Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-2524     David Howells reported an issue in the Common Internet     File System (CIFS). Local users could cause arbitrary     CIFS shares to be mounted by introducing malicious     redirects.

  - CVE-2010-3875     Vasiliy Kulikov discovered an issue in the Linux     implementation of the Amateur Radio AX.25 Level 2     protocol. Local users may obtain access to sensitive     kernel memory.

  - CVE-2010-4075     Dan Rosenberg reported an issue in the tty layer that     may allow local users to obtain access to sensitive     kernel memory.

  - CVE-2010-4655     Kees Cook discovered several issues in the ethtool     interface which may allow local users with the     CAP_NET_ADMIN capability to obtain access to sensitive     kernel memory.

  - CVE-2011-0695     Jens Kuehnel reported an issue in the InfiniBand stack.
    Remote attackers can exploit a race condition to cause a     denial of service (kernel panic).

  - CVE-2011-0710     Al Viro reported an issue in the /proc/<pid>/status     interface on the s390 architecture. Local users could     gain access to sensitive memory in processes they do not     own via the task_show_regs entry.

  - CVE-2011-0711     Dan Rosenberg reported an issue in the XFS filesystem.
    Local users may obtain access to sensitive kernel     memory.

  - CVE-2011-0726     Kees Cook reported an issue in the /proc/<pid>/stat     implementation. Local users could learn the text     location of a process, defeating protections provided by     address space layout randomization (ASLR).

  - CVE-2011-1010     Timo Warns reported an issue in the Linux support for     Mac partition tables. Local users with physical access     could cause a denial of service (panic) by adding a     storage device with a malicious map_count value.

  - CVE-2011-1012     Timo Warns reported an issue in the Linux support for     LDM partition tables. Local users with physical access     could cause a denial of service (Oops) by adding a     storage device with an invalid VBLK value in the VMDB     structure.

  - CVE-2011-1017     Timo Warns reported an issue in the Linux support for     LDM partition tables. Users with physical access can     gain access to sensitive kernel memory or gain elevated     privileges by adding a storage device with a specially     crafted LDM partition.

  - CVE-2011-1078     Vasiliy Kulikov discovered an issue in the Bluetooth     subsystem. Local users can obtain access to sensitive     kernel memory.

  - CVE-2011-1079     Vasiliy Kulikov discovered an issue in the Bluetooth     subsystem. Local users with the CAP_NET_ADMIN capability     can cause a denial of service (kernel Oops).

  - CVE-2011-1080     Vasiliy Kulikov discovered an issue in the Netfilter     subsystem. Local users can obtain access to sensitive     kernel memory.

  - CVE-2011-1090     Neil Horman discovered a memory leak in the setacl()     call on NFSv4 filesystems. Local users can exploit this     to cause a denial of service (Oops).

  - CVE-2011-1093     Johan Hovold reported an issue in the Datagram     Congestion Control Protocol (DCCP) implementation.
    Remote users could cause a denial of service by sending     data after closing a socket.

  - CVE-2011-1160     Peter Huewe reported an issue in the Linux kernel's     support for TPM security chips. Local users with     permission to open the device can gain access to     sensitive kernel memory.

  - CVE-2011-1163     Timo Warns reported an issue in the kernel support for     Alpha OSF format disk partitions. Users with physical     access can gain access to sensitive kernel memory by     adding a storage device with a specially crafted OSF     partition.

  - CVE-2011-1170     Vasiliy Kulikov reported an issue in the Netfilter arp     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1171     Vasiliy Kulikov reported an issue in the Netfilter IP     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1172     Vasiliy Kulikov reported an issue in the Netfilter IP6     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1173     Vasiliy Kulikov reported an issue in the Acorn Econet     protocol implementation. Local users can obtain access     to sensitive kernel memory on systems that use this rare     hardware.

  - CVE-2011-1180     Dan Rosenberg reported a buffer overflow in the     Information Access Service of the IrDA protocol, used     for Infrared devices. Remote attackers within IR device     range can cause a denial of service or possibly gain     elevated privileges.

  - CVE-2011-1182     Julien Tinnes reported an issue in the rt_sigqueueinfo     interface. Local users can generate signals with     falsified source pid and uid information.

