Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* multiple flaws were found in the mmap and mremap implementations. A local user could use these flaws to cause a local denial of service or escalate their privileges. (CVE-2010-0291, Important)

* a NULL pointer dereference flaw was found in the Fast Userspace Mutexes (futexes) implementation. The unlock code path did not check if the futex value associated with pi_state->owner had been modified.
A local user could use this flaw to modify the futex value, possibly leading to a denial of service or privilege escalation when the pi_state->owner pointer is dereferenced. (CVE-2010-0622, Important)

* a NULL pointer dereference flaw was found in the Linux kernel Network File System (NFS) implementation. A local user on a system that has an NFS-mounted file system could use this flaw to cause a denial of service or escalate their privileges on that system.
(CVE-2010-1087, Important)

* a flaw was found in the sctp_process_unk_param() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to an SCTP listening port on a target system, causing a kernel panic (denial of service). (CVE-2010-1173, Important)

* a flaw was found in the Linux kernel Transparent Inter-Process Communication protocol (TIPC) implementation. If a client application, on a local system where the tipc module is not yet in network mode, attempted to send a message to a remote TIPC node, it would dereference a NULL pointer on the local system, causing a kernel panic (denial of service). (CVE-2010-1187, Important)

* a buffer overflow flaw was found in the Linux kernel Global File System 2 (GFS2) implementation. In certain cases, a quota could be written past the end of a memory page, causing memory corruption, leaving the quota stored on disk in an invalid state. A user with write access to a GFS2 file system could trigger this flaw to cause a kernel crash (denial of service) or escalate their privileges on the GFS2 server. This issue can only be triggered if the GFS2 file system is mounted with the 'quota=on' or 'quota=account' mount option.
(CVE-2010-1436, Important)

* a race condition between finding a keyring by name and destroying a freed keyring was found in the Linux kernel key management facility. A local user could use this flaw to cause a kernel panic (denial of service) or escalate their privileges. (CVE-2010-1437, Important)

* a flaw was found in the link_path_walk() function in the Linux kernel. Using the file descriptor returned by the open() function with the O_NOFOLLOW flag on a subordinate NFS-mounted file system, could result in a NULL pointer dereference, causing a denial of service or privilege escalation. (CVE-2010-1088, Moderate)

* a missing permission check was found in the gfs2_set_flags() function in the Linux kernel GFS2 implementation. A local user could use this flaw to change certain file attributes of files, on a GFS2 file system, that they do not own. (CVE-2010-1641, Low)

Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting CVE-2010-1641.

This update also fixes several bugs. Documentation for these bug fixes will be available shortly from http://www.redhat.com/docs/en-US/errata/RHSA-2010-0504/Kernel_Security
_Update/ index.html

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.48 fixing various bugs and security issues.

CVE-2010-1641: The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request.

CVE-2010-1087: The nfs_wait_on_request function in fs/nfs/pagelist.c in the Linux kernel allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible. 

CVE-2010-1643: mm/shmem.c in the Linux kernel, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors.

CVE-2010-1437: Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.

CVE-2010-1446: arch/powerpc/mm/fsl_booke_mmu.c in KGDB in the Linux kernel, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl booke.

CVE-2010-1162: The release_one_tty function in drivers/char/tty_io.c in the Linux kernel omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.

CVE-2009-4537: drivers/net/r8169.c in the r8169 driver in the Linux kernel does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-377:12 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2010-0291     The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service     (panic) by calling the (1) mmap or (2) mremap function, aka the 'do_mremap() mess' or 'mremap/mmap mess.'     CVE-2010-0622     The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly     handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause     a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification     of the futex value from user space.
    CVE-2010-1087     The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows     attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an     operation that is not interruptible.
    CVE-2010-1088     fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount 'symlinks,' which     allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.
    CVE-2010-1173     The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier,     when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an     SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.
    CVE-2010-1187     The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through     2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by     sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference.
    CVE-2010-1436     gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota     struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic)     via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file     system to a gfs2 file system.
    CVE-2010-1437     Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel     2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system     crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead     keyring that is undergoing deletion by the key_cleanup function.
    CVE-2010-1641     The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify     the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS     ioctl request.
    Fixed bugs:
    acpi
    - warn on hot-add of memory exceeding 4G boundary
    - fix WARN on unregister in power meter driver     block
    - cfq-iosched: fix IOPRIO_CLASS_IDLE accounting
    - cfq-iosched: async queue allocation per priority
    - cfq-iosched: fix async queue behaviour
    - cfq-iosched: propagate down request sync flag
    - introduce the rq_is_sync macro     fs
    - remove unneccessary f_ep_lock from fasync_helper     misc
    - add atomic64_cmpxcgh to x86_64 include files     mm
    - fix hugepage corruption using vm.drop_caches
    - clear page errors when issuing a fresh read of page     net
    - e1000: fix WoL init when WoL disabled in EEPROM
    - tg3: fix INTx fallback when MSI fails
    - sched: fix SFQ qdisc crash w/limit of 2 packets
    - bonding: fix broken multicast with round-robin mode
    - cnic: Fix crash during bnx2x MTU change
    - bxn2x: add dynamic lro disable support
    - sctp: file must be valid before setting timeout
    - e1000/e1000e: implement simple interrupt moderation
    - neigh: fix state transitions via Netlink request
    - tg3: fix panic in tg3_interrupt
    - cnic: fix bnx2x panic w/multiple interfaces enabled     nfs
    - revert retcode check in nfs_revalidate_mapping()
    - don't unhash dentry in nfs_lookup_revalidate     virt
    - don't compute pvclock adjustments if we trust tsc
    - add a global synchronization point for pvclock
    - enable pvclock flags in vcpu_time_info structure     virtio
    - fix GFP flags passed by virtio balloon driver     x86
    - grab atomic64 types from upstream     x86_64
    - fix time drift due to faulty lost tick tracking     xen
    - set hypervisor present CPUID bit

