this deficiency to leak uninitialized and potentially sensitive data.
(CVE-2008-0598, Important)

* a possible kernel memory leak was found in the Linux kernel Simple Internet Transition (SIT) INET6 implementation. This could allow a local, unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

* missing capability checks were found in the SBNI WAN driver which could allow a local user to bypass intended capability restrictions.
(CVE-2008-3525, Important)

* the do_truncate() and generic_file_splice_write() functions did not clear the setuid and setgid bits. This could allow a local, unprivileged user to obtain access to privileged information.
(CVE-2008-4210, Important)

* a buffer overflow flaw was found in Integrated Services Digital Network (ISDN) subsystem. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2007-6063, Moderate)

* multiple NULL pointer dereferences were found in various Linux kernel network drivers. These drivers were missing checks for terminal validity, which could allow privilege escalation. (CVE-2008-2812, Moderate)

* a deficiency was found in the Linux kernel virtual filesystem (VFS) implementation. This could allow a local, unprivileged user to attempt file creation within deleted directories, possibly causing a denial of service. (CVE-2008-3275, Moderate)

This update also fixes the following bugs :

* the incorrect kunmap function was used in nfs_xdr_readlinkres.
kunmap() was used where kunmap_atomic() should have been. As a consequence, if an NFSv2 or NFSv3 server exported a volume containing a symlink which included a path equal to or longer than the local system's PATH_MAX, accessing the link caused a kernel oops. This has been corrected in this update.

* mptctl_gettargetinfo did not check if pIoc3 was NULL before using it as a pointer. This caused a kernel panic in mptctl_gettargetinfo in some circumstances. A check has been added which prevents this.

* lost tick compensation code in the timer interrupt routine triggered without apparent cause. When running as a fully-virtualized client, this spurious triggering caused the 64-bit version of Red Hat Enterprise Linux 3 to present highly inaccurate times. With this update the lost tick compensation code is turned off when the operating system is running as a fully-virtualized client under Xen or VMware(r).

All Red Hat Enterprise Linux 3 users should install this updated kernel which addresses these vulnerabilities and fixes these bugs.

Update to Linux kernel verion 2.6.25.1, 2.6.25.2, 2.6.25.3:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.1 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.2 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.3 Security fixes: CVE-2008-1669 (2.6.25.2) - SMP ordering hole in fcntl_setlk() CVE-2008-2136 (2.6.25.3) - SIT exploitable remote memory leak CVE-2008-1375, CVE-2008-1675 were fixed in 2.6.25-12.fc9 and are available in GA version of kernel package shipped in Fedora 9. Bugs fixed: CIFS: fix slashes in path names to have proper format (#443681)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
33253	openSUSE 10 Security Update : kernel (kernel-5339)	Nessus	SuSE Local Security Checks	2008/6/24	2021/1/14	high
60459	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
67730	Oracle Linux 5 : kernel (ELSA-2008-0612)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
79447	OracleVM 2.1 : kernel (OVMSA-2008-2005)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/14	high
42179	VMSA-2009-0014 : VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues	Nessus	VMware ESX Local Security Checks	2009/10/19	2021/1/6	high
32448	Debian DSA-1588-1 : linux-2.6 - denial of service	Nessus	Debian Local Security Checks	2008/5/28	2021/1/4	high
33432	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5375)	Nessus	SuSE Local Security Checks	2008/7/8	2021/1/14	high
33531	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : linux, linux-source-2.6.15/20/22 vulnerabilities (USN-625-1)	Nessus	Ubuntu Local Security Checks	2008/7/17	2021/1/19	critical
33830	RHEL 5 : kernel (RHSA-2008:0612)	Nessus	Red Hat Local Security Checks	2008/8/5	2021/1/14	high
59128	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5370)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/14	high
60507	Scientific Linux Security Update : kernel on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
67763	Oracle Linux 3 : kernel (ELSA-2008-0973)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high
35190	RHEL 3 : kernel (RHSA-2008:0973)	Nessus	Red Hat Local Security Checks	2008/12/17	2021/1/14	high
32346	Fedora 9 : kernel-2.6.25.3-18.fc9 (2008-3949)	Nessus	Fedora Local Security Checks	2008/5/16	2021/1/11	high
43701	CentOS 5 : kernel (CESA-2008:0612)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	high

检测

插件搜索

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high