  - CVE-2011-1477     Dan Rosenberg reported issues in the Open Sound System     driver for cards that include a Yamaha FM synthesizer     chip. Local users can cause memory corruption resulting     in a denial of service. This issue does not affect     official Debian Linux image packages as they no longer     provide support for OSS. However, custom kernels built     from Debians linux-source-2.6.26 may have enabled this     configuration and would therefore be vulnerable.

  - CVE-2011-1493     Dan Rosenburg reported two issues in the Linux     implementation of the Amateur Radio X.25 PLP (Rose)     protocol. A remote user can cause a denial of service by     providing specially crafted facilities fields.

  - CVE-2011-1577     Timo Warns reported an issue in the Linux support for     GPT partition tables. Local users with physical access     could cause a denial of service (Oops) by adding a     storage device with a malicious partition table header.

  - CVE-2011-1593     Robert Swiecki reported a signednes issue in the     next_pidmap() function, which can be exploited my local     users to cause a denial of service.

  - CVE-2011-1598     Dave Jones reported an issue in the Broadcast Manager     Controller Area Network (CAN/BCM) protocol that may     allow local users to cause a NULL pointer dereference,     resulting in a denial of service.

  - CVE-2011-1745     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the AGPIOC_BIND ioctl. On default     Debian installations, this is exploitable only by users     in the video group.

  - CVE-2011-1746     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the agp_allocate_memory and     agp_create_user_memory. On default Debian installations,     this is exploitable only by users in the video group.

  - CVE-2011-1748     Oliver Kartkopp reported an issue in the Controller Area     Network (CAN) raw socket implementation which permits     ocal users to cause a NULL pointer dereference,     resulting in a denial of service.

  - CVE-2011-1759     Dan Rosenberg reported an issue in the support for     executing 'old ABI' binaries on ARM processors. Local     users can obtain elevated privileges due to insufficient     bounds checking in the semtimedop system call.

  - CVE-2011-1767     Alexecy Dobriyan reported an issue in the GRE over IP     implementation. Remote users can cause a denial of     service by sending a packet during module     initialization.

  - CVE-2011-1768     Alexecy Dobriyan reported an issue in the IP tunnels     implementation. Remote users can cause a denial of     service by sending a packet during module     initialization.

  - CVE-2011-1776     Timo Warns reported an issue in the Linux implementation     for GUID partitions. Users with physical access can gain     access to sensitive kernel memory by adding a storage     device with a specially crafted corrupted invalid     partition table.

  - CVE-2011-2022     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the AGPIOC_UNBIND ioctl. On default     Debian installations, this is exploitable only by users     in the video group.

  - CVE-2011-2182     Ben Hutchings reported an issue with the fix for     CVE-2011-1017 (see above) that made it insufficient to     resolve the issue.

Goldwyn Rodrigues discovered that the OCFS2 filesystem did not correctly clear memory when writing certain file holes. A local attacker could exploit this to read uninitialized data from the disk, leading to a loss of privacy. (CVE-2011-0463)

Timo Warns discovered that the LDM disk partition handling code did not correctly handle certain values. By inserting a specially crafted disk device, a local attacker could exploit this to gain root privileges. (CVE-2011-1017)

It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities. (CVE-2011-1020)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-1078)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly check that device name strings were NULL terminated. A local attacker could exploit this to crash the system, leading to a denial of service, or leak contents of kernel stack memory, leading to a loss of privacy. (CVE-2011-1079)

Vasiliy Kulikov discovered that bridge network filtering did not check that name fields were NULL terminated. A local attacker could exploit this to leak contents of kernel stack memory, leading to a loss of privacy. (CVE-2011-1080)

Peter Huewe discovered that the TPM device did not correctly initialize memory. A local attacker could exploit this to read kernel heap memory contents, leading to a loss of privacy. (CVE-2011-1160)

Vasiliy Kulikov discovered that the netfilter code did not check certain strings copied from userspace. A local attacker with netfilter access could exploit this to read kernel memory or crash the system, leading to a denial of service. (CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-2534)

Vasiliy Kulikov discovered that the Acorn Universal Networking driver did not correctly initialize memory. A remote attacker could send specially crafted traffic to read kernel stack memory, leading to a loss of privacy. (CVE-2011-1173)

Dan Rosenberg discovered that the IRDA subsystem did not correctly check certain field sizes. If a system was using IRDA, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-1180)

Julien Tinnes discovered that the kernel did not correctly validate the signal structure from tkill(). A local attacker could exploit this to send signals to arbitrary threads, possibly bypassing expected restrictions. (CVE-2011-1182)

Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fields. If a system was running with Rose enabled, a remote attacker could send specially crafted traffic to gain root privileges. (CVE-2011-1493)

Dan Rosenberg discovered that MPT devices did not correctly validate certain values in ioctl calls. If these drivers were loaded, a local attacker could exploit this to read arbitrary kernel memory, leading to a loss of privacy. (CVE-2011-1494, CVE-2011-1495)

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

Phil Oester discovered that the network bonding system did not correctly handle large queues. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2011-1581)

Tavis Ormandy discovered that the pidmap function did not correctly handle large requests. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-1593)

Oliver Hartkopp and Dave Jones discovered that the CAN network driver did not correctly validate certain socket structures. If this driver was loaded, a local attacker could crash the system, leading to a denial of service. (CVE-2011-1598, CVE-2011-1748)

Vasiliy Kulikov discovered that the AGP driver did not check certain ioctl values. A local attacker with access to the video subsystem could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges. (CVE-2011-1745, CVE-2011-2022)

Vasiliy Kulikov discovered that the AGP driver did not check the size of certain memory allocations. A local attacker with access to the video subsystem could exploit this to run the system out of memory, leading to a denial of service. (CVE-2011-1746)

Dan Rosenberg discovered that the DCCP stack did not correctly handle certain packet structures. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-1770)

Ben Greear discovered that CIFS did not correctly handle direct I/O.
A local attacker with access to a CIFS partition could exploit this to crash the system, leading to a denial of service. (CVE-2011-1771)

Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. (CVE-2011-1833)

Vasiliy Kulikov discovered that taskstats listeners were not correctly handled. A local attacker could expoit this to exhaust memory and CPU resources, leading to a denial of service.
(CVE-2011-2484)

It was discovered that Bluetooth l2cap and rfcomm did not correctly initialize structures. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy.
(CVE-2011-2492)

Sami Liedes discovered that ext4 did not correctly handle missing root inodes. A local attacker could trigger the mount of a specially crafted filesystem to cause the system to crash, leading to a denial of service. (CVE-2011-2493)

It was discovered that GFS2 did not correctly check block sizes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2689)

Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.
(CVE-2011-2699)

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2918)

This kernel update for the SUSE Linux Enterprise 10 SP4 kernel fixes several security issues and bugs.

The following security issues were fixed :

  - The code for evaluating LDM partitions (in     fs/partitions/ldm.c) contained bugs that could crash the     kernel for certain corrupted LDM partitions.
    (CVE-2011-1017 / CVE-2011-1012)

  - Boundschecking was missing in AARESOLVE_OFFSET, which     allowed local attackers to overwrite kernel memory and     so escalate privileges or crash the kernel.
    (CVE-2011-1573)

  - When using a setuid root mount.cifs, local users could     hijack password protected mounted CIFS shares of other     local users. (CVE-2011-1585)

  - Kernel information via the TPM devices could by used by     local attackers to read kernel memory. (CVE-2011-1160)

  - The Linux kernel automatically evaluated partition     tables of storage devices. The code for evaluating EFI     GUID partitions (in fs/partitions/efi.c) contained a bug     that causes a kernel oops on certain corrupted GUID     partition tables, which might be used by local attackers     to crash the kernel or potentially execute code.
    (CVE-2011-1577)

  - In the IrDA module, length fields provided by a peer for     names and attributes may be longer than the destination     array sizes and were not checked, this allowed local     attackers (close to the irda port) to potentially     corrupt memory. (CVE-2011-1180)

  - A system out of memory condition (denial of service)     could be triggered with a large socket backlog,     exploitable by local users. This has been addressed by     backlog limiting. (CVE-2010-4251)

  - The Radeon GPU drivers in the Linux kernel did not     properly validate data related to the AA resolve     registers, which allowed local users to write to     arbitrary memory locations associated with (1) Video RAM     (aka VRAM) or (2) the Graphics Translation Table (GTT)     via crafted values. (CVE-2011-1016)

  - When parsing the FAC_NATIONAL_DIGIS facilities field, it     was possible for a remote host to provide more     digipeaters than expected, resulting in heap corruption.
    (CVE-2011-1493)

  - Local attackers could send signals to their programs     that looked like coming from the kernel, potentially     gaining privileges in the context of setuid programs.
    (CVE-2011-1182)

