Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a NULL pointer dereference flaw was found in the sctp_rcv_ootb() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to a target system, resulting in a denial of service. (CVE-2010-0008, Important)

* a NULL pointer dereference flaw was found in the Linux kernel.
During a core dump, the kernel did not check if the Virtual Dynamically-linked Shared Object page was accessible. On Intel 64 and AMD64 systems, a local, unprivileged user could use this flaw to cause a kernel panic by running a crafted 32-bit application.
(CVE-2009-4271, Important)

* an information leak was found in the print_fatal_signal() implementation in the Linux kernel. When '/proc/sys/kernel/print-fatal-signals' is set to 1 (the default value is 0), memory that is reachable by the kernel could be leaked to user-space. This issue could also result in a system crash. Note that this flaw only affected the i386 architecture. (CVE-2010-0003, Moderate)

* on AMD64 systems, it was discovered that the kernel did not ensure the ELF interpreter was available before making a call to the SET_PERSONALITY macro. A local attacker could use this flaw to cause a denial of service by running a 32-bit application that attempts to execute a 64-bit application. (CVE-2010-0307, Moderate)

* missing capability checks were found in the ebtables implementation, used for creating an Ethernet bridge firewall. This could allow a local, unprivileged user to bypass intended capability restrictions and modify ebtables rules. (CVE-2010-0007, Low)

This update also fixes the following bugs :

* under some circumstances, a locking bug could have caused an online ext3 file system resize to deadlock, which may have, in turn, caused the file system or the entire system to become unresponsive. In either case, a reboot was required after the deadlock. With this update, using resize2fs to perform an online resize of an ext3 file system works as expected. (BZ#553135)

* some ATA and SCSI devices were not honoring the barrier=1 mount option, which could result in data loss after a crash or power loss.
This update applies a patch to the Linux SCSI driver to ensure ordered write caching. This solution does not provide cache flushes; however, it does provide data integrity on devices that have no write caching (or where write caching is disabled) and no command queuing. For systems that have command queuing or write cache enabled there is no guarantee of data integrity after a crash. (BZ#560563)

* it was found that lpfc_find_target() could loop continuously when scanning a list of nodes due to a missing spinlock. This missing spinlock allowed the list to be changed after the list_empty() test, resulting in a NULL value, causing the loop. This update adds the spinlock, resolving the issue. (BZ#561453)

* the fix for CVE-2009-4538 provided by RHSA-2010:0020 introduced a regression, preventing Wake on LAN (WoL) working for network devices using the Intel PRO/1000 Linux driver, e1000e. Attempting to configure WoL for such devices resulted in the following error, even when configuring valid options :

'Cannot set new wake-on-lan settings: Operation not supported not setting wol'

This update resolves this regression, and WoL now works as expected for network devices using the e1000e driver. (BZ#565496)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

This kernel is already in SL 5.5

This updated contains all the security and bug fixes from the 2.6.18-194.el5 kernel. In additions this update fixes the following security issues :

  - a flaw was found in the Unidirectional Lightweight     Encapsulation (ULE) implementation. A remote attacker     could send a specially crafted ISO MPEG-2 Transport     Stream (TS) frame to a target system, resulting in an     infinite loop (denial of service). (CVE-2010-1086,     Important)

  - on AMD64 systems, it was discovered that the kernel did     not ensure the ELF interpreter was available before     making a call to the SET_PERSONALITY macro. A local     attacker could use this flaw to cause a denial of     service by running a 32-bit application that attempts to     execute a 64-bit application. (CVE-2010-0307, Moderate)

  - a flaw was found in the kernel connector implementation.
    A local, unprivileged user could trigger this flaw by     sending an arbitrary number of notification requests     using specially crafted netlink messages, resulting in a     denial of service. (CVE-2010-0410, Moderate)

  - a flaw was found in the Memory-mapped I/O (MMIO)     instruction decoder in the Xen hypervisor     implementation. An unprivileged guest user could use     this flaw to trick the hypervisor into emulating a     certain instruction, which could crash the guest (denial     of service). (CVE-2010-0730, Moderate)

  - a divide-by-zero flaw was found in the azx_position_ok()     function in the driver for Intel High Definition Audio,     snd-hda-intel. A local, unprivileged user could trigger     this flaw to cause a kernel crash (denial of service).
    (CVE-2010-1085, Moderate)

This update also fixes the following bugs :

