Updated kernel packages that fix multiple security issues, several bugs, and add an enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in sctp_packet_config() in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could use this flaw to cause a denial of service.
(CVE-2010-3432, Important)

* A missing integer overflow check was found in snd_ctl_new() in the Linux kernel's sound subsystem. A local, unprivileged user on a 32-bit system could use this flaw to cause a denial of service or escalate their privileges. (CVE-2010-3442, Important)

* A heap overflow flaw in the Linux kernel's Transparent Inter-Process Communication protocol (TIPC) implementation could allow a local, unprivileged user to escalate their privileges. (CVE-2010-3859, Important)

* An integer overflow flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges. (CVE-2010-3865, Important)

* A flaw was found in the Xenbus code for the unified block-device I/O interface back end. A privileged guest user could use this flaw to cause a denial of service on the host system running the Xen hypervisor. (CVE-2010-3699, Moderate)

* Missing sanity checks were found in setup_arg_pages() in the Linux kernel. When making the size of the argument and environment area on the stack very large, it could trigger a BUG_ON(), resulting in a local denial of service. (CVE-2010-3858, Moderate)

* A flaw was found in inet_csk_diag_dump() in the Linux kernel's module for monitoring the sockets of INET transport protocols. By sending a netlink message with certain bytecode, a local, unprivileged user could cause a denial of service. (CVE-2010-3880, Moderate)

* Missing sanity checks were found in gdth_ioctl_alloc() in the gdth driver in the Linux kernel. A local user with access to '/dev/gdth' on a 64-bit system could use this flaw to cause a denial of service or escalate their privileges. (CVE-2010-4157, Moderate)

* The fix for Red Hat Bugzilla bug 484590 as provided in RHSA-2009:1243 introduced a regression. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-4161, Moderate)

* A NULL pointer dereference flaw was found in the Bluetooth HCI UART driver in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-4242, Moderate)

* It was found that a malicious guest running on the Xen hypervisor could place invalid data in the memory that the guest shared with the blkback and blktap back-end drivers, resulting in a denial of service on the host system. (CVE-2010-4247, Moderate)

* A flaw was found in the Linux kernel's CPU time clocks implementation for the POSIX clock interface. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-4248, Moderate)

* Missing initialization flaws in the Linux kernel could lead to information leaks. (CVE-2010-3876, CVE-2010-4083, Low)

Red Hat would like to thank Dan Rosenberg for reporting CVE-2010-3442, CVE-2010-4161, and CVE-2010-4083; Thomas Pollet for reporting CVE-2010-3865; Brad Spengler for reporting CVE-2010-3858; Nelson Elhage for reporting CVE-2010-3880; Alan Cox for reporting CVE-2010-4242; and Vasiliy Kulikov for reporting CVE-2010-3876.

This update also fixes several bugs and adds an enhancement.
Documentation for the bug fixes and the enhancement will be available shortly from the Technical Notes document, linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

This patch updates the SUSE Linux Enterprise Server 9 kernel to fix various security issues and some bugs.

The following security issues were fixed :

  - The hci_uart_tty_open function in the HCI UART driver     (drivers/bluetooth/hci_ldisc.c) in the Linux kernel did     not verify whether the tty has a write operation, which     allowed local users to cause a denial of service (NULL     pointer dereference) via vectors related to the     Bluetooth driver. (CVE-2010-4242)

  - The load_mixer_volumes function in sound/oss/soundcard.c     in the OSS sound subsystem in the Linux kernel     incorrectly expected that a certain name field ends with     a '\0' character, which allowed local users to conduct     buffer overflow attacks and gain privileges, or possibly     obtain sensitive information from kernel memory, via a     SOUND_MIXER_SETLEVELS ioctl call. (CVE-2010-4527)

  - Integer underflow in the irda_getsockopt function in     net/irda/af_irda.c in the Linux kernel on platforms     other than x86 allowed local users to obtain potentially     sensitive information from kernel heap memory via an     IRLMP_ENUMDEVICES getsockopt call. (CVE-2010-4529)