  - The code for evaluating Mac partitions (in     fs/partitions/mac.c) contained a bug that could crash     the kernel for certain corrupted Mac partitions.
    (CVE-2011-1010)

  - The code for evaluating OSF partitions (in     fs/partitions/osf.c) contained a bug that leaks data     from kernel heap memory to userspace for certain     corrupted OSF partitions. (CVE-2011-1163)

  - Specially crafted requests may be written to     /dev/sequencer resulting in an underflow when     calculating a size for a copy_from_user() operation in     the driver for MIDI interfaces. On x86, this just     returns an error, but it could have caused memory     corruption on other architectures. Other malformed     requests could have resulted in the use of uninitialized     variables. (CVE-2011-1476)

  - Due to a failure to validate user-supplied indexes in     the driver for Yamaha YM3812 and OPL-3 chips, a     specially crafted ioctl request could have been sent to     /dev/sequencer, resulting in reading and writing beyond     the bounds of heap buffers, and potentially allowing     privilege escalation. (CVE-2011-1477)

  - A information leak in the XFS geometry calls could be     used by local attackers to gain access to kernel     information. (CVE-2011-0191)

  - The sctp_rcv_ootb function in the SCTP implementation in     the Linux kernel allowed remote attackers to cause a     denial of service (infinite loop) via (1) an Out Of The     Blue (OOTB) chunk or (2) a chunk of zero length.
    (CVE-2010-0008)

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel.

The following security issues have been fixed :

  - A USB string descriptor overflow in the auerwald USB     driver was fixed, which could be used by physically     proximate attackers to cause a kernel crash.
    (CVE-2009-4067)

  - Always check the path in CIFS mounts to avoid     interesting filesystem path interaction issues and     potential crashes. (CVE-2011-3363)

  - A malicious CIFS server could cause a integer overflow     on the local machine on directory index operations, in     turn causing memory corruption. (CVE-2011-3191)

  - The is_gpt_valid function in fs/partitions/efi.c in the     Linux kernel did not check the size of an Extensible     Firmware Interface (EFI) GUID Partition Table (GPT)     entry, which allowed physically proximate attackers to     cause a denial of service (heap-based buffer overflow     and OOPS) or obtain sensitive information from kernel     heap memory by connecting a crafted GPT storage device,     a different vulnerability than CVE-2011-1577.
    (CVE-2011-1776)

The following non-security issues have been fixed :

  - md: fix deadlock in md/raid1 and md/raid10 when handling     a read error. (bnc#628343)

  - md: fix possible raid1/raid10 deadlock on read error     during resync. (bnc#628343)

  - Add timeo parameter to /proc/mounts for nfs filesystems.
    (bnc#616256)

  - virtio: indirect ring entries     (VIRTIO_RING_F_INDIRECT_DESC). (bnc#713876)

  - virtio: teach virtio_has_feature() about transport     features. (bnc#713876)

  - nf_nat: do not add NAT extension for confirmed     conntracks. (bnc#709213)

  - 8250: Oxford Semiconductor Devices. (bnc#717126)

  - 8250_pci: Add support for the Digi/IBM PCIe 2-port     Adapter. (bnc#717126)

  - 8250: Fix capabilities when changing the port type.
    (bnc#717126)

  - 8250: Add EEH support. (bnc#717126)

  - xfs: fix memory reclaim recursion deadlock on locked     inode buffer. (bnc#699355 / bnc#699354 / bnc#721830)

  - ipmi: do not grab locks in run-to-completion mode.
    (bnc#717421)

  - cifs: add fallback in is_path_accessible for old     servers. (bnc#718028)

  - cciss: do not attempt to read from a write-only     register. (bnc#683101)

  - s390: kernel: System hang if hangcheck timer expires     (bnc#712009,LTC#74157).

  - s390: kernel: NSS creation with initrd fails     (bnc#712009,LTC#74207).

  - s390: kernel: remove code to handle topology interrupts     (bnc#712009,LTC#74440).

