Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 11.4 kernel was updated to fix bugs and security issues.

Following security issues have been fixed: CVE-2011-4604: If root does read() on a specific socket, it's possible to corrupt (kernel) memory over network, with an ICMP packet, if the B.A.T.M.A.N. mesh protocol is used.

CVE-2011-2699: Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.

CVE-2011-1173: A kernel information leak via ip6_tables was fixed.

CVE-2011-1172: A kernel information leak via ip6_tables netfilter was fixed.

CVE-2011-1171: A kernel information leak via ip_tables was fixed.

CVE-2011-1170: A kernel information leak via arp_tables was fixed.

CVE-2011-1080: A kernel information leak via netfilter was fixed.

CVE-2011-2213: The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel did not properly audit INET_DIAG bytecode, which allowed local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880.

CVE-2011-2534: Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel might have allowed local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '0' character.

CVE-2011-1770: Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel allowed remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggered a buffer over-read.

CVE-2011-2723: The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel, when Generic Receive Offload (GRO) is enabled, reset certain fields in incorrect situations, which allowed remote attackers to cause a denial of service (system crash) via crafted network traffic.

CVE-2011-2898: A kernel information leak in the AF_PACKET protocol was fixed which might have allowed local attackers to read kernel memory.

CVE-2011-4087: A local denial of service when using bridged networking via a flood ping was fixed.

CVE-2011-2203: A NULL ptr dereference on mounting corrupt hfs filesystems was fixed which could be used by local attackers to crash the kernel.

CVE-2011-4081: Using the crypto interface a local user could Oops the kernel by writing to a AF_ALG socket.

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel.

This update fixes the following security issues :

  - X.25 remote DoS. (CVE-2010-3873). (bnc#651219)

  - X.25 remote Dos. (CVE-2010-4164). (bnc#653260)

  - 1 socket local DoS. (CVE-2010-4249). (bnc#655696)

  - ebtables infoleak. (CVE-2011-1080). (bnc#676602)

  - netfilter: arp_tables infoleak to userspace.
    (CVE-2011-1170). (bnc#681180)

  - netfilter: ip_tables infoleak to userspace.
    (CVE-2011-1171). (bnc#681181)

  - netfilter: ip6_tables infoleak to userspace.
    (CVE-2011-1172). (bnc#681185)

  - econet 4 byte infoleak. (CVE-2011-1173). (bnc#681186)

  - hfs NULL pointer dereference. (CVE-2011-2203).
    (bnc#699709)

  - inet_diag infinite loop. (CVE-2011-2213). (bnc#700879)

  - netfilter: ipt_CLUSTERIP buffer overflow.
    (CVE-2011-2534). (bnc#702037)

  - ipv6: make fragment identifications less predictable.
    (CVE-2011-2699). (bnc#707288)

  - clock_gettime() panic. (CVE-2011-3209). (bnc#726064)

  - qdisc NULL dereference (CVE-2011-2525) This update also     fixes the following non-security issues:. (bnc#735612)

  - New timesource for VMware platform. (bnc#671124)

  - usblp crashes after the printer is unplugged for the     second time. (bnc#673343)

  - Data corruption with mpt2sas driver. (bnc#704253)

  - NIC Bond no longer works when booting the XEN kernel.
    (bnc#716437)

  - 'reboot=b' kernel command line hangs system on reboot.
    (bnc#721267)

  - kernel panic at iscsi_xmitwork function. (bnc#721351)

  - NFS supplementary group permissions. (bnc#725878)

  - IBM LTC System z Maintenance Kernel Patches (#59).
    (bnc#726843)

  - NFS slowness. (bnc#727597)

  - IBM LTC System z maintenance kernel patches (#60).
    (bnc#728341)

  - propagate MAC-address to VLAN-interface. (bnc#729117)

  - ipmi deadlock in start_next_msg. (bnc#730749)

  - ext3 filesystem corruption after crash. (bnc#731770)

  - IBM LTC System z maintenance kernel patches (#61).
    (bnc#732375)

  - hangs when offlining a CPU core. (bnc#733407)

The SUSE Linux Enterprise 11 Service Pack 1 kernel has been updated to version 2.6.32.49 and fixes various bugs and security issues.