  - in some cases, booting a system with the 'iommu=on'     kernel parameter resulted in a Xen hypervisor panic.
    (BZ#580199)

  - the fnic driver flushed the Rx queue instead of the Tx     queue after fabric login. This caused crashes in some     cases. (BZ#580829)

  - 'kernel unaligned access' warnings were logged to the     dmesg log on some systems. (BZ#580832)

  - the 'Northbridge Error, node 1, core: -1 K8 ECC error'     error occurred on some systems using the amd64_edac     driver. (BZ#580836)

  - in rare circumstances, when using kdump and booting a     kernel with 'crashkernel=128M@16M', the kdump kernel did     not boot after a crash. (BZ#580838)

  - TLB page table entry flushing was done incorrectly on     IBM System z, possibly causing crashes, subtle data     inconsistency, or other issues. (BZ#580839)

  - iSCSI failover times were slower than in Red Hat     Enterprise Linux 5.3. (BZ#580840)

  - fixed floating point state corruption after signal.
    (BZ#580841)

  - in certain circumstances, under heavy load, certain     network interface cards using the bnx2 driver and     configured to use MSI-X, could stop processing     interrupts and then network connectivity would cease.
    (BZ#587799)

  - cnic parts resets could cause a deadlock when the bnx2     device was enslaved in a bonding device and that device     had an associated VLAN. (BZ#581148)

  - some BIOS implementations initialized interrupt     remapping hardware in a way the Xen hypervisor     implementation did not expect. This could have caused a     system hang during boot. (BZ#581150)

  - AMD Magny-Cours systems panicked when booting a 32-bit     kernel. (BZ#580846)

The system must be rebooted for this update to take effect.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-285:05 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2010-0307     The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform     does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which     allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to     execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer,     related to the flush_old_exec function.
    CVE-2010-0410     drivers/connector/connector.c in the Linux kernel before 2.6.32.8 allows local users to cause a denial of     service (memory consumption and system crash) by sending the kernel many NETLINK_CONNECTOR messages.
    CVE-2010-0730     The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux     (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that     trigger an unspecified instruction emulation.
    CVE-2010-1085     The azx_position_ok function in hda_intel.c in Linux kernel 2.6.33-rc4 and earlier, when running on the     AMD780V chip set, allows context-dependent attackers to cause a denial of service (crash) via unknown     manipulations that trigger a divide-by-zero error.
    CVE-2010-1086     The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel     2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS     frame, related to an invalid Payload Pointer ULE.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a flaw was found in the Unidirectional Lightweight Encapsulation (ULE) implementation. A remote attacker could send a specially crafted ISO MPEG-2 Transport Stream (TS) frame to a target system, resulting in an infinite loop (denial of service). (CVE-2010-1086, Important)

* on AMD64 systems, it was discovered that the kernel did not ensure the ELF interpreter was available before making a call to the SET_PERSONALITY macro. A local attacker could use this flaw to cause a denial of service by running a 32-bit application that attempts to execute a 64-bit application. (CVE-2010-0307, Moderate)

* a flaw was found in the kernel connector implementation. A local, unprivileged user could trigger this flaw by sending an arbitrary number of notification requests using specially crafted netlink messages, resulting in a denial of service. (CVE-2010-0410, Moderate)

* a flaw was found in the Memory-mapped I/O (MMIO) instruction decoder in the Xen hypervisor implementation. An unprivileged guest user could use this flaw to trick the hypervisor into emulating a certain instruction, which could crash the guest (denial of service).
(CVE-2010-0730, Moderate)

* a divide-by-zero flaw was found in the azx_position_ok() function in the driver for Intel High Definition Audio, snd-hda-intel. A local, unprivileged user could trigger this flaw to cause a kernel crash (denial of service). (CVE-2010-1085, Moderate)

This update also fixes the following bugs :

* in some cases, booting a system with the 'iommu=on' kernel parameter resulted in a Xen hypervisor panic. (BZ#580199)

* the fnic driver flushed the Rx queue instead of the Tx queue after fabric login. This caused crashes in some cases. (BZ#580829)

* 'kernel unaligned access' warnings were logged to the dmesg log on some systems. (BZ#580832)

* the 'Northbridge Error, node 1, core: -1 K8 ECC error' error occurred on some systems using the amd64_edac driver. (BZ#580836)

* in rare circumstances, when using kdump and booting a kernel with 'crashkernel=128M@16M', the kdump kernel did not boot after a crash.
(BZ#580838)

