Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a system with SELinux enforced was more permissive in allowing local users in the unconfined_t domain to map low memory areas even if the mmap_min_addr restriction was enabled. This could aid in the local exploitation of NULL pointer dereference bugs. (CVE-2009-2695, Important)

* a NULL pointer dereference flaw was found in the eCryptfs implementation in the Linux kernel. A local attacker could use this flaw to cause a local denial of service or escalate their privileges.
(CVE-2009-2908, Important)

* a flaw was found in the NFSv4 implementation. The kernel would do an unnecessary permission check after creating a file. This check would usually fail and leave the file with the permission bits set to random values. Note: This is a server-side only issue. (CVE-2009-3286, Important)

* a NULL pointer dereference flaw was found in each of the following functions in the Linux kernel: pipe_read_open(), pipe_write_open(), and pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could be released by other processes before it is used to update the pipe's reader and writer counters. This could lead to a local denial of service or privilege escalation. (CVE-2009-3547, Important)

* a flaw was found in the Realtek r8169 Ethernet driver in the Linux kernel. pci_unmap_single() presented a memory leak that could lead to IOMMU space exhaustion and a system crash. An attacker on the local network could abuse this flaw by using jumbo frames for large amounts of network traffic. (CVE-2009-3613, Important)

* missing initialization flaws were found in the Linux kernel. Padding data in several core network structures was not initialized properly before being sent to user-space. These flaws could lead to information leaks. (CVE-2009-3228, Moderate)

Bug fixes :

* with network bonding in the 'balance-tlb' or 'balance-alb' mode, the primary setting for the primary slave device was lost when said device was brought down. Bringing the slave back up did not restore the primary setting. (BZ#517971)

* some faulty serial device hardware caused systems running the kernel-xen kernel to take a very long time to boot. (BZ#524153)

* a caching bug in nfs_readdir() may have caused NFS clients to see duplicate files or not see all files in a directory. (BZ#526960)

* the RHSA-2009:1243 update removed the mpt_msi_enable option, preventing certain scripts from running. This update adds the option back. (BZ#526963)

* an iptables rule with the recent module and a hit count value greater than the ip_pkt_list_tot parameter (the default is 20), did not have any effect over packets, as the hit count could not be reached. (BZ#527434)

* a check has been added to the IPv4 code to make sure that rt is not NULL, to help prevent future bugs in functions that call ip_append_data() from being exploitable. (BZ#527436)

* a kernel panic occurred in certain conditions after reconfiguring a tape drive's block size. (BZ#528133)

* when using the Linux Virtual Server (LVS) in a master and backup configuration, and propagating active connections on the master to the backup, the connection timeout value on the backup was hard-coded to 180 seconds, meaning connection information on the backup was soon lost. This could prevent the successful failover of connections. The timeout value can now be set via 'ipvsadm --set'. (BZ#528645)

* a bug in nfs4_do_open_expired() could have caused the reclaimer thread on an NFSv4 client to enter an infinite loop. (BZ#529162)

* MSI interrupts may not have been delivered for r8169 based network cards that have MSI interrupts enabled. This bug only affected certain systems. (BZ#529366)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddpN device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams. (CVE-2009-2903)

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname. (CVE-2009-3547)

The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881. (CVE-2009-3612)

net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket. (CVE-2009-3621)

Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.
(CVE-2009-3638)

The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.
(CVE-2009-3726)

The ip_frag_reasm function in ipv4/ip_fragment.c in Linux kernel 2.6.32-rc8, and possibly earlier versions, calls IP_INC_STATS_BH with an incorrect argument, which allows remote attackers to cause a denial of service (NULL pointer dereference and hang) via long IP packets, possibly related to the ip_defrag function. (CVE-2009-1298)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

a. vMA and Service Console update for newt to 0.52.2-12.el5_4.1

   Newt is a programming library for color text mode, widget based    user interfaces. Newt can be used to add stacked windows, entry    widgets, checkboxes, radio buttons, labels, plain text fields,    scrollbars, etc., to text mode user interfaces.