  - The TCP/IP initial sequence number generation     effectively only used 24 bits of 32 to generate     randomness, making a brute-force man-in-the-middle     attack on TCP/IP connections feasible. The generator was     changed to use full 32bit randomness. (CVE-2011-3188)

  - Fernando Gont discovered that the IPv6 stack used     predictable fragment identification numbers. A remote     attacker could exploit this to exhaust network     resources, leading to a denial of service.
    (CVE-2011-2699)

  - A NULL ptr dereference on mounting corrupt hfs     filesystems was fixed which could be used by local     attackers to crash the kernel. (CVE-2011-2203)

  - Added a kernel option to ensure ecryptfs is mounting     only on paths belonging to the current ui, which would     have allowed local attackers to potentially gain     privileges via symlink attacks. (CVE-2011-1833)

  - The Generic Receive Offload (GRO) implementation in the     Linux kernel allowed remote attackers to cause a denial     of service via crafted VLAN packets that are processed     by the napi_reuse_skb function, leading to (1) a memory     leak or (2) memory corruption, a different vulnerability     than CVE-2011-1478. (CVE-2011-1576)

  - A name overflow in the hfs filesystem was fixed, where     mounting a corrupted hfs filesystem could lead to a     stack overflow and code execution in the kernel. This     requires a local attacker to be able to mount hfs     filesystems. (CVE-2011-4330)

  - A bug was found in the way headroom check was performed     in udp6_ufo_fragment() function. A remote attacker could     use this flaw to crash the system. (CVE-2011-4326)

The following non-security bugs have been fixed :

  - ALSA: hda - Fix S3/S4 problem on machines with VREF-pin     mute-LED. (bnc#732535)

  - patches.xen/xen-pcpu-hotplug: Fix a double kfree().

  - ixgbe: fix bug with vlan strip in promsic mode     (bnc#687049, fate#311821).

  - ixgbe: fix panic when shutting down system with WoL     enabled.

  - fnic: Allow users to modify dev_loss_tmo setting.
    (bnc#719786)

  - x86, intel: Do not mark sched_clock() as stable.
    (bnc#725709)

  - ALSA: hda - Keep vref-LED during power-saving on IDT     codecs. (bnc#731981)

  - cifs: Assume passwords are encoded according to     iocharset. (bnc#731035)

  - scsi_dh: Check queuedata pointer before proceeding.
    (bnc#714744)

  - netback: use correct index for invalidation in     netbk_tx_check_mop().

  - ACPI video: introduce module parameter     video.use_bios_initial_backlight. (bnc#731229)

  - SUNRPC: prevent task_cleanup running on freed xprt.
    (bnc#709671)

  - add device entry for Broadcom Valentine combo card.
    (bnc#722429)

  - quota: Fix WARN_ON in lookup_one_len. (bnc#728626)

  - Update Xen patches to 2.6.32.48.

  - pv-on-hvm/kexec: add xs_reset_watches to shutdown     watches from old kernel. (bnc#694863)

  - x86: undo_limit_pages() must reset page count.

  - mm/vmstat.c: cache align vm_stat. (bnc#729721)

  - s390/ccwgroup: fix uevent vs dev attrs race     (bnc#659101,LTC#69028).

  - Warn on pagecache limit usage (FATE309111).

  - SCSI: st: fix race in st_scsi_execute_end. (bnc#720536)

  - ACPI: introduce 'acpi_rsdp=' parameter for kdump.
    (bnc#717263)

  - elousb: Limit the workaround warning to one per error,     control workaround activity. (bnc#719916)

  - SCSI: libiscsi: reset cmd timer if cmds are making     progress. (bnc#691440)

  - SCSI: fix crash in scsi_dispatch_cmd(). (bnc#724989)

  - NFS/sunrpc: do not use a credential with extra groups.
    (bnc#725878)

  - s390/qdio: EQBS retry after CCQ 96     (bnc#725453,LTC#76117).

