Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* multiple flaws were found in the mmap and mremap implementations. A local user could use these flaws to cause a local denial of service or escalate their privileges. (CVE-2010-0291, Important)

* a NULL pointer dereference flaw was found in the Fast Userspace Mutexes (futexes) implementation. The unlock code path did not check if the futex value associated with pi_state->owner had been modified.
A local user could use this flaw to modify the futex value, possibly leading to a denial of service or privilege escalation when the pi_state->owner pointer is dereferenced. (CVE-2010-0622, Important)

* a NULL pointer dereference flaw was found in the Linux kernel Network File System (NFS) implementation. A local user on a system that has an NFS-mounted file system could use this flaw to cause a denial of service or escalate their privileges on that system.
(CVE-2010-1087, Important)

* a flaw was found in the sctp_process_unk_param() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to an SCTP listening port on a target system, causing a kernel panic (denial of service). (CVE-2010-1173, Important)

* a flaw was found in the Linux kernel Transparent Inter-Process Communication protocol (TIPC) implementation. If a client application, on a local system where the tipc module is not yet in network mode, attempted to send a message to a remote TIPC node, it would dereference a NULL pointer on the local system, causing a kernel panic (denial of service). (CVE-2010-1187, Important)

* a buffer overflow flaw was found in the Linux kernel Global File System 2 (GFS2) implementation. In certain cases, a quota could be written past the end of a memory page, causing memory corruption, leaving the quota stored on disk in an invalid state. A user with write access to a GFS2 file system could trigger this flaw to cause a kernel crash (denial of service) or escalate their privileges on the GFS2 server. This issue can only be triggered if the GFS2 file system is mounted with the 'quota=on' or 'quota=account' mount option.
(CVE-2010-1436, Important)

* a race condition between finding a keyring by name and destroying a freed keyring was found in the Linux kernel key management facility. A local user could use this flaw to cause a kernel panic (denial of service) or escalate their privileges. (CVE-2010-1437, Important)

* a flaw was found in the link_path_walk() function in the Linux kernel. Using the file descriptor returned by the open() function with the O_NOFOLLOW flag on a subordinate NFS-mounted file system, could result in a NULL pointer dereference, causing a denial of service or privilege escalation. (CVE-2010-1088, Moderate)

* a missing permission check was found in the gfs2_set_flags() function in the Linux kernel GFS2 implementation. A local user could use this flaw to change certain file attributes of files, on a GFS2 file system, that they do not own. (CVE-2010-1641, Low)

Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting CVE-2010-1641.

This update also fixes several bugs. Documentation for these bug fixes will be available shortly from http://www.redhat.com/docs/en-US/errata/RHSA-2010-0504/Kernel_Security
_Update/ index.html

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4537     Fabian Yamaguchi reported a missing check for Ethernet     frames larger than the MTU in the r8169 driver. This may     allow users on the local network to crash a system,     resulting in a denial of service.

  - CVE-2010-0727     Sachin Prabhu reported an issue in the GFS2 filesystem.
    Local users can trigger a BUG() altering the permissions     on a locked file, resulting in a denial of service.

  - CVE-2010-1083     Linus Torvalds reported an issue in the USB subsystem,     which may allow local users to obtain portions of     sensitive kernel memory.

  - CVE-2010-1084     Neil Brown reported an issue in the Bluetooth subsystem     that may permit remote attackers to overwrite memory     through the creation of large numbers of sockets,     resulting in a denial of service.

  - CVE-2010-1086     Ang Way Chuang reported an issue in the DVB subsystem     for Digital TV adapters. By creating a specially-encoded     MPEG2-TS frame, a remote attacker could cause the     receiver to enter an endless loop, resulting in a denial     of service.

  - CVE-2010-1087     Trond Myklebust reported an issue in the NFS filesystem.
    A local user may cause an oops by sending a fatal signal     during a file truncation operation, resulting in a     denial of service.

  - CVE-2010-1088     Al Viro reported an issue where automount symlinks may     not be followed when LOOKUP_FOLLOW is not set. This has     an unknown security impact.

  - CVE-2010-1162     Catalin Marinas reported an issue in the tty subsystem     that allows local attackers to cause a kernel memory     leak, possibly resulting in a denial of service.

  - CVE-2010-1173     Chris Guo from Nokia China and Jukka Taimisto and Olli     Jarva from Codenomicon Ltd reported an issue in the SCTP     subsystem that allows a remote attacker to cause a     denial of service using a malformed init package.

  - CVE-2010-1187     Neil Hormon reported an issue in the TIPC subsystem.
    Local users can cause a denial of service by way of a     NULL pointer dereference by sending datagrams through     AF_TIPC before entering network mode.

  - CVE-2010-1437     Toshiyuki Okajima reported a race condition in the     keyring subsystem. Local users can cause memory     corruption via keyctl commands that access a keyring in     the process of being deleted, resulting in a denial of     service.