  - The aun_incoming function in net/econet/af_econet.c in     the Linux kernel, when Econet is enabled, allowed remote     attackers to cause a denial of service (NULL pointer     dereference and OOPS) by sending an Acorn Universal     Networking (AUN) packet over UDP. (CVE-2010-4342)

  - fs/jfs/xattr.c in the Linux kernel did not properly     handle a certain legacy format for storage of extended     attributes, which might have allowed local users by     bypass intended xattr namespace restrictions via an     'os2.' substring at the beginning of a name.
    (CVE-2010-2946)

  - Stack-based buffer overflow in the econet_sendmsg     function in net/econet/af_econet.c in the Linux kernel,     when an econet address is configured, allowed local     users to gain privileges by providing a large number of     iovec structures. (CVE-2010-3848)

  - The econet_sendmsg function in net/econet/af_econet.c in     the Linux kernel, when an econet address is configured,     allowed local users to cause a denial of service (NULL     pointer dereference and OOPS) via a sendmsg call that     specifies a NULL value for the remote address field.
    (CVE-2010-3849)

  - The ec_dev_ioctl function in net/econet/af_econet.c in     the Linux kernel does not require the CAP_NET_ADMIN     capability, which allowed local users to bypass intended     access restrictions and configure econet addresses via     an SIOCSIFADDR ioctl call. (CVE-2010-3850)

  - The do_exit function in kernel/exit.c in the Linux     kernel did not properly handle a KERNEL_DS get_fs value,     which allowed local users to bypass intended access_ok     restrictions, overwrite arbitrary kernel memory     locations, and gain privileges by leveraging a (1) BUG,     (2) NULL pointer dereference, or (3) page fault, as     demonstrated by vectors involving the clear_child_tid     feature and the splice system call. (CVE-2010-4258)

  - Multiple integer overflows in the (1) pppol2tp_sendmsg     function in net/l2tp/l2tp_ppp.c, and the (2)     l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the     PPPoL2TP and IPoL2TP implementations in the Linux kernel     allowed local users to cause a denial of service (heap     memory corruption and panic) or possibly gain privileges     via a crafted sendto call. (CVE-2010-4160)

  - Integer overflow in the ioc_general function in     drivers/scsi/gdth.c in the Linux kernel on 64-bit     platforms allowed local users to cause a denial of     service (memory corruption) or possibly have unspecified     other impact via a large argument in an ioctl call.
    (CVE-2010-4157)

  - Multiple integer underflows in the x25_parse_facilities     function in net/x25/x25_facilities.c in the Linux kernel     allowed remote attackers to cause a denial of service     (system crash) via malformed X.25 (1) X25_FAC_CLASS_A,     (2) X25_FAC_CLASS_B, (3) X25_FAC_CLASS_C, or (4)     X25_FAC_CLASS_D facility data, a different vulnerability     than CVE-2010-3873. (CVE-2010-4164)

  - The sk_run_filter function in net/core/filter.c in the     Linux kernel did not check whether a certain memory     location has been initialized before executing a (1)     BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which     allowed local users to obtain potentially sensitive     information from kernel stack memory via a crafted     socket filter. (CVE-2010-4158)

  - Multiple integer overflows in the snd_ctl_new function     in sound/core/control.c in the Linux kernel allowed     local users to cause a denial of service (heap memory     corruption) or possibly have unspecified other impact     via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2)     SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. (CVE-2010-3442)

  - The snd_hdspm_hwdep_ioctl function in     sound/pci/rme9652/hdspm.c in the Linux kernel did not     initialize a certain structure, which allowed local     users to obtain potentially sensitive information from     kernel stack memory via an     SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
    (CVE-2010-4081)

  - The ipc subsystem in the Linux kernel did not initialize     certain structures, which allowed local users to obtain     potentially sensitive information from kernel stack     memory via vectors related to the (1) compat_sys_semctl,     (2) compat_sys_msgctl, and (3) compat_sys_shmctl     functions in ipc/compat.c; and the (4)     compat_sys_mq_open and (5) compat_sys_mq_getsetattr     functions in ipc/compat_mq.c. (CVE-2010-4073)