  - fcoe: Reduce max_sectors to 1024. (bnc#695898)

  - apparmor: return -ENOENT when there is no profile for a     hat. (bnc#725502)

  - sched, cgroups: disallow attaching kthreadd.
    (bnc#721840)

  - nfs: Check validity of cl_rpcclient in     nfs_server_list_show. (bnc#717884)

  - x86, vt-d: enable x2apic opt out (disabling x2apic     through BIOS flag) (bnc#701183, fate#311989).

  - block: Free queue resources at blk_release_queue().
    (bnc#723815)

  - ALSA: hda - Add post_suspend patch ops. (bnc#724800)

  - ALSA: hda - Allow codec-specific set_power_state ops.
    (bnc#724800)

  - ALSA: hda - Add support for vref-out based mute LED     control on IDT codecs. (bnc#724800)

  - scsi_dh_rdac : Add definitions for different RDAC     operating modes. (bnc#724365)

  - scsi_dh_rdac : Detect the different RDAC operating     modes. (bnc#724365)

  - scsi_dh_rdac : decide whether to send mode select based     on operating mode. (bnc#724365)

  - scsi_dh_rdac: Use WWID from C8 page instead of Subsystem     id from C4 page to identify storage. (bnc#724365)

  - vlan: Match underlying dev carrier on vlan add.
    (bnc#722504)

  - scsi_lib: pause between error retries. (bnc#675127)

  - xfs: use KM_NOFS for allocations during attribute list     operations. (bnc#721830)

  - bootsplash: Do not crash when no fb is set. (bnc#723542)

  - cifs: do not allow cifs_iget to match inodes of the     wrong type. (bnc#711501)

  - cifs: fix noserverino handling when 1 extensions are     enabled. (bnc#711501)

  - cifs: reduce false positives with inode aliasing     serverino autodisable. (bnc#711501)

  - parport_pc: release IO region properly if unsupported     ITE887x card is found. (bnc#721464)

  - writeback: avoid unnecessary calculation of bdi dirty     thresholds. (bnc#721299)

  - 1: Fix bogus it_blocksize in VIO iommu code.
    (bnc#717690)

  - ext4: Fix max file size and logical block counting of     extent format file. (bnc#706374)

  - novfs: Unable to change password in the Novell Client     for Linux. (bnc#713229)

  - xfs: add more ilock tracing.

  - sched: move wakeup tracepoint above out_running.
    (bnc#712002)

  - config.conf: Build KMPs for the -trace flavor as well     (fate#312759, bnc#712404, bnc#712405, bnc#721337).

  - memsw: remove noswapaccount kernel parameter.
    (bnc#719450)

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in the b43 driver in the Linux kernel. An attacker could use this flaw to cause a denial of service if the system has an active wireless interface using the b43 driver. (CVE-2011-3359)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE 11.3 kernel was updated to fix various bugs and security issues.

Following security issues have been fixed: CVE-2011-4604: If root does read() on a specific socket, it's possible to corrupt (kernel) memory over network, with an ICMP packet, if the B.A.T.M.A.N. mesh protocol is used.

CVE-2011-2525: A flaw allowed the tc_fill_qdisc() function in the Linux kernels packet scheduler API implementation to be called on built-in qdisc structures. A local, unprivileged user could have used this flaw to trigger a NULL pointer dereference, resulting in a denial of service.

CVE-2011-2699: Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.

CVE-2011-2213: The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel did not properly audit INET_DIAG bytecode, which allowed local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880.

CVE-2011-1576: The Generic Receive Offload (GRO) implementation in the Linux kernel allowed remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478.

CVE-2011-2534: Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel might have allowed local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\0' character.

CVE-2011-1770: Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel allowed remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggered a buffer over-read.

CVE-2011-2723: The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel, when Generic Receive Offload (GRO) is enabled, reset certain fields in incorrect situations, which allowed remote attackers to cause a denial of service (system crash) via crafted network traffic.

CVE-2011-2898: A kernel information leak in the AF_PACKET protocol was fixed which might have allowed local attackers to read kernel memory.

CVE-2011-2203: A NULL ptr dereference on mounting corrupt hfs filesystems was fixed which could be used by local attackers to crash the kernel.