   A heap-based buffer overflow flaw was found in the way newt    processes content that is to be displayed in a text dialog box.
   A local attacker could issue a specially crafted text dialog box    display request (direct or via a custom application), leading to a    denial of service (application crash) or, potentially, arbitrary    code execution with the privileges of the user running the    application using the newt library.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-2905 to this issue.

b. vMA and Service Console update for vMA package nfs-utils to    1.0.9-42.el5

   The nfs-utils package provides a daemon for the kernel NFS server    and related tools.

   It was discovered that nfs-utils did not use tcp_wrappers    correctly.  Certain hosts access rules defined in '/etc/hosts.allow'    and '/etc/hosts.deny' may not have been honored, possibly allowing    remote attackers to bypass intended access restrictions.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2008-4552 to this issue.

c. vMA and Service Console package glib2 updated to 2.12.3-4.el5_3.1

   GLib is the low-level core library that forms the basis for    projects such as GTK+ and GNOME. It provides data structure    handling for C, portability wrappers, and interfaces for such    runtime functionality as an event loop, threads, dynamic loading,    and an object system.

   Multiple integer overflows in glib/gbase64.c in GLib before 2.20    allow context-dependent attackers to execute arbitrary code via a    long string that is converted either from or to a base64    representation.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2008-4316 to this issue.

d. vMA and Service Console update for openssl to 0.9.8e-12.el5

   SSL is a toolkit implementing SSL v2/v3 and TLS protocols with full-    strength cryptography world-wide.

   Multiple denial of service flaws were discovered in OpenSSL's DTLS    implementation. A remote attacker could use these flaws to cause a    DTLS server to use excessive amounts of memory, or crash on an    invalid memory access or NULL pointer dereference.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-1377, CVE-2009-1378,    CVE-2009-1379, CVE-2009-1386, CVE-2009-1387 to these issues.

   An input validation flaw was found in the handling of the BMPString    and UniversalString ASN1 string types in OpenSSL's    ASN1_STRING_print_ex() function. An attacker could use this flaw to    create a specially crafted X.509 certificate that could cause    applications using the affected function to crash when printing    certificate contents.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0590 to this issue.

e. vMA and Service Console package bind updated to 9.3.6-4.P1.el5_4.1

   It was discovered that BIND was incorrectly caching responses    without performing proper DNSSEC validation, when those responses    were received during the resolution of a recursive client query    that requested DNSSEC records but indicated that checking should be    disabled. A remote attacker could use this flaw to bypass the DNSSEC    validation check and perform a cache poisoning attack if the target    BIND server was receiving such client queries.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-4022 to this issue.

f. vMA and Service Console package expat updated to 1.95.8-8.3.el5_4.2.

   Two buffer over-read flaws were found in the way Expat handled    malformed UTF-8 sequences when processing XML files. A specially-    crafted XML file could cause applications using Expat to fail while    parsing the file.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-3560 and CVE-2009-3720 to these    issues.

g. vMA and Service Console package openssh update to 4.3p2-36.el5_4.2

   A Red Hat specific patch used in the openssh packages as shipped in    Red Hat Enterprise Linux 5.4 (RHSA-2009:1287) loosened certain    ownership requirements for directories used as arguments for the    ChrootDirectory configuration options. A malicious user that also    has or previously had non-chroot shell access to a system could    possibly use this flaw to escalate their privileges and run    commands as any system user.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-2904 to this issue.

h. vMA and Service Console package ntp updated to    ntp-4.2.2p1-9.el5_4.1.i386.rpm