  - The copy_shmid_to_user function in ipc/shm.c in the     Linux kernel did not initialize a certain structure,     which allowed local users to obtain potentially     sensitive information from kernel stack memory via     vectors related to the shmctl system call and the 'old     shm interface.'. (CVE-2010-4072)

  - The copy_semid_to_user function in ipc/sem.c in the     Linux kernel did not initialize a certain structure,     which allowed local users to obtain potentially     sensitive information from kernel stack memory via a (1)     IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT     command in a semctl system call. (CVE-2010-4083)

  - Integer overflow in the do_io_submit function in     fs/aio.c in the Linux kernel allowed local users to     cause a denial of service or possibly have unspecified     other impact via crafted use of the io_submit system     call. (CVE-2010-3067)

  - Multiple integer signedness errors in net/rose/af_rose.c     in the Linux kernel allowed local users to cause a     denial of service (heap memory corruption) or possibly     have unspecified other impact via a rose_getname     function call, related to the rose_bind and rose_connect     functions. (CVE-2010-3310)

Fixes multiple security bugs. All users should update to this version.

Also fixes :

  - Stall on boot on some systems with TPM devices.
    (RHBZ#530393)

    - Hard lockups with Radeon RV350 devices. (RHBZ#631310)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0162 advisory.

  - kernel: tipc: heap overflow in tipc_msg_build() (CVE-2010-3859)

  - kernel: net/packet/af_packet.c: reading uninitialized stack memory (CVE-2010-3876)

  - kernel: ipc/shm.c: reading uninitialized stack memory (CVE-2010-4072)

  - kernel: ipc/compat*.c: reading uninitialized stack memory (CVE-2010-4073)

  - kernel: drivers/serial/serial_core.c: reading uninitialized stack memory (CVE-2010-4075)

  - kernel: drivers/sound/pci/rme9652/hdsp.c: reading uninitialized stack memory (CVE-2010-4080)

  - kernel: ipc/sem.c: reading uninitialized stack memory (CVE-2010-4083)

  - kernel: gdth: integer overflow in ioc_general() (CVE-2010-4157)

  - kernel: socket filters infoleak (CVE-2010-4158)

  - kernel: missing tty ops write function presence check in hci_uart_tty_open() (CVE-2010-4242)

  - kernel: unix socket local dos (CVE-2010-4249)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0004 advisory.

    - [virt] xen: fix netback hotplug regression in xenbus fix (Laszlo Ersek) [636412 635999] {CVE-2010-3699}
    - [misc] posix-cpu-timers: workaround for mt exec problems (Oleg Nesterov) [656265 656266] {CVE-2010-4248}
    - [fs] setup_arg_pages: diagnose excessive argument size (Oleg Nesterov) [645226 645227] {CVE-2010-3858}
    - [net] inet_diag: make sure we run audited bytecode (Jiri Pirko) [651266 651267] {CVE-2010-3880}
    - [net] limit sendto/recvfrom/iovec total length to INT_MAX (Jiri Pirko) [645871 645872] {CVE-2010-3859}
    - [bluetooth] hci_ldisc: fix missing NULL check (Jarod Wilson) [655664 655666] {CVE-2010-4242}
    - [virt] xen: add bounds req-process loop in blkback/blktap (Laszlo Ersek) [656208 654546] {CVE-2010-4247}
    - [virt] xen: don't leak dev refs on bad xenbus transitions (Laszlo Ersek) [636412 635999] {CVE-2010-3699}
    - [net] rds: fix rds_iovec page count overflow (Jiri Pirko) [647421 647422] {CVE-2010-3865}
    - [net] fix deadlock in sock_queue_rcv_skb (Danny Feng) [652536 652537] {CVE-2010-4161}
    - [net] packet: fix information leak to userland (Jiri Pirko) [649897 649898] {CVE-2010-3876}
    - [ipc] sys_semctl: fix kernel stack leakage (Danny Feng) [648721 648722] {CVE-2010-4083}
    - [net] sctp: do not reset packet during sctp_packet_config (Jiri Pirko) [637866 637867] {CVE-2010-3432}
    - [scsi] gdth: prevent integer overflow in ioc_general (Frantisek Hrbata) [651175 651176] {CVE-2010-4157}
    - [sound] core: prevent heap corruption in snd_ctl_new (Jerome Marchand) [638483 638484] {CVE-2010-3442}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE 11.3 kernel was updated to fix various bugs and security issues.

