Jump to content
Compatible Support Forums
Sign in to follow this  
Followers 0
news

[RHSA-2011:0330-01] Important: kernel-rt security and bug fix update

By news, in Upcoming News

Recommended Posts

news    28

news
Posted

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Important: kernel-rt security and bug fix update

Advisory ID: RHSA-2011:0330-01

Product: Red Hat Enterprise MRG for RHEL-5

Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-0330.html

Issue date: 2011-03-10

CVE Names: CVE-2010-3477 CVE-2010-4160 CVE-2010-4162

CVE-2010-4163 CVE-2010-4165 CVE-2010-4242

CVE-2010-4248 CVE-2010-4249 CVE-2010-4250

CVE-2010-4346 CVE-2010-4347 CVE-2010-4565

CVE-2010-4648 CVE-2010-4649 CVE-2010-4655

CVE-2010-4656 CVE-2010-4668 CVE-2011-0521

CVE-2011-1044

=====================================================================

 

1. Summary:

 

Updated kernel-rt packages that fix multiple security issues and three bugs

are now available for Red Hat Enterprise MRG 1.3.

 

The Red Hat Security Response Team has rated this update as having

important security impact. Common Vulnerability Scoring System (CVSS) base

scores, which give detailed severity ratings, are available for each

vulnerability from the CVE links in the References section.

 

2. Relevant releases/architectures:

 

MRG Realtime for RHEL 5 Server - i386, noarch, x86_64

 

3. Description:

 

The kernel-rt packages contain the Linux kernel, the core of any Linux

operating system.

 

Security fixes:

 

* Missing boundary checks in the PPP over L2TP sockets implementation could

allow a local, unprivileged user to cause a denial of service or escalate

their privileges. (CVE-2010-4160, Important)

 

* Integer overflow in ib_uverbs_poll_cq() could allow a local, unprivileged

user to cause a denial of service or escalate their privileges.

(CVE-2010-4649, Important)

 

* Missing boundary check in dvb_ca_ioctl() in the av7110 module. On systems

using old DVB cards requiring the av7110 module, a local, unprivileged user

could use this flaw to cause a denial of service or escalate their

privileges. (CVE-2011-0521, Important)

 

* Flaw in tcf_act_police_dump() in the network traffic policing

implementation could allow a local, unprivileged user to cause an

information leak. (CVE-2010-3477, Moderate)

 

* Missing boundary checks in the block layer implementation could allow a

local, unprivileged user to cause a denial of service. (CVE-2010-4162,

CVE-2010-4163, CVE-2010-4668, Moderate)

 

* Divide-by-zero flaw in tcp_select_initial_window() in the Linux kernel's

TCP/IP protocol suite implementation could allow a local, unprivileged user

to cause a denial of service. (CVE-2010-4165, Moderate)

 

* NULL pointer dereference flaw in the Bluetooth HCI UART driver could

allow a local, unprivileged user to cause a denial of service.

(CVE-2010-4242, Moderate)

 

* Flaw in the CPU time clocks implementation for the POSIX clock interface

could allow a local, unprivileged user to cause a denial of service.

(CVE-2010-4248, Moderate)

 

* Flaw in the garbage collector for AF_UNIX sockets could allow a local,

unprivileged user to trigger a denial of service (out-of-memory condition).

(CVE-2010-4249, Moderate)

 

* Memory leak in the inotify_init() system call. In some cases, it could

leak a group, which could allow a local, unprivileged user to eventually

cause a denial of service. (CVE-2010-4250, Moderate)

 

* /sys/kernel/debug/acpi/custom_method had world-writable permissions,

which could allow a local, unprivileged user to escalate their privileges.

Note: The debugfs file system must be mounted locally to exploit this

issue. It is not mounted by default. (CVE-2010-4347, Moderate)

 

* Heap overflow in iowarrior_write() could allow a user with access to an

IO-Warrior USB device to cause a denial of service or escalate their

privileges. (CVE-2010-4656, Moderate)

 

* Missing security check in the Linux kernel's implementation of the

install_special_mapping routine could allow a local, unprivileged user to

bypass the mmap_min_addr protection mechanism. (CVE-2010-4346, Low)

 

* Information leak in bcm_connect() in the Controller Area Network (CAN)

Broadcast Manager implementation could allow a local, unprivileged user to

leak kernel mode addresses in /proc/net/can-bcm. (CVE-2010-4565, Low)

 

* A logic error in orinoco_ioctl_set_auth() in the Linux kernel's ORiNOCO

wireless extensions support implementation could render TKIP

countermeasures ineffective when it is enabled, as it enabled the card

instead of shutting it down. (CVE-2010-4648, Low)

 

* Missing initialization flaw in ethtool_get_regs() could allow a local

user who has the CAP_NET_ADMIN capability to cause an information leak.

(CVE-2010-4655, Low)

 

* Flaw in ib_uverbs_poll_cq() could allow a local, unprivileged user to

cause an information leak. (CVE-2011-1044, Low)

 

Red Hat would like to thank Dan Rosenberg for reporting CVE-2010-4160,

CVE-2010-4162, CVE-2010-4163, CVE-2010-4668, and CVE-2010-4565; Steve Chen

for reporting CVE-2010-4165; Alan Cox for reporting CVE-2010-4242; Vegard

Nossum for reporting CVE-2010-4249 and CVE-2010-4250; Kees Cook for

reporting CVE-2010-4656 and CVE-2010-4655; and Tavis Ormandy for reporting

CVE-2010-4346.

 

This update also fixes three bugs. Documentation for these bug fixes will

be available shortly from the Technical Notes document linked to in the

References section.

 

4. Solution:

 

Users should upgrade to these updated kernel-rt packages. They are

based on upstream version 2.6.33.7.2-rt30 (despite package naming) and

correct these issues. The system must be rebooted for this update to

take effect.