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fixes :

  - a NULL pointer dereference flaw was found in the Linux     kernel NFSv4 implementation. Several of the NFSv4 file     locking functions failed to check whether a file had     been opened on the server before performing locking     operations on it. A local, unprivileged user on a system     with an NFSv4 share mounted could possibly use this flaw     to cause a kernel panic (denial of service) or escalate     their privileges. (CVE-2009-3726, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local, unprivileged user     could use this flaw to cause a kernel panic (denial of     service) or escalate their privileges. (CVE-2010-1437,     Important)

Red Hat would like to thank Simon Vallet for responsibly reporting CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173.

Bug fixes :

  - RHBA-2007:0791 introduced a regression in the Journaling     Block Device (JBD). Under certain circumstances,     removing a large file (such as 300 MB or more) did not     result in inactive memory being freed, leading to the     system having a large amount of inactive memory. Now,     the memory is correctly freed. (BZ#589155)

  - the timer_interrupt() routine did not scale lost real     ticks to logical ticks correctly, possibly causing time     drift for 64-bit Scientific Linux 4 KVM (Kernel-based     Virtual Machine) guests that were booted with the     'divider=x' kernel parameter set to a value greater than     1. 'warning: many lost ticks' messages may have been     logged on the affected guest systems. (BZ#590551)

  - a bug could have prevented NFSv3 clients from having the     most up-to-date file attributes for files on a given     NFSv3 file system. In cases where a file type changed,     such as if a file was removed and replaced with a     directory of the same name, the NFSv3 client may not     have noticed this change until stat(2) was called (for     example, by running 'ls -l'). (BZ#596372)

  - RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X     subsystem. These could have caused a system deadlock on     some systems where the BIOS set the default Maximum     Memory Read Byte Count (MMRBC) to 4096, and that also     use the Intel PRO/1000 Linux driver, e1000. Errors such     as 'e1000: eth[x]: e1000_clean_tx_irq: Detected Tx Unit     Hang' were logged. (BZ#596374)

  - an out of memory condition in a KVM guest, using the     virtio-net network driver and also under heavy network     stress, could have resulted in that guest being unable     to receive network traffic. Users had to manually remove     and re-add the virtio_net module and restart the network     service before networking worked as expected. Such     memory conditions no longer prevent KVM guests receiving     network traffic. (BZ#597310)

  - when an SFQ qdisc that limited the queue size to two     packets was added to a network interface, sending     traffic through that interface resulted in a kernel     crash. Such a qdisc no longer results in a kernel crash.
    (BZ#597312)

  - when an NFS client opened a file with the O_TRUNC flag     set, it received a valid stateid, but did not use that     stateid to perform the SETATTR call. Such cases were     rejected by Red Hat Enterprise Linux 4 NFS servers with     an 'NFS4ERR_BAD_STATEID' error, possibly preventing some     NFS clients from writing files to an NFS file system.
    (BZ#597314)

The system must be rebooted for this update to take effect.

a. Service Console OS update for COS kernel

   This patch updates the service console kernel to fix multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0415, CVE-2010-0307,    CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1437, and    CVE-2010-1088 to these issues.

b. Likewise package updates

   Updates to the likewisekrb5, likewiseopenldap, likewiseopen,    and pamkrb5 packages address several security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-0844, CVE-2009-0845,    CVE-2009-0846, CVE-2009-4212, and CVE-2010-1321 to these issues.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
47870	RHEL 5 : kernel (RHSA-2010:0504)	Nessus	Red Hat Local Security Checks	2010/7/28	2021/1/14	high
47774	openSUSE Security Update : kernel (openSUSE-SU-2010:0397-1)	Nessus	SuSE Local Security Checks	2010/7/21	2021/1/14	high
291412	MiracleLinux 3 : kernel-2.6.18-194.3.AXS3 (AXSA:2010-377:12)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/2/5	high
60802	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
50611	VMSA-2010-0016 : VMware ESXi and ESX third-party updates for Service Console and Likewise components	Nessus	VMware ESX Local Security Checks	2010/11/16	2021/1/6	critical
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	2011/2/14	2022/5/25	high

检测

插件搜索

high

high

high

high

critical

high