Jump to content
Compatible Support Forums
Sign in to follow this  
Followers 0
news

[RHSA-2013:1519-01] Important: kernel security and bug fix update

By news, in Upcoming News

Recommended Posts

news    28

news
Posted

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Important: kernel security and bug fix update

Advisory ID: RHSA-2013:1519-01

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1519.html

Issue date: 2013-11-13

CVE Names: CVE-2012-4508 CVE-2013-4299

=====================================================================

 

1. Summary:

 

Updated kernel packages that fix two security issues and several bugs are

now available for Red Hat Enterprise Linux 6.2 Extended Update Support.

 

The Red Hat Security Response Team has rated this update as having

important security impact. Common Vulnerability Scoring System (CVSS) base

scores, which give detailed severity ratings, are available for each

vulnerability from the CVE links in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux Compute Node EUS (v. 6.2) - noarch, x86_64

Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.2) - x86_64

Red Hat Enterprise Linux Server EUS (v. 6.2) - i386, noarch, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional EUS (v. 6.2) - i386, ppc64, s390x, x86_64

 

3. Description:

 

The kernel packages contain the Linux kernel, the core of any Linux

operating system.

 

* A race condition was found in the way asynchronous I/O and fallocate()

interacted when using the ext4 file system. A local, unprivileged user

could use this flaw to expose random data from an extent whose data blocks

have not yet been written, and thus contain data from a deleted file.

(CVE-2012-4508, Important)

 

* An information leak flaw was found in the way Linux kernel's device

mapper subsystem, under certain conditions, interpreted data written to

snapshot block devices. An attacker could use this flaw to read data from

disk blocks in free space, which are normally inaccessible. (CVE-2013-4299,

Moderate)

 

Red Hat would like to thank Theodore Ts'o for reporting CVE-2012-4508, and

Fujitsu for reporting CVE-2013-4299. Upstream acknowledges Dmitry Monakhov

as the original reporter of CVE-2012-4508.

 

This update also fixes the following bugs:

 

* When the Audit subsystem was under heavy load, it could loop infinitely

in the audit_log_start() function instead of failing over to the error

recovery code. This would cause soft lockups in the kernel. With this

update, the timeout condition in the audit_log_start() function has been

modified to properly fail over when necessary. (BZ#1017898)

 

* When handling Memory Type Range Registers (MTRRs), the

stop_one_cpu_nowait() function could potentially be executed in parallel

with the stop_machine() function, which resulted in a deadlock. The MTRR

handling logic now uses the stop_machine() function and makes use of mutual

exclusion to avoid the aforementioned deadlock. (BZ#1017902)

 

* Power-limit notification interrupts were enabled by default. This could

lead to degradation of system performance or even render the system

unusable on certain platforms, such as Dell PowerEdge servers. Power-limit

notification interrupts have been disabled by default and a new kernel

command line parameter "int_pln_enable" has been added to allow users to

observe these events using the existing system counters. Power-limit

notification messages are also no longer displayed on the console.

The affected platforms no longer suffer from degraded system performance

due to this problem. (BZ#1020519)

 

* Package level thermal and power limit events are not defined as MCE

errors for the x86 architecture. However, the mcelog utility erroneously

reported these events as MCE errors with the following message:

 

kernel: [Hardware Error]: Machine check events logged

 

Package level thermal and power limit events are no longer reported as MCE

errors by mcelog. When these events are triggered, they are now reported

only in the respective counters in sysfs (specifically,

/sys/devices/system/cpu/cpu/thermal_throttle/). (BZ#1021950)

 

* An insufficiently designed calculation in the CPU accelerator could cause

an arithmetic overflow in the set_cyc2ns_scale() function if the system

uptime exceeded 208 days prior to using kexec to boot into a new kernel.

This overflow led to a kernel panic on systems using the Time Stamp Counter

(TSC) clock source, primarily systems using Intel Xeon E5 processors that

do not reset TSC on soft power cycles. A patch has been applied to modify

the calculation so that this arithmetic overflow and kernel panic can no

longer occur under these circumstances. (BZ#1024453)

 

All kernel users are advised to upgrade to these updated packages, which

contain backported patches to correct these issues. The system must be

rebooted for this update to take effect.

 

4. Solution:

 

Before applying this update, make sure all previously released errata

relevant to your system have been applied.

 

This update is available via the Red Hat Network. Details on how to use the

Red Hat Network to apply this update are available at

https://access.redhat.com/site/articles/11258

 

To install kernel packages manually, use "rpm -ivh [package]". Do not use

"rpm -Uvh" as that will remove the running kernel binaries from your

system. You may use "rpm -e" to remove old kernels after determining that

the new kernel functions properly on your system.

 

5. Bugs fixed (http://bugzilla.redhat.com/):

 

869904 - CVE-2012-4508 kernel: ext4: AIO vs fallocate stale data exposure

1004233 - CVE-2013-4299 kernel: dm: dm-snapshot data leak

 

6. Package List:

 

Red Hat Enterprise Linux Compute Node EUS (v. 6.2):

 

Source:

kernel-2.6.32-220.45.1.el6.src.rpm

 

noarch:

kernel-doc-2.6.32-220.45.1.el6.noarch.rpm

kernel-firmware-2.6.32-220.45.1.el6.noarch.rpm

 

x86_64:

kernel-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debug-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debug-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debug-devel-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debuginfo-common-x86_64-2.6.32-220.45.1.el6.x86_64.rpm

kernel-devel-2.6.32-220.45.1.el6.x86_64.rpm

kernel-headers-2.6.32-220.45.1.el6.x86_64.rpm

perf-2.6.32-220.45.1.el6.x86_64.rpm

perf-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

 

Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.2):

 

Source:

kernel-2.6.32-220.45.1.el6.src.rpm

 

x86_64:

kernel-debug-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debuginfo-common-x86_64-2.6.32-220.45.1.el6.x86_64.rpm

perf-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

python-perf-2.6.32-220.45.1.el6.x86_64.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

 

Red Hat Enterprise Linux Server EUS (v. 6.2):

 

Source:

kernel-2.6.32-220.45.1.el6.src.rpm

 

i386:

kernel-2.6.32-220.45.1.el6.i686.rpm

kernel-debug-2.6.32-220.45.1.el6.i686.rpm

kernel-debug-debuginfo-2.6.32-220.45.1.el6.i686.rpm

kernel-debug-devel-2.6.32-220.45.1.el6.i686.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.i686.rpm

kernel-debuginfo-common-i686-2.6.32-220.45.1.el6.i686.rpm

kernel-devel-2.6.32-220.45.1.el6.i686.rpm

kernel-headers-2.6.32-220.45.1.el6.i686.rpm

perf-2.6.32-220.45.1.el6.i686.rpm

perf-debuginfo-2.6.32-220.45.1.el6.i686.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.i686.rpm

 

noarch:

kernel-doc-2.6.32-220.45.1.el6.noarch.rpm

kernel-firmware-2.6.32-220.45.1.el6.noarch.rpm

 

ppc64:

kernel-2.6.32-220.45.1.el6.ppc64.rpm

kernel-bootwrapper-2.6.32-220.45.1.el6.ppc64.rpm

kernel-debug-2.6.32-220.45.1.el6.ppc64.rpm

kernel-debug-debuginfo-2.6.32-220.45.1.el6.ppc64.rpm

kernel-debug-devel-2.6.32-220.45.1.el6.ppc64.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.ppc64.rpm

kernel-debuginfo-common-ppc64-2.6.32-220.45.1.el6.ppc64.rpm

kernel-devel-2.6.32-220.45.1.el6.ppc64.rpm

kernel-headers-2.6.32-220.45.1.el6.ppc64.rpm

perf-2.6.32-220.45.1.el6.ppc64.rpm

perf-debuginfo-2.6.32-220.45.1.el6.ppc64.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.ppc64.rpm

 

s390x:

kernel-2.6.32-220.45.1.el6.s390x.rpm

kernel-debug-2.6.32-220.45.1.el6.s390x.rpm

kernel-debug-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

kernel-debug-devel-2.6.32-220.45.1.el6.s390x.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

kernel-debuginfo-common-s390x-2.6.32-220.45.1.el6.s390x.rpm

kernel-devel-2.6.32-220.45.1.el6.s390x.rpm

kernel-headers-2.6.32-220.45.1.el6.s390x.rpm

kernel-kdump-2.6.32-220.45.1.el6.s390x.rpm

kernel-kdump-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

kernel-kdump-devel-2.6.32-220.45.1.el6.s390x.rpm

perf-2.6.32-220.45.1.el6.s390x.rpm

perf-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

 

x86_64:

kernel-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debug-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debug-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debug-devel-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debuginfo-common-x86_64-2.6.32-220.45.1.el6.x86_64.rpm

kernel-devel-2.6.32-220.45.1.el6.x86_64.rpm

kernel-headers-2.6.32-220.45.1.el6.x86_64.rpm

perf-2.6.32-220.45.1.el6.x86_64.rpm

perf-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

 

Red Hat Enterprise Linux Server Optional EUS (v. 6.2):

 

Source:

kernel-2.6.32-220.45.1.el6.src.rpm

 

i386:

kernel-debug-debuginfo-2.6.32-220.45.1.el6.i686.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.i686.rpm

kernel-debuginfo-common-i686-2.6.32-220.45.1.el6.i686.rpm

perf-debuginfo-2.6.32-220.45.1.el6.i686.rpm

python-perf-2.6.32-220.45.1.el6.i686.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.i686.rpm

 

ppc64:

kernel-debug-debuginfo-2.6.32-220.45.1.el6.ppc64.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.ppc64.rpm

kernel-debuginfo-common-ppc64-2.6.32-220.45.1.el6.ppc64.rpm

perf-debuginfo-2.6.32-220.45.1.el6.ppc64.rpm

python-perf-2.6.32-220.45.1.el6.ppc64.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.ppc64.rpm

 

s390x:

kernel-debug-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

kernel-debuginfo-common-s390x-2.6.32-220.45.1.el6.s390x.rpm

kernel-kdump-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

perf-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

python-perf-2.6.32-220.45.1.el6.s390x.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.s390x.rpm

 

x86_64:

kernel-debug-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

kernel-debuginfo-common-x86_64-2.6.32-220.45.1.el6.x86_64.rpm

perf-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

python-perf-2.6.32-220.45.1.el6.x86_64.rpm

python-perf-debuginfo-2.6.32-220.45.1.el6.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/#package

 

7. References:

 

https://www.redhat.com/security/data/cve/CVE-2012-4508.html

https://www.redhat.com/security/data/cve/CVE-2013-4299.html

https://access.redhat.com/security/updates/classification/#important

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2013 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.4 (GNU/Linux)

 

iD8DBQFSg8u/XlSAg2UNWIIRAu11AJ4w9FlzIAQyVEskmkkEiaxxoEQyGwCeIHTE

0iYz3l9OpRfVQj1Ranal8kI=

=Su10

-----END PGP SIGNATURE-----

 

 

--

 

Share this post

Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  
Followers 0
Go To Topic Listing Upcoming News
×