 

Before applying this update, make sure all previously-released errata

relevant to your system have been applied.

 

This update is available via the Red Hat Network. Details on how to

use the Red Hat Network to apply this update are available at

https://access.redhat.com/kb/docs/DOC-11259

 

To install kernel packages manually, use "rpm -ivh [package]". Do not

use "rpm -Uvh" as that will remove the running kernel binaries from

your system. You may use "rpm -e" to remove old kernels after

determining that the new kernel functions properly on your system.

 

5. Bugs fixed (http://bugzilla.redhat.com/):

 

636386 - CVE-2010-3477 kernel: net/sched/act_police.c infoleak

641410 - CVE-2010-4242 kernel: missing tty ops write function presence check in hci_uart_tty_open()

651892 - CVE-2010-4160 kernel: L2TP send buffer allocation size overflows

652508 - CVE-2010-4165 kernel: possible kernel oops from user MSS

652529 - CVE-2010-4162 kernel: bio: integer overflow page count when mapping/copying user data

652957 - CVE-2010-4163 CVE-2010-4668 kernel: panic when submitting certain 0-length I/O requests

656264 - CVE-2010-4248 kernel: posix-cpu-timers: workaround to suppress the problems with mt exec

656756 - CVE-2010-4249 kernel: unix socket local dos

656830 - CVE-2010-4250 kernel: inotify memory leak

659574 - CVE-2010-4258 kernel: failure to revert address limit override in OOPS error path [mrg-1.3]

662189 - CVE-2010-4346 kernel: install_special_mapping skips security_file_mmap check

663542 - CVE-2010-4347 kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method

664544 - CVE-2010-4565 kernel: CAN info leak

667907 - CVE-2010-4648 kernel: orinoco: fix TKIP countermeasure behaviour

667916 - CVE-2010-4649 CVE-2011-1044 kernel: IB/uverbs: Handle large number of entries in poll CQ

672398 - CVE-2011-0521 kernel: av7110 negative array offset

672420 - CVE-2010-4656 kernel: iowarrior usb device heap overflow

672428 - CVE-2010-4655 kernel: heap contents leak for CAP_NET_ADMIN via ethtool ioctl

 

6. Package List:

 

MRG Realtime for RHEL 5 Server:

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHEMRG/SRPMS/kernel-rt-2.6.33.7-rt29.55.el5rt.src.rpm

 

i386:

kernel-rt-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-debug-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-debug-debuginfo-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-debug-devel-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-debuginfo-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-debuginfo-common-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-devel-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-trace-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-trace-debuginfo-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-trace-devel-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-vanilla-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-vanilla-debuginfo-2.6.33.7-rt29.55.el5rt.i686.rpm

kernel-rt-vanilla-devel-2.6.33.7-rt29.55.el5rt.i686.rpm

perf-2.6.33.7-rt29.55.el5rt.i686.rpm

perf-debuginfo-2.6.33.7-rt29.55.el5rt.i686.rpm

 

noarch:

kernel-rt-doc-2.6.33.7-rt29.55.el5rt.noarch.rpm

 

x86_64:

kernel-rt-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-debug-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-debug-debuginfo-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-debug-devel-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-debuginfo-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-debuginfo-common-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-devel-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-trace-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-trace-debuginfo-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-trace-devel-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-vanilla-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-vanilla-debuginfo-2.6.33.7-rt29.55.el5rt.x86_64.rpm

kernel-rt-vanilla-devel-2.6.33.7-rt29.55.el5rt.x86_64.rpm

perf-2.6.33.7-rt29.55.el5rt.x86_64.rpm

perf-debuginfo-2.6.33.7-rt29.55.el5rt.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/#package

 

7. References:

 

https://www.redhat.com/security/data/cve/CVE-2010-3477.html

https://www.redhat.com/security/data/cve/CVE-2010-4160.html

https://www.redhat.com/security/data/cve/CVE-2010-4162.html

https://www.redhat.com/security/data/cve/CVE-2010-4163.html

https://www.redhat.com/security/data/cve/CVE-2010-4165.html

https://www.redhat.com/security/data/cve/CVE-2010-4242.html

https://www.redhat.com/security/data/cve/CVE-2010-4248.html

https://www.redhat.com/security/data/cve/CVE-2010-4249.html

https://www.redhat.com/security/data/cve/CVE-2010-4250.html

https://www.redhat.com/security/data/cve/CVE-2010-4346.html

https://www.redhat.com/security/data/cve/CVE-2010-4347.html

https://www.redhat.com/security/data/cve/CVE-2010-4565.html

https://www.redhat.com/security/data/cve/CVE-2010-4648.html

https://www.redhat.com/security/data/cve/CVE-2010-4649.html

https://www.redhat.com/security/data/cve/CVE-2010-4655.html

https://www.redhat.com/security/data/cve/CVE-2010-4656.html

https://www.redhat.com/security/data/cve/CVE-2010-4668.html

https://www.redhat.com/security/data/cve/CVE-2011-0521.html

https://www.redhat.com/security/data/cve/CVE-2011-1044.html

https://access.redhat.com/security/updates/classification/#important

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/1.3/html/Technical_Notes/chap-Package_Updates.html#RHSA-2011-0330

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://www.redhat.com/security/team/contact/

 

Copyright 2011 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.4 (GNU/Linux)

 

iD8DBQFNeTsrXlSAg2UNWIIRAlygAJwN1qWRvHTL0hg3dWJ3Ki2JuOBXdgCfew1i

A5AG5zgqnX11kLZiKmQyuTc=

=h5c7

-----END PGP SIGNATURE-----

 

 

--

 

Share this post

Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  
Followers 0
Go To Topic Listing Upcoming News
×