  - xen: Added 1083-kbdfront-absolute-coordinates.patch.
    (bnc#717585)

  - acpi: Use a spinlock instead of mutex to guard gbl_lock     access. (bnc#707439)

  - Allow balance_dirty_pages to help other filesystems.
    (bnc#709369)

  - nfs: fix congestion control. (bnc#709369)

  - NFS: Separate metadata and page cache revalidation     mechanisms. (bnc#709369)

  - jbd: Fix oops in journal_remove_journal_head().
    (bnc#694315)

  - xen/blkfront: avoid NULL de-reference in CDROM ioctl     handling. (bnc#701355)

  - xen/x86: replace order-based range checking of M2P table     by linear one.

  - xen/x86: use dynamically adjusted upper bound for     contiguous regions. (bnc#635880)

  - Fix type in     patches.fixes/libiscsi-dont-run-scsi-eh-if-iscsi-task-is
    -making-progress.

  - s390: cio: Add timeouts for internal IO     (bnc#701550,LTC#72691).

  - s390: kernel: first time swap use results in heavy     swapping (bnc#701550,LTC#73132).

  - s390: qeth: wrong number of output queues for     HiperSockets (bnc#701550,LTC#73814).

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - IPv6 fragment identification value generation could     allow a remote attacker to disrupt a target system's     networking, preventing legitimate users from accessing     its services. (CVE-2011-2699, Important)

  - A signedness issue was found in the Linux kernel's CIFS     (Common Internet File System) implementation. A     malicious CIFS server could send a specially crafted     response to a directory read request that would result     in a denial of service or privilege escalation on a     system that has a CIFS share mounted. (CVE-2011-3191,     Important)

  - A flaw was found in the way the Linux kernel handled     fragmented IPv6 UDP datagrams over the bridge with UDP     Fragmentation Offload (UFO) functionality on. A remote     attacker could use this flaw to cause a denial of     service. (CVE-2011-4326, Important)

  - The way IPv4 and IPv6 protocol sequence numbers and     fragment IDs were generated could allow a     man-in-the-middle attacker to inject packets and     possibly hijack connections. Protocol sequence numbers     and fragment IDs are now more random. (CVE-2011-3188,     Moderate)

  - A buffer overflow flaw was found in the Linux kernel's     FUSE (Filesystem in Userspace) implementation. A local     user in the fuse group who has access to mount a FUSE     file system could use this flaw to cause a denial of     service. (CVE-2011-3353, Moderate)

  - A flaw was found in the b43 driver in the Linux kernel.
    If a system had an active wireless interface that uses     the b43 driver, an attacker able to send a specially     crafted frame to that interface could cause a denial of     service. (CVE-2011-3359, Moderate)

  - A flaw was found in the way CIFS shares with DFS     referrals at their root were handled. An attacker on the     local network who is able to deploy a malicious CIFS     server could create a CIFS network share that, when     mounted, would cause the client system to crash.
    (CVE-2011-3363, Moderate)

  - A flaw was found in the way the Linux kernel handled     VLAN 0 frames with the priority tag set. When using     certain network drivers, an attacker on the local     network could use this flaw to cause a denial of     service. (CVE-2011-3593, Moderate)

  - A flaw in the way memory containing security-related     data was handled in tpm_read() could allow a local,     unprivileged user to read the results of a previously     run TPM command. (CVE-2011-1162, Low)

  - A heap overflow flaw was found in the Linux kernel's EFI     GUID Partition Table (GPT) implementation. A local     attacker could use this flaw to cause a denial of     service by mounting a disk that contains specially     crafted partition tables. (CVE-2011-1577, Low)

  - The I/O statistics from the taskstats subsystem could be     read without any restrictions. A local, unprivileged     user could use this flaw to gather confidential     information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

  - It was found that the perf tool, a part of the Linux     kernel's Performance Events implementation, could load     its configuration file from the current working     directory. If a local user with access to the perf tool     were tricked into running perf in a directory that     contains a specially crafted configuration file, it     could cause perf to overwrite arbitrary files and     directories accessible to that user. (CVE-2011-2905,     Low)

This update also fixes various bugs.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0833 advisory.