Following security issues have been fixed: CVE-2010-4347: A local user could inject ACPI code into the kernel via the world-writable 'custom_debug' file, allowing local privilege escalation.

CVE-2010-4258: A local attacker could use a Oops (kernel crash) caused by other flaws to write a 0 byte to a attacker controlled address in the kernel. This could lead to privilege escalation together with other issues.

CVE-2010-4157: A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc could lead to memory corruption in the GDTH driver.

CVE-2010-4165: The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel did not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.

CVE-2010-4164: A remote (or local) attacker communicating over X.25 could cause a kernel panic by attempting to negotiate malformed facilities.

CVE-2010-4175: A local attacker could cause memory overruns in the RDS protocol stack, potentially crashing the kernel. So far it is considered not to be exploitable.

CVE-2010-4169: Use-after-free vulnerability in mm/mprotect.c in the Linux kernel allwed local users to cause a denial of service via vectors involving an mprotect system call.

CVE-2010-3874: A minor heap overflow in the CAN network module was fixed. Due to nature of the memory allocator it is likely not exploitable.

CVE-2010-4158: A memory information leak in berkely packet filter rules allowed local attackers to read uninitialized memory of the kernel stack.

CVE-2010-4162: A local denial of service in the blockdevice layer was fixed.

CVE-2010-4163: By submitting certain I/O requests with 0 length, a local user could have caused a kernel panic.

CVE-2010-0435: The Hypervisor in KVM 83, when the Intel VT-x extension is enabled, allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via vectors related to instruction emulation.

CVE-2010-3861: The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel did not initialize a certain block of heap memory, which allowed local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value.

CVE-2010-3442: Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.

CVE-2010-3437: A range checking overflow in pktcdvd ioctl was fixed.

CVE-2010-4078: The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call.

CVE-2010-4080: The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.

CVE-2010-4081: The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.

CVE-2010-4082: The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call.

CVE-2010-4073: The ipc subsystem in the Linux kernel did not initialize certain structures, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c.

CVE-2010-4072: The copy_shmid_to_user function in ipc/shm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the 'old shm interface.'

CVE-2010-4083: The copy_semid_to_user function in ipc/sem.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call.

CVE-2010-3432: The sctp_packet_config function in net/sctp/output.c in the Linux kernel performed extraneous initializations of packet data structures, which allowed remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic.

CVE-2010-3067: Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.

CVE-2010-3865: A iovec integer overflow in RDS sockets was fixed which could lead to local attackers gaining kernel privileges.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
51426	CentOS 5 : kernel (CESA-2011:0004)	Nessus	CentOS Local Security Checks	2011/1/7	2021/1/4	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	high
51953	SuSE9 Security Update : the Linux kernel (YOU Patch Number 12672)	Nessus	SuSE Local Security Checks	2011/2/11	2021/1/14	high
51417	RHEL 5 : kernel (RHSA-2011:0004)	Nessus	Red Hat Local Security Checks	2011/1/5	2021/1/14	high
51374	Fedora 13 : kernel-2.6.34.7-66.fc13 (2010-18983)	Nessus	Fedora Local Security Checks	2010/12/26	2021/1/11	high
51569	RHEL 4 : kernel (RHSA-2011:0162)	Nessus	Red Hat Local Security Checks	2011/1/19	2024/4/21	medium
68176	Oracle Linux 5 : kernel (ELSA-2011-0004)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
75553	openSUSE Security Update : kernel (openSUSE-SU-2011:0004-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high

检测

插件搜索

high

high

high

high

high

medium

high

high