   A flaw was discovered in the way ntpd handled certain malformed NTP    packets. ntpd logged information about all such packets and replied    with an NTP packet that was treated as malformed when received by    another ntpd. A remote attacker could use this flaw to create an NTP    packet reply loop between two ntpd servers through a malformed packet    with a spoofed source IP address and port, causing ntpd on those    servers to use excessive amounts of CPU time and fill disk space with    log messages.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-3563 to this issue.   

i. vMA update for package kernel to 2.6.18-164.9.1.el5

   Updated vMA package kernel addresses the security issues listed    below.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-2849 to the security issue fixed in    kernel 2.6.18-128.2.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-2695, CVE-2009-2908, CVE-2009-3228,    CVE-2009-3286, CVE-2009-3547, CVE-2009-3613 to the security issues    fixed in kernel 2.6.18-128.6.1

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3612, CVE-2009-3620, CVE-2009-3621,    CVE-2009-3726 to the security issues fixed in kernel    2.6.18-128.9.1

j. vMA 4.0 updates for the packages kpartx, libvolume-id,    device-mapper-multipath, fipscheck, dbus, dbus-libs, and ed

   kpartx updated to 0.4.7-23.el5_3.4, libvolume-id updated to    095-14.20.el5 device-mapper-multipath package updated to    0.4.7-23.el5_3.4, fipscheck updated to 1.0.3-1.el5, dbus    updated to 1.1.2-12.el5, dbus-libs updated to 1.1.2-12.el5,    and ed package updated to 0.2-39.el5_2.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2008-3916, CVE-2009-1189 and    CVE-2009-0115 to these issues.

Update to kernel 2.6.27.38:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.38

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.39 fixing various bugs and security issues.

The following security issues have been fixed :

  - A race condition during pipe open could be used by local     attackers to cause a denial of service. (Due to     mmap_min_addr protection enabled by default, code     execution is not possible.). (CVE-2009-3547)

  - On x86_64 systems a information leak of high register     contents (upper 32bit) was fixed. (CVE-2009-2910)

  - Memory leak in the appletalk subsystem in the Linux     kernel when the appletalk and ipddp modules are loaded     but the ipddp'N' device is not found, allows remote     attackers to cause a denial of service (memory     consumption) via IP-DDP datagrams. (CVE-2009-2903)

  - net/1/af_unix.c in the Linux kernel allows local users     to cause a denial of service (system hang) by creating     an abstract-namespace AF_UNIX listening socket,     performing a shutdown operation on this socket, and then     performing a series of connect operations to this     socket. (CVE-2009-3621)

  - The tcf_fill_node function in net/sched/cls_api.c in the     netlink subsystem in the Linux kernel 2.6.x before     2.6.32-rc5, and 2.4.37.6 and earlier, does not     initialize a certain tcm__pad2 structure member, which     might allow local users to obtain sensitive information     from kernel memory via unspecified vectors. NOTE: this     issue existed because of an incomplete fix for     CVE-2005-4881. (CVE-2009-3612 / CVE-2005-4881)

  - The ATI Rage 128 (aka r128) driver in the Linux kernel     does not properly verify Concurrent Command Engine (CCE)     state initialization, which allows local users to cause     a denial of service (NULL pointer dereference and system     crash) or possibly gain privileges via unspecified ioctl     calls. (CVE-2009-3620)

  - The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the     NFSv4 client in the Linux kernel allows remote NFS     servers to cause a denial of service (NULL pointer     dereference and panic) by sending a certain response     containing incorrect file attributes, which trigger     attempted use of an open file that lacks NFSv4 state.
    (CVE-2009-3726)

  - Sv4 in the Linux kernel does not properly clean up an     inode when an O_EXCL create fails, which causes files to     be created with insecure settings such as setuid bits,     and possibly allows local users to gain privileges,     related to the execution of the do_open_permission     function even when a create fails. (CVE-2009-3286)

Updated kernel packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* when fput() was called to close a socket, the __scm_destroy() function in the Linux kernel could make indirect recursive calls to itself. This could, potentially, lead to a denial of service issue.
(CVE-2008-5029, Important)