  - CVE-2010-1446     Wufei reported an issue with kgdb on the PowerPC     architecture, allowing local users to write to kernel     memory. Note: this issue does not affect binary kernels     provided by Debian. The fix is provided for the benefit     of users who build their own kernels from Debian source.

  - CVE-2010-1451     Brad Spengler reported an issue on the SPARC     architecture that allows local users to execute     non-executable pages.

This update also includes fixes a regression introduced by a previous update. See the referenced Debian bug page for details.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0474 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    Security fixes:

    * a NULL pointer dereference flaw was found in the Linux kernel NFSv4     implementation. Several of the NFSv4 file locking functions failed to check     whether a file had been opened on the server before performing locking     operations on it. A local, unprivileged user on a system with an NFSv4     share mounted could possibly use this flaw to cause a kernel panic (denial     of service) or escalate their privileges. (CVE-2009-3726, Important)

    * a flaw was found in the sctp_process_unk_param() function in the Linux     kernel Stream Control Transmission Protocol (SCTP) implementation. A remote     attacker could send a specially-crafted SCTP packet to an SCTP listening     port on a target system, causing a kernel panic (denial of service).
    (CVE-2010-1173, Important)

    * a race condition between finding a keyring by name and destroying a freed     keyring was found in the Linux kernel key management facility. A local,     unprivileged user could use this flaw to cause a kernel panic (denial of     service) or escalate their privileges. (CVE-2010-1437, Important)

    Red Hat would like to thank Simon Vallet for responsibly reporting     CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia     Siemens Networks, and Wind River on behalf of their customer, for     responsibly reporting CVE-2010-1173.

    Bug fixes:

    * RHBA-2007:0791 introduced a regression in the Journaling Block Device     (JBD). Under certain circumstances, removing a large file (such as 300 MB     or more) did not result in inactive memory being freed, leading to the     system having a large amount of inactive memory. Now, the memory is     correctly freed. (BZ#589155)

    * the timer_interrupt() routine did not scale lost real ticks to logical     ticks correctly, possibly causing time drift for 64-bit Red Hat Enterprise     Linux 4 KVM (Kernel-based Virtual Machine) guests that were booted with the     divider=x kernel parameter set to a value greater than 1. warning: many     lost ticks messages may have been logged on the affected guest systems.
    (BZ#590551)

    * a bug could have prevented NFSv3 clients from having the most up-to-date     file attributes for files on a given NFSv3 file system. In cases where a     file type changed, such as if a file was removed and replaced with a     directory of the same name, the NFSv3 client may not have noticed this     change until stat(2) was called (for example, by running ls -l).
    (BZ#596372)

    * RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X subsystem. These     could have caused a system deadlock on some systems where the BIOS set the     default Maximum Memory Read Byte Count (MMRBC) to 4096, and that also use     the Intel PRO/1000 Linux driver, e1000. Errors such as e1000: eth[x]:
    e1000_clean_tx_irq: Detected Tx Unit Hang were logged. (BZ#596374)

    * an out of memory condition in a KVM guest, using the virtio-net network     driver and also under heavy network stress, could have resulted in     that guest being unable to receive network traffic. Users had to manually     remove and re-add the virtio_net module and restart the network service     before networking worked as expected. Such memory conditions no longer     prevent KVM guests receiving network traffic. (BZ#597310)

    * when an SFQ qdisc that limited the queue size to two packets was added to     a network interface, sending traffic through that interface resulted in a     kernel crash. Such a qdisc no longer results in a kernel crash. (BZ#597312)

    * when an NFS client opened a file with the O_TRUNC flag set, it received     a valid stateid, but did not use that stateid to perform the SETATTR call.
    Such cases were rejected by Red Hat Enterprise Linux 4 NFS servers with an     NFS4ERR_BAD_STATEID error, possibly preventing some NFS clients from     writing files to an NFS file system. (BZ#597314)

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues. The system must be rebooted for this     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to kernel 2.6.33.5:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.33.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 kernel was updated to 2.6.27.48, fixing various bugs and security issues :

  - The do_gfs2_set_flags() function in fs/gfs2/file.c of     the Linux kernel does not verify the ownership of a     file, which allows local users to bypass intended access     restrictions via a SETFLAGS ioctl request.
    (CVE-2010-1641)

  - The nfs_wait_on_request() function in fs/nfs/pagelist.c     of the Linux kernel allows attackers to cause a denial     of service (Oops) via unknown vectors related to     truncating a file and an operation that is not     interruptible. (CVE-2010-1087)

  - When strict overcommit is enabled, mm/shmem.c does not     properly handle the export of shmemfs objects by knfsd,     which allows attackers to cause a denial of service     (NULL pointer dereference and knfsd crash) or possibly     have unspecified other impact via unknown vectors.
    (CVE-2010-1643)

  - A race condition in the find_keyring_by_name() function     in security/keys/keyring.c of the Linux kernel allows     local users to cause a denial of service (memory     corruption and system crash) or possibly have     unspecified other impact via keyctl session commands     that trigger access to a dead keyring that is undergoing     deletion by the key_cleanup() function. (CVE-2010-1437)