* TLB page table entry flushing was done incorrectly on IBM System z, possibly causing crashes, subtle data inconsistency, or other issues.
(BZ#580839)

* iSCSI failover times were slower than in Red Hat Enterprise Linux 5.3. (BZ#580840)

* fixed floating point state corruption after signal. (BZ#580841)

* in certain circumstances, under heavy load, certain network interface cards using the bnx2 driver and configured to use MSI-X, could stop processing interrupts and then network connectivity would cease. (BZ#587799)

* cnic parts resets could cause a deadlock when the bnx2 device was enslaved in a bonding device and that device had an associated VLAN.
(BZ#581148)

* some BIOS implementations initialized interrupt remapping hardware in a way the Xen hypervisor implementation did not expect. This could have caused a system hang during boot. (BZ#581150)

* AMD Magny-Cours systems panicked when booting a 32-bit kernel.
(BZ#580846)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Kernel security update for Fedora 11: CVE-2009-4141 CVE-2009-4536 CVE-2009-4537 CVE-2009-4538 CVE-2010-0307 Bugs: 559100 kernel:
tty->pgrp races 521265 oops in VIA padlock driver

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3939     Joseph Malicki reported that the dbg_lvl sysfs attribute     for the megaraid_sas device driver had world-writable     permissions, permitting local users to modify logging     settings.

  - CVE-2009-4027     Lennert Buytenhek reported a race in the mac80211     subsystem that may allow remote users to cause a denial     of service (system crash) on a system connected to the     same wireless network.

  - CVE-2009-4536 CVE-2009-4538     Fabian Yamaguchi reported issues in the e1000 and e1000e     drivers for Intel gigabit network adapters which allow     remote users to bypass packet filters using specially     crafted ethernet frames.

  - CVE-2010-0003     Andi Kleen reported a defect which allows local users to     gain read access to memory reachable by the kernel when     the print-fatal-signals option is enabled. This option     is disabled by default.

  - CVE-2010-0007     Florian Westphal reported a lack of capability checking     in the ebtables netfilter subsystem. If the ebtables     module is loaded, local users can add and modify     ebtables rules.

  - CVE-2010-0291     Al Viro reported several issues with the mmap/mremap     system calls that allow local users to cause a denial of     service (system panic) or obtain elevated privileges.

  - CVE-2010-0298 & CVE-2010-0306     Gleb Natapov discovered issues in the KVM subsystem     where missing permission checks (CPL/IOPL) permit a user     in a guest system to denial of service a guest (system     crash) or gain escalated privileges with the guest.

  - CVE-2010-0307     Mathias Krause reported an issue with the     load_elf_binary code on the amd64 flavor kernels that     allows local users to cause a denial of service (system     crash).

  - CVE-2010-0309     Marcelo Tosatti fixed an issue in the PIT emulation code     in the KVM subsystem that allows privileged users in a     guest domain to cause a denial of service (crash) of the     host system.

  - CVE-2010-0410     Sebastian Krahmer discovered an issue in the netlink     connector subsystem that permits local users to allocate     large amounts of system memory resulting in a denial of     service (out of memory).

  - CVE-2010-0415     Ramon de Carvalho Valle discovered an issue in the     sys_move_pages interface, limited to amd64, ia64 and     powerpc64 flavors in Debian. Local users can exploit     this issue to cause a denial of service (system crash)     or gain access to sensitive kernel memory.

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.45 fixing various bugs and security issues.

  - The wake_futex_pi function in kernel/futex.c in the     Linux kernel before 2.6.33-rc7 does not properly handle     certain unlock operations for a Priority Inheritance     (PI) futex, which allows local users to cause a denial     of service (OOPS) and possibly have unspecified other     impact via vectors involving modification of the futex     value from user space. (CVE-2010-0622)

  - The load_elf_binary function in fs/binfmt_elf.c in the     Linux kernel before 2.6.32.8 on the x86_64 platform does     not ensure that the ELF interpreter is available before     a call to the SET_PERSONALITY macro, which allows local     users to cause a denial of service (system crash) via a     32-bit application that attempts to execute a 64-bit     application and then triggers a segmentation fault, as     demonstrated by amd64_killer, related to the     flush_old_exec function. (CVE-2010-0307)

  - Users could send/allocate arbitrary amounts of     NETLINK_CONNECTOR messages to the kernel, causing OOM     condition, killing selected processes or halting the     system. (CVE-2010-0410)