    - [scsi] mpt2sas: prevent heap overflows and unchecked access (Tomas Henzl) [694526 694527] {CVE-2011-1495     CVE-2011-1494}
    - [net] bridge/netfilter: fix ebtables information leak (Don Howard) [681325 681326] {CVE-2011-1080}
    - [net] bluetooth: fix sco information leak to userspace (Don Howard) [681310 681311] {CVE-2011-1078}
    - [fs] fix corrupted GUID partition table kernel oops (Jerome Marchand) [695979 695980] {CVE-2011-1577}
    - [xen] x86/domain: fix error checks in arch_set_info_guest (Laszlo Ersek) [688581 688582] {CVE-2011-1166}
    - [fs] partitions: Fix corrupted OSF partition table parsing (Danny Feng) [688022 688023] {CVE-2011-1163}
    - [net] netfilter: ip6_tables: fix infoleak to userspace (Jiri Pirko) [689348 689349] {CVE-2011-1172}
    - [net] netfilter/ip_tables: fix infoleak to userspace (Jiri Pirko) [689331 689332] {CVE-2011-1171}
    - [net] netfilter/arp_tables: fix infoleak to userspace (Jiri Pirko) [689322 689323] {CVE-2011-1170}
    - [fs] proc: protect mm start_/end_code in /proc/pid/stat (Eugene Teo) [684570 684571] {CVE-2011-0726}
    - [net] dccp: fix oops in dccp_rcv_state_process (Eugene Teo) [682955 682956] {CVE-2011-1093}
    - [net] bluetooth: fix bnep buffer overflow (Don Howard) [681318 681319] {CVE-2011-1079}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The openSUSE 11.3 kernel was updated to fix various bugs and security issues.

Following security issues have been fixed: CVE-2011-1833: Added a kernel option to ensure ecryptfs is mounting only on paths belonging to the current ui, which would have allowed local attackers to potentially gain privileges via symlink attacks.

CVE-2011-3363: Always check the path in CIFS mounts to avoid interesting filesystem path interaction issues and potential crashes.

CVE-2011-2918: In the perf framework software event overflows could deadlock or delete an uninitialized timer.

CVE-2011-3353: In the fuse filesystem, FUSE_NOTIFY_INVAL_ENTRY did not check the length of the write so the message processing could overrun and result in a BUG_ON() in fuse_copy_fill(). This flaw could be used by local users able to mount FUSE filesystems to crash the system.

CVE-2011-3191: A signedness issue in CIFS could possibly have lead to to memory corruption, if a malicious server could send crafted replies to the host.

CVE-2011-1776: The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel did not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allowed physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.

Following non security bugs were fixed :

  - drm/radeon/kms: Fix I2C mask definitions (bnc#712023).

  - ext4: Fix max file size and logical block counting of     extent format file (bnc#706374).

  - TTY: pty, fix pty counting (bnc#711203).

  - Update Xen patches to 2.6.34.10.

  - xen/blkfront: fix data size for xenbus_gather in     connect().

  - xen/xenbus: fix xenbus_transaction_start() hang caused     by double xenbus_transaction_end().

  - xen/blkback: don't fail empty barrier requests.

  - xen/blktap: fix locking (bnc#685276).

  - xen/xenbus: don't BUG() on user mode induced conditions     (bnc#696107).

  - xen/blkfront: avoid NULL de-reference in CDROM ioctl     handling (bnc#701355).

  - intr-remap: allow disabling source id checking     (bnc#710352).

The openSUSE 11.4 kernel was updated to 2.6.37.6 fixing lots of bugs and security issues.

Following security issues have been fixed: CVE-2011-1833: Added a kernel option to ensure ecryptfs is mounting only on paths belonging to the current ui, which would have allowed local attackers to potentially gain privileges via symlink attacks.

CVE-2011-2695: Multiple off-by-one errors in the ext4 subsystem in the Linux kernel allowed local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.

CVE-2011-3363: Always check the path in CIFS mounts to avoid interesting filesystem path interaction issues and potential crashes.

CVE-2011-2918: In the perf framework software event overflows could deadlock or delete an uninitialized timer.

CVE-2011-3353: In the fuse filesystem, FUSE_NOTIFY_INVAL_ENTRY did not check the length of the write so the message processing could overrun and result in a BUG_ON() in fuse_copy_fill(). This flaw could be used by local users able to mount FUSE filesystems to crash the system.

CVE-2011-2183: Fixed a race between ksmd and other memory management code, which could result in a NULL ptr dereference and kernel crash.

CVE-2011-3191: A signedness issue in CIFS could possibly have lead to to memory corruption, if a malicious server could send crafted replies to the host.

CVE-2011-1776: The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel did not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allowed physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.

Following non-security bugs were fixed :

  - novfs: Unable to change password in the Novell Client     for Linux (bnc#713229).

  - novfs: last modification time not reliable (bnc#642896).