  - arch/1/mm/fsl_booke_mmu.c in KGDB in the Linux kernel,     when running on PowerPC, does not properly perform a     security check for access to a kernel page, which allows     local users to overwrite arbitrary kernel memory.
    (CVE-2010-1446)

  - The release_one_tty() function in drivers/char/tty_io.c     of the Linux kernel omits certain required calls to the     put_pid() function, which has an unspecified impact and     local attack vectors. (CVE-2010-1162)

  - The r8169 driver of the Linux kernel does not properly     check the size of an Ethernet frame that exceeds the     MTU, which allows remote attackers to cause a denial of     service (temporary network outage) via a packet with a     crafted size, in conjunction with certain packets     containing A characters and certain packets containing E     characters; or cause a denial of service (system crash)     via a packet with a crafted size, in conjunction with     certain packets containing '0' characters, related to     the value of the status register and erroneous behavior     associated with the RxMaxSize register. This     vulnerability exists due to an incorrect fix for     CVE-2009-1389. (CVE-2009-4537)

For a list of non-security related fixes please refer to the kernel RPM changelog.

From Red Hat Security Advisory 2010:0474 :

Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a NULL pointer dereference flaw was found in the Linux kernel NFSv4 implementation. Several of the NFSv4 file locking functions failed to check whether a file had been opened on the server before performing locking operations on it. A local, unprivileged user on a system with an NFSv4 share mounted could possibly use this flaw to cause a kernel panic (denial of service) or escalate their privileges.
(CVE-2009-3726, Important)

* a flaw was found in the sctp_process_unk_param() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to an SCTP listening port on a target system, causing a kernel panic (denial of service). (CVE-2010-1173, Important)

* a race condition between finding a keyring by name and destroying a freed keyring was found in the Linux kernel key management facility. A local, unprivileged user could use this flaw to cause a kernel panic (denial of service) or escalate their privileges. (CVE-2010-1437, Important)

Red Hat would like to thank Simon Vallet for responsibly reporting CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173.

Bug fixes :

* RHBA-2007:0791 introduced a regression in the Journaling Block Device (JBD). Under certain circumstances, removing a large file (such as 300 MB or more) did not result in inactive memory being freed, leading to the system having a large amount of inactive memory. Now, the memory is correctly freed. (BZ#589155)

* the timer_interrupt() routine did not scale lost real ticks to logical ticks correctly, possibly causing time drift for 64-bit Red Hat Enterprise Linux 4 KVM (Kernel-based Virtual Machine) guests that were booted with the 'divider=x' kernel parameter set to a value greater than 1. 'warning: many lost ticks' messages may have been logged on the affected guest systems. (BZ#590551)

* a bug could have prevented NFSv3 clients from having the most up-to-date file attributes for files on a given NFSv3 file system. In cases where a file type changed, such as if a file was removed and replaced with a directory of the same name, the NFSv3 client may not have noticed this change until stat(2) was called (for example, by running 'ls -l'). (BZ#596372)

* RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X subsystem.
These could have caused a system deadlock on some systems where the BIOS set the default Maximum Memory Read Byte Count (MMRBC) to 4096, and that also use the Intel PRO/1000 Linux driver, e1000. Errors such as 'e1000: eth[x]: e1000_clean_tx_irq: Detected Tx Unit Hang' were logged. (BZ#596374)

* an out of memory condition in a KVM guest, using the virtio-net network driver and also under heavy network stress, could have resulted in that guest being unable to receive network traffic. Users had to manually remove and re-add the virtio_net module and restart the network service before networking worked as expected. Such memory conditions no longer prevent KVM guests receiving network traffic.
(BZ#597310)

* when an SFQ qdisc that limited the queue size to two packets was added to a network interface, sending traffic through that interface resulted in a kernel crash. Such a qdisc no longer results in a kernel crash. (BZ#597312)

* when an NFS client opened a file with the O_TRUNC flag set, it received a valid stateid, but did not use that stateid to perform the SETATTR call. Such cases were rejected by Red Hat Enterprise Linux 4 NFS servers with an 'NFS4ERR_BAD_STATEID' error, possibly preventing some NFS clients from writing files to an NFS file system. (BZ#597314)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
47870	RHEL 5 : kernel (RHSA-2010:0504)	Nessus	Red Hat Local Security Checks	2010/7/28	2021/1/14	high
46725	Debian DSA-2053-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	2010/5/26	2021/1/4	high
47026	RHEL 4 : kernel (RHSA-2010:0474)	Nessus	Red Hat Local Security Checks	2010/6/16	2024/11/4	high
47525	Fedora 13 : kernel-2.6.33.5-112.fc13 (2010-9183)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	low
50922	SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 2682 / 2687 / 2689)	Nessus	SuSE Local Security Checks	2010/12/2	2021/1/14	high
68049	Oracle Linux 4 : kernel (ELSA-2010-0474)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/8/24	high

检测

插件搜索

high

high

high

low

high

high