  - The do_pages_move function in mm/migrate.c in the Linux     kernel before 2.6.33-rc7 does not validate node values,     which allows local users to read arbitrary kernel memory     locations, cause a denial of service (OOPS), and     possibly have unspecified other impact by specifying a     node that is not part of the kernels node set.
    (CVE-2010-0415)

  - net/bridge/netfilter/ebtables.c in the ebtables module     in the netfilter framework in the Linux kernel before     2.6.33-rc4 does not require the CAP_NET_ADMIN capability     for setting or modifying rules, which allows local users     to bypass intended access restrictions and configure     arbitrary network-traffic filtering via a modified     ebtables application. (CVE-2010-0007)

  - drivers/net/e1000/e1000_main.c in the e1000 driver in     the Linux kernel 2.6.32.3 and earlier handles Ethernet     frames that exceed the MTU by processing certain     trailing payload data as if it were a complete frame,     which allows remote attackers to bypass packet filters     via a large packet with a crafted payload.
    (CVE-2009-4536)

  - drivers/net/e1000e/netdev.c in the e1000e driver in the     Linux kernel 2.6.32.3 and earlier does not properly     check the size of an Ethernet frame that exceeds the     MTU, which allows remote attackers to have an     unspecified impact via crafted packets. (CVE-2009-4538)

  - The print_fatal_signal function in kernel/signal.c in     the Linux kernel before 2.6.32.4 on the i386 platform,     when print-fatal-signals is enabled, allows local users     to discover the contents of arbitrary memory locations     by jumping to an address and then reading a log file,     and might allow local users to cause a denial of service     (system slowdown or crash) by jumping to an address.
    (CVE-2010-0003)

  - The poll_mode_io file for the megaraid_sas driver in the     Linux kernel 2.6.31.6 and earlier has world-writable     permissions, which allows local users to change the I/O     mode of the driver by modifying this file.
    (CVE-2009-3939)

Mathias Krause discovered that the Linux kernel did not correctly handle missing ELF interpreters. A local attacker could exploit this to cause the system to crash, leading to a denial of service.
(CVE-2010-0307)

Marcelo Tosatti discovered that the Linux kernel's hardware virtualization did not correctly handle reading the /dev/port special device. A local attacker in a guest operating system could issue a specific read that would cause the host system to crash, leading to a denial of service. (CVE-2010-0309)

Sebastian Krahmer discovered that the Linux kernel did not correctly handle netlink connector messages. A local attacker could exploit this to consume kernel memory, leading to a denial of service.
(CVE-2010-0410)

Ramon de Carvalho Valle discovered that the Linux kernel did not correctly validate certain memory migration calls. A local attacker could exploit this to read arbitrary kernel memory or cause a system crash, leading to a denial of service. (CVE-2010-0415)

Jermome Marchand and Mikael Pettersson discovered that the Linux kernel did not correctly handle certain futex operations. A local attacker could exploit this to cause a system crash, leading to a denial of service. (CVE-2010-0622, CVE-2010-0623).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
45091	CentOS 4 : kernel (CESA-2010:0146)	Nessus	CentOS Local Security Checks	2010/3/19	2021/1/4	high
60788	Scientific Linux Security Update : kernel on SL 5.0-5.4 i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	2016/3/4	2022/5/25	high
284498	MiracleLinux 3 : kernel-2.6.18-128.18.AXS3 (AXSA:2010-285:05)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/19	medium
46307	RHEL 5 : kernel (RHSA-2010:0398)	Nessus	Red Hat Local Security Checks	2010/5/11	2021/1/14	high
46759	CentOS 5 : kernel (CESA-2010:0398)	Nessus	CentOS Local Security Checks	2010/6/1	2021/1/4	high
47258	Fedora 11 : kernel-2.6.30.10-105.2.13.fc11 (2010-1500)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	critical
44860	Debian DSA-1996-1 : linux-2.6 - privilege escalation/denial of service/sensitive memory leak	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	critical
44966	SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 2040 / 2043 / 2044)	Nessus	SuSE Local Security Checks	2010/3/3	2021/1/14	critical
45081	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : linux, linux-source-2.6.15 vulnerabilities (USN-914-1)	Nessus	Ubuntu Local Security Checks	2010/3/17	2019/9/19	medium

检测

插件搜索

high

high

high

medium

high

high

critical

critical

critical

medium