  - novfs: unlink directory after unmap (bnc#649625).

  - fs: novfs: Fix exit handlers on local_unlink     (bnc#649625).

  - novfs: 'Unable to save Login Script' appears when trying     to save a user login script (bnc#638985).

  - fs: novfs: Limit check for datacopy between user and     kernel space.

  - novfs: Fix checking of login id (bnc#626119).

  - novfs: Set the sticky bit for the novfs mountpoint     (bnc#686412).

  - ACPICA: Fix issues/fault with automatic 'serialized'     method support (bnc#678097).

  - drm/radeon/kms: Fix I2C mask definitions (bnc#712023).

  - ext4: Fix max file size and logical block counting of     extent format file (bnc#706374).

  - novfs: fix off-by-one allocation error (bnc#669378     bnc#719710).

  - novfs: fix some kmalloc/kfree issues (bnc#669378     bnc#719710).

  - novfs: fix some DirCache locking issues (bnc#669378     bnc#719710).

  - memsw: remove noswapaccount kernel parameter     (bnc#719450).

  - Provide memory controller swap extension. Keep the     feature disabled by default. Use swapaccount=1 kernel     boot parameter for enabling it.

  - Config cleanups: CONFIG_OLPC should be enabled only for     i386 non PAE

  - TTY: pty, fix pty counting (bnc#711203).

  - USB: OHCI: fix another regression for NVIDIA controllers     (bnc#682204).

  - xen/blkfront: avoid NULL de-reference in CDROM ioctl     handling.

  - x86, mtrr: lock stop machine during MTRR rendezvous     sequence (bnc#672008).

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-228:02 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2011-1020     The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the     /proc directory tree of a process after this process performs an exec of a setuid program, which allows     local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write     system calls.
    CVE-2011-3347     CVE-2011-3638     No information available at the time of writing, see the CVE link below.
    CVE-2011-4110     The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to     cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined     key and updating a negative key into a fully instantiated key.
    CVE-2011-1162     The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local     users to read the results of the previous TPM command.
    CVE-2011-1577     Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    CVE-2012-0056     The mem_write function in Linux kernel 2.6.39 and other versions, when ASLR is disabled, does not properly     check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by     modifying process memory, as demonstrated by Mempodipper.
    CVE-2011-2494     CVE-2011-2699     CVE-2011-2905     CVE-2011-3188     CVE-2011-3191     CVE-2011-3353     CVE-2011-3359     CVE-2011-3363     CVE-2011-3593     CVE-2011-4326     CVE-2011-4127     No information available at the time of writing, please refer to the CVE links     below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. (CVE-2010-4076, CVE-2010-4077)

Neil Horman discovered that NFSv4 did not correctly handle certain orders of operation with ACL data. A remote attacker with access to an NFSv4 mount could exploit this to crash the system, leading to a denial of service. (CVE-2011-1090)

Timo Warns discovered that OSF partition parsing routines did not correctly clear memory. A local attacker with physical access could plug in a specially crafted block device to read kernel memory, leading to a loss of privacy. (CVE-2011-1163)

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

Oliver Hartkopp and Dave Jones discovered that the CAN network driver did not correctly validate certain socket structures. If this driver was loaded, a local attacker could crash the system, leading to a denial of service. (CVE-2011-1598)

Vasiliy Kulikov discovered that the AGP driver did not check the size of certain memory allocations. A local attacker with access to the video subsystem could exploit this to run the system out of memory, leading to a denial of service. (CVE-2011-1746).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
55170	Debian DSA-2264-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	2011/6/20	2021/1/4	high
56257	USN-1212-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	2011/9/22	2019/10/16	high
59156	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7515)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/19	high
59160	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7811)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/19	critical
61179	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
68276	Oracle Linux 5 : kernel (ELSA-2011-0833)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
75556	openSUSE Security Update : kernel (openSUSE-SU-2011:1221-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
75881	openSUSE Security Update : kernel (openSUSE-SU-2011:1222-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
284039	MiracleLinux 4 : kernel-2.6.32-220.4.1.el6 (AXSA:2012-228:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	critical
55762	Ubuntu 10.10 : linux vulnerabilities (USN-1183-1)	Nessus	Ubuntu Local Security Checks	2011/8/4	2019/9/19	medium

检测

插件搜索

high

high

high

critical

critical

high

critical

critical

critical

medium