CVE-2011-4081: Using the crypto interface a local user could Oops the kernel by writing to a AF_ALG socket.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-220:01 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2011-1162     The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local     users to read the results of the previous TPM command.
    CVE-2011-1898     Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not     have interrupt remapping, allows guest OS users to gain host OS privileges by using DMA to generate MSI     interrupts by writing to the interrupt injection registers.
    CVE-2011-2203     The hfs_find_init function in the Linux kernel 2.6 allows local users to cause a denial of service (NULL     pointer dereference and Oops) by mounting an HFS file system with a malformed MDB extent record.
    CVE-2011-2494     CVE-2011-3363     No information available at the time of writing, please refer to the CVE links below.
    CVE-2011-4110     The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to     cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined     key and updating a negative key into a fully instantiated key.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* Using PCI passthrough without interrupt remapping support allowed Xen hypervisor guests to generate MSI interrupts and thus potentially inject traps. A privileged guest user could use this flaw to crash the host or possibly escalate their privileges on the host. The fix for this issue can prevent PCI passthrough working and guests starting.
Refer to Red Hat Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

* A flaw was found in the way CIFS (Common Internet File System) shares with DFS referrals at their root were handled. An attacker on the local network who is able to deploy a malicious CIFS server could create a CIFS network share that, when mounted, would cause the client system to crash. (CVE-2011-3363, Moderate)

* A NULL pointer dereference flaw was found in the way the Linux kernel's key management facility handled user-defined key types. A local, unprivileged user could use the keyctl utility to cause a denial of service. (CVE-2011-4110, Moderate)

* A flaw in the way memory containing security-related data was handled in tpm_read() could allow a local, unprivileged user to read the results of a previously run TPM command. (CVE-2011-1162, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's HFS file system implementation. A local attacker could use this flaw to cause a denial of service by mounting a disk that contains a specially crafted HFS file system with a corrupted MDB extent record.
(CVE-2011-2203, Low)

* The I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw to gather confidential information, such as the length of a password used in a process. (CVE-2011-2494, Low)

Red Hat would like to thank Yogesh Sharma for reporting CVE-2011-3363;
Peter Huewe for reporting CVE-2011-1162; Clement Lecigne for reporting CVE-2011-2203; and Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

This update also fixes several bugs and adds one enhancement.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A bug was discovered in the XFS filesystem's handling of pathnames. A local attacker could exploit this to crash the system, leading to a denial of service, or gain root privileges. (CVE-2011-4077)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110)

A flaw was found in the Journaling Block Device (JBD). A local attacker able to mount ext3 or ext4 file systems could exploit this to crash the system, leading to a denial of service. (CVE-2011-4132)

Clement Lecigne discovered a bug in the HFS file system bounds checking. When a malformed HFS file system is mounted a local user could crash the system or gain root privileges. (CVE-2011-4330)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
57535	Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1332-1)	Nessus	Ubuntu Local Security Checks	2012/1/13	2019/9/19	high
75882	openSUSE Security Update : kernel (openSUSE-SU-2012:0236-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
57532	Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1328-1)	Nessus	Ubuntu Local Security Checks	2012/1/13	2013/12/14	low
57659	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7918)	Nessus	SuSE Local Security Checks	2012/1/24	2021/1/19	high
57297	SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 5493 / 5510 / 5511)	Nessus	SuSE Local Security Checks	2011/12/14	2021/1/19	high
57495	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1323-1)	Nessus	Ubuntu Local Security Checks	2012/1/12	2019/9/19	medium
57664	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1340-1)	Nessus	Ubuntu Local Security Checks	2012/1/24	2019/9/19	high
75557	openSUSE Security Update : kernel (openSUSE-SU-2012:0206-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
284166	MiracleLinux 3 : kernel-2.6.18-274.5.AXS3 (AXSA:2012-220:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/19	medium
67086	CentOS 5 : kernel (CESA-2011:1479)	Nessus	CentOS Local Security Checks	2013/6/29	2021/1/4	high
57534	USN-1330-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	2012/1/13	2016/12/1	high
59161	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7915)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/19	high

检测

插件搜索

high

high

low

high

high

medium

high

high

medium

high

high

high