Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux 4. This is the seventh regular update.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Kernel Feature Support: * iostat displays I/O performance for partitions * I/O task accounting added to getrusage(), allowing comprehensive core statistics * page cache pages count added to show_mem() output * tux O_ATOMICLOOKUP flag removed from the open() system call: replaced with O_CLOEXEC * the kernel now exports process limit information to /proc/[PID]/limits * implement udp_poll() to reduce likelihood of false positives returned from select() * the TCP_RTO_MIN parameter can now be configured to a maximum of 3000 milliseconds. This is configured using 'ip route' * update CIFS to version 1.50

Added Features: * nfs.enable_ino64 boot command line parameter: enable and disable 32-bit inode numbers when using NFS * tick 'divider' kernel boot parameter: reduce CPU overhead, and increase efficiency at the cost of lowering timing accuracy * /proc/sys/vm/nfs-writeback-lowmem-only tunable parameter: resolve NFS read performance * /proc/sys/vm/write-mapped tunable option, allowing the option of faster NFS reads * support for Large Receive Offload as a networking module * core dump masking, allowing a core dump process to skip the shared memory segments of a process

Virtualization: * para-virtualized network and block device drivers, to increase fully-virtualized guest performance * support for more than three VNIF numbers per guest domain

Platform Support: * AMD ATI SB800 SATA controller, AMD ATI SB600 and SB700 40-pin IDE cable * 64-bit DMA support on AMD ATI SB700 * PCI device IDs to support Intel ICH10 * /dev/msr[0-n] device files * powernow-k8 as a module * SLB shadow buffer support for IBM POWER6 systems * support for CPU frequencies greater than 32-bit on IBM POWER5, IBM POWER6 * floating point load and store handler for IBM POWER6

Added Drivers and Updates: * ixgbe 1.1.18, for the Intel 82598 10GB ethernet controller * bnx2x 1.40.22, for network adapters on the Broadcom 5710 chipset * dm-hp-sw 1.0.0, for HP Active/Standby * zfcp version and bug fixes * qdio to fix FCP/SCSI write I/O expiring on LPARs * cio bug fixes * eHEA latest upstream, and netdump and netconsole support * ipr driver support for dual SAS RAID controllers
* correct CPU cache info and SATA support for Intel Tolapai * i5000_edac support for Intel 5000 chipsets * i3000_edac support for Intel 3000 and 3010 chipsets * add i2c_piix4 module on 64-bit systems to support AMD ATI SB600, 700 and 800 * i2c-i801 support for Intel Tolapai * qla4xxx: 5.01.01-d2 to 5.01.02-d4-rhel4.7-00 * qla2xxx:
8.01.07-d4 to 8.01.07-d4-rhel4.7-02 * cciss: 2.6.16 to 2.6.20 * mptfusion: 3.02.99.00rh to 3.12.19.00rh * lpfc:0: 8.0.16.34 to 8.0.16.40 * megaraid_sas: 00.00.03.13 to 00.00.03.18-rh1 * stex:
3.0.0.1 to 3.6.0101.2 * arcmsr: 1.20.00.13 to 1.20.00.15.rh4u7 * aacraid: 1.1-5[2441] to 1.1.5[2455]

Miscellaneous Updates: * OFED 1.3 support * wacom driver to add support for Cintiq 20WSX, Wacom Intuos3 12x19, 12x12 and 4x6 tablets * sata_svw driver to support Broadcom HT-1100 chipsets * libata to un-blacklist Hitachi drives to enable NCQ * ide driver allows command line option to disable ide drivers * psmouse support for cortps protocol

These updated packages fix the following security issues :

* NULL pointer access due to missing checks for terminal validity.
(CVE-2008-2812, Moderate)

* a security flaw was found in the Linux kernel Universal Disk Format file system. (CVE-2006-4145, Low)

For further details, refer to the latest Red Hat Enterprise Linux 4.7 release notes: redhat.com/docs/manuals/enterprise

This update of the SUSE Linux Enterprise 10 Service Pack 1 kernel contains lots of bugfixes and several security fixes :

  - Added missing capability checks in sbni_ioctl().
    (CVE-2008-3525)

  - On AMD64 some string operations could leak kernel     information into userspace. (CVE-2008-0598)

  - Added range checking in ASN.1 handling for the CIFS and     SNMP NAT netfilter modules. (CVE-2008-1673)

  - Fixed range checking in the snd_seq OSS ioctl, which     could be used to leak information from the kernel.
    (CVE-2008-3272)

  - Fixed a memory leak when looking up deleted directories     which could be used to run the system out of memory.
    (CVE-2008-3275)

  - The do_change_type function in fs/namespace.c did not     verify that the caller has the CAP_SYS_ADMIN capability,     which allows local users to gain privileges or cause a     denial of service by modifying the properties of a     mountpoint. (CVE-2008-2931)

  - Various NULL ptr checks have been added to tty op     functions, which might have been used by local attackers     to execute code. We think that this affects only devices     openable by root, so the impact is limited.
    (CVE-2008-2812)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or arbitrary code execution. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6282     Dirk Nehring discovered a vulnerability in the IPsec     code that allows remote users to cause a denial of     service by sending a specially crafted ESP packet.

  - CVE-2008-0598     Tavis Ormandy discovered a vulnerability that allows     local users to access uninitialized kernel memory,     possibly leaking sensitive data. This issue is specific     to the amd64-flavour kernel images.

  - CVE-2008-2729     Andi Kleen discovered an issue where uninitialized     kernel memory was being leaked to userspace during an     exception. This issue may allow local users to gain     access to sensitive data. Only the amd64-flavour Debian     kernel images are affected.

  - CVE-2008-2812     Alan Cox discovered an issue in multiple tty drivers     that allows local users to trigger a denial of service     (NULL pointer dereference) and possibly obtain elevated     privileges.

  - CVE-2008-2826     Gabriel Campana discovered an integer overflow in the     sctp code that can be exploited by local users to cause     a denial of service.

  - CVE-2008-2931     Miklos Szeredi reported a missing privilege check in the     do_change_type() function. This allows local,     unprivileged users to change the properties of mount     points.

  - CVE-2008-3272     Tobias Klein reported a locally exploitable data leak in     the snd_seq_oss_synth_make_info() function. This may     allow local users to gain access to sensitive     information.

  - CVE-2008-3275     Zoltan Sogor discovered a coding error in the VFS that     allows local users to exploit a kernel memory leak     resulting in a denial of service.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
33581	RHEL 4 : kernel (RHSA-2008:0665)	Nessus	Red Hat Local Security Checks	2008/7/25	2021/1/14	high
34331	SuSE 10 Security Update : the Linux Kernel (x86) (ZYPP Patch Number 5566)	Nessus	SuSE Local Security Checks	2008/10/2	2021/1/14	critical
34032	Debian DSA-1630-1 : linux-2.6 - denial of service/information leak	Nessus	Debian Local Security Checks	2008/8/24	2021/1/4	high

检测

插件搜索

high

critical

high