* the sendmsg() function in the Linux kernel did not block during UNIX socket garbage collection. This could, potentially, lead to a local denial of service. (CVE-2008-5300, Important)

* the exit_notify() function in the Linux kernel did not properly reset the exit signal if a process executed a set user ID (setuid) application before exiting. This could allow a local, unprivileged user to elevate their privileges. (CVE-2009-1337, Important)

* a flaw was found in the Intel PRO/1000 network driver in the Linux kernel. Frames with sizes near the MTU of an interface may be split across multiple hardware receive descriptors. Receipt of such a frame could leak through a validation check, leading to a corruption of the length check. A remote attacker could use this flaw to send a specially crafted packet that would cause a denial of service or code execution. (CVE-2009-1385, Important)

* the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a setuid or setgid program was executed. A local, unprivileged user could use this flaw to bypass the mmap_min_addr protection mechanism and perform a NULL pointer dereference attack, or bypass the Address Space Layout Randomization (ASLR) security feature.
(CVE-2009-1895, Important)

* it was discovered that, when executing a new process, the clear_child_tid pointer in the Linux kernel is not cleared. If this pointer points to a writable portion of the memory of the new program, the kernel could corrupt four bytes of memory, possibly leading to a local denial of service or privilege escalation. (CVE-2009-2848, Important)

* missing initialization flaws were found in getname() implementations in the IrDA sockets, AppleTalk DDP protocol, NET/ROM protocol, and ROSE protocol implementations in the Linux kernel. Certain data structures in these getname() implementations were not initialized properly before being copied to user-space. These flaws could lead to an information leak. (CVE-2009-3002, Important)

* a NULL pointer dereference flaw was found in each of the following functions in the Linux kernel: pipe_read_open(), pipe_write_open(), and pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could be released by other processes before it is used to update the pipe's reader and writer counters. This could lead to a local denial of service or privilege escalation. (CVE-2009-3547, Important)

Bug fixes :

* this update adds the mmap_min_addr tunable and restriction checks to help prevent unprivileged users from creating new memory mappings below the minimum address. This can help prevent the exploitation of NULL pointer dereference bugs. Note that mmap_min_addr is set to zero (disabled) by default for backwards compatibility. (BZ#512642)

* a bridge reference count problem in IPv6 has been fixed. (BZ#457010)

* enforce null-termination of user-supplied arguments to setsockopt().
(BZ#505514)

* the gcc flag '-fno-delete-null-pointer-checks' was added to the kernel build options. This prevents gcc from optimizing out NULL pointer checks after the first use of a pointer. NULL pointer bugs are often exploited by attackers. Keeping these checks is a safety measure. (BZ#511185)

* a check has been added to the IPv4 code to make sure that rt is not NULL, to help prevent future bugs in functions that call ip_append_data() from being exploitable. (BZ#520300)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
67068	CentOS 5 : kernel (CESA-2009:1548)	Nessus	CentOS Local Security Checks	2013/6/29	2021/1/4	high
48161	Mandriva Linux Security Advisory : kernel (MDVSA-2009:329)	Nessus	Mandriva Local Security Checks	2010/7/30	2021/1/6	high
44993	VMSA-2010-0004 : ESX Service Console and vMA third-party updates	Nessus	VMware ESX Local Security Checks	2010/3/5	2021/1/6	high
42402	Fedora 10 : kernel-2.6.27.38-170.2.113.fc10 (2009-11038)	Nessus	Fedora Local Security Checks	2009/11/6	2021/1/11	high
42990	SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 1581 / 1588 / 1591)	Nessus	SuSE Local Security Checks	2009/12/3	2021/1/14	high
42360	RHEL 3 : kernel (RHSA-2009:1550)	Nessus	Red Hat Local Security Checks	2009/11/4	2021/1/14	high

检测

插件搜索

high

high

high

high

high

high