This patch updates the SUSE Linux Enterprise Server 9 kernel to fix various security issues and some bugs.

The following security issues were fixed :

  - The hci_uart_tty_open function in the HCI UART driver     (drivers/bluetooth/hci_ldisc.c) in the Linux kernel did     not verify whether the tty has a write operation, which     allowed local users to cause a denial of service (NULL     pointer dereference) via vectors related to the     Bluetooth driver. (CVE-2010-4242)

  - The load_mixer_volumes function in sound/oss/soundcard.c     in the OSS sound subsystem in the Linux kernel     incorrectly expected that a certain name field ends with     a '\0' character, which allowed local users to conduct     buffer overflow attacks and gain privileges, or possibly     obtain sensitive information from kernel memory, via a     SOUND_MIXER_SETLEVELS ioctl call. (CVE-2010-4527)

  - Integer underflow in the irda_getsockopt function in     net/irda/af_irda.c in the Linux kernel on platforms     other than x86 allowed local users to obtain potentially     sensitive information from kernel heap memory via an     IRLMP_ENUMDEVICES getsockopt call. (CVE-2010-4529)

  - The aun_incoming function in net/econet/af_econet.c in     the Linux kernel, when Econet is enabled, allowed remote     attackers to cause a denial of service (NULL pointer     dereference and OOPS) by sending an Acorn Universal     Networking (AUN) packet over UDP. (CVE-2010-4342)

  - fs/jfs/xattr.c in the Linux kernel did not properly     handle a certain legacy format for storage of extended     attributes, which might have allowed local users by     bypass intended xattr namespace restrictions via an     'os2.' substring at the beginning of a name.
    (CVE-2010-2946)

  - Stack-based buffer overflow in the econet_sendmsg     function in net/econet/af_econet.c in the Linux kernel,     when an econet address is configured, allowed local     users to gain privileges by providing a large number of     iovec structures. (CVE-2010-3848)

  - The econet_sendmsg function in net/econet/af_econet.c in     the Linux kernel, when an econet address is configured,     allowed local users to cause a denial of service (NULL     pointer dereference and OOPS) via a sendmsg call that     specifies a NULL value for the remote address field.
    (CVE-2010-3849)

  - The ec_dev_ioctl function in net/econet/af_econet.c in     the Linux kernel does not require the CAP_NET_ADMIN     capability, which allowed local users to bypass intended     access restrictions and configure econet addresses via     an SIOCSIFADDR ioctl call. (CVE-2010-3850)

  - The do_exit function in kernel/exit.c in the Linux     kernel did not properly handle a KERNEL_DS get_fs value,     which allowed local users to bypass intended access_ok     restrictions, overwrite arbitrary kernel memory     locations, and gain privileges by leveraging a (1) BUG,     (2) NULL pointer dereference, or (3) page fault, as     demonstrated by vectors involving the clear_child_tid     feature and the splice system call. (CVE-2010-4258)

  - Multiple integer overflows in the (1) pppol2tp_sendmsg     function in net/l2tp/l2tp_ppp.c, and the (2)     l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the     PPPoL2TP and IPoL2TP implementations in the Linux kernel     allowed local users to cause a denial of service (heap     memory corruption and panic) or possibly gain privileges     via a crafted sendto call. (CVE-2010-4160)

  - Integer overflow in the ioc_general function in     drivers/scsi/gdth.c in the Linux kernel on 64-bit     platforms allowed local users to cause a denial of     service (memory corruption) or possibly have unspecified     other impact via a large argument in an ioctl call.
    (CVE-2010-4157)

  - Multiple integer underflows in the x25_parse_facilities     function in net/x25/x25_facilities.c in the Linux kernel     allowed remote attackers to cause a denial of service     (system crash) via malformed X.25 (1) X25_FAC_CLASS_A,     (2) X25_FAC_CLASS_B, (3) X25_FAC_CLASS_C, or (4)     X25_FAC_CLASS_D facility data, a different vulnerability     than CVE-2010-3873. (CVE-2010-4164)

  - The sk_run_filter function in net/core/filter.c in the     Linux kernel did not check whether a certain memory     location has been initialized before executing a (1)     BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which     allowed local users to obtain potentially sensitive     information from kernel stack memory via a crafted     socket filter. (CVE-2010-4158)

  - Multiple integer overflows in the snd_ctl_new function     in sound/core/control.c in the Linux kernel allowed     local users to cause a denial of service (heap memory     corruption) or possibly have unspecified other impact     via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2)     SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. (CVE-2010-3442)

  - The snd_hdspm_hwdep_ioctl function in     sound/pci/rme9652/hdspm.c in the Linux kernel did not     initialize a certain structure, which allowed local     users to obtain potentially sensitive information from     kernel stack memory via an     SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
    (CVE-2010-4081)

  - The ipc subsystem in the Linux kernel did not initialize     certain structures, which allowed local users to obtain     potentially sensitive information from kernel stack     memory via vectors related to the (1) compat_sys_semctl,     (2) compat_sys_msgctl, and (3) compat_sys_shmctl     functions in ipc/compat.c; and the (4)     compat_sys_mq_open and (5) compat_sys_mq_getsetattr     functions in ipc/compat_mq.c. (CVE-2010-4073)

  - The copy_shmid_to_user function in ipc/shm.c in the     Linux kernel did not initialize a certain structure,     which allowed local users to obtain potentially     sensitive information from kernel stack memory via     vectors related to the shmctl system call and the 'old     shm interface.'. (CVE-2010-4072)

  - The copy_semid_to_user function in ipc/sem.c in the     Linux kernel did not initialize a certain structure,     which allowed local users to obtain potentially     sensitive information from kernel stack memory via a (1)     IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT     command in a semctl system call. (CVE-2010-4083)

  - Integer overflow in the do_io_submit function in     fs/aio.c in the Linux kernel allowed local users to     cause a denial of service or possibly have unspecified     other impact via crafted use of the io_submit system     call. (CVE-2010-3067)

  - Multiple integer signedness errors in net/rose/af_rose.c     in the Linux kernel allowed local users to cause a     denial of service (heap memory corruption) or possibly     have unspecified other impact via a rose_getname     function call, related to the rose_bind and rose_connect     functions. (CVE-2010-3310)

Fix possible local privilege escalation on x86_64 systems (CVE-2010-3081, CVE-2010-3301).

  - NOTE: All users should update because of this bug. Fix     denial of service attack with large argument lists. Add     support for perl and python scripting to perf. Nouveau     video driver fixes :

  - fix oops in acpi edid support

    - disable acceleration on nva3/nva5/nva8

    - misc fixes from upstream + NVAF support Add support       for the eject key on the Dell Studio 1555 fix       rcu_dereference_check warning Restore appleir driver       that got lost in the 2.6.35 rebase. Fix DMA in       via-velocity network driver.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
51953	SuSE9 Security Update : the Linux kernel (YOU Patch Number 12672)	Nessus	SuSE Local Security Checks	2011/2/11	2021/1/14	high
49635	Fedora 14 : kernel-2.6.35.4-28.fc14 (2010-14832)	Nessus	Fedora Local Security Checks	2010/9/22	2021/1/11	high

检测

插件搜索

high

high