Synopsis: Important: kernel security and bug fix update
Issue date: 2010-07-01
CVE Names: CVE-2010-0291 CVE-2010-0622 CVE-2010-1087
CVE-2010-1088 CVE-2010-1173 CVE-2010-1187
CVE-2010-1436 CVE-2010-1437 CVE-2010-1641
This update fixes the following security issues:
* multiple flaws were found in the mmap and mremap implementations. A
local user could use these flaws to cause a local denial of service or
escalate their privileges. (CVE-2010-0291, Important)
* a NULL pointer dereference flaw was found in the Fast Userspace
Mutexes (futexes) implementation. The unlock code path did not check if
the futex value associated with pi_state->owner had been modified. A
local user could use this flaw to modify the futex value, possibly
leading to a denial of service or privilege escalation when the
pi_state->owner pointer is dereferenced. (CVE-2010-0622, Important)
* a NULL pointer dereference flaw was found in the Linux kernel Network
File System (NFS) implementation. A local user on a system that has an
NFS-mounted file system could use this flaw to cause a denial of service
or escalate their privileges on that system. (CVE-2010-1087, Important)
* a flaw was found in the sctp_process_unk_param() function in the Linux
kernel Stream Control Transmission Protocol (SCTP) implementation. A
remote attacker could send a specially-crafted SCTP packet to an SCTP
listening port on a target system, causing a kernel panic (denial of
service). (CVE-2010-1173, Important)
* a flaw was found in the Linux kernel Transparent Inter-Process
Communication protocol (TIPC) implementation. If a client application,
on a local system where the tipc module is not yet in network mode,
attempted to send a message to a remote TIPC node, it would dereference
a NULL pointer on the local system, causing a kernel panic (denial of
service). (CVE-2010-1187, Important)
* a buffer overflow flaw was found in the Linux kernel Global File
System 2 (GFS2) implementation. In certain cases, a quota could be
written past the end of a memory page, causing memory corruption,
leaving the quota stored on disk in an invalid state. A user with write
access to a GFS2 file system could trigger this flaw to cause a kernel
crash (denial of service) or escalate their privileges on the GFS2
server. This issue can only be triggered if the GFS2 file system is
mounted with the "quota=on" or "quota=account" mount option.
(CVE-2010-1436, Important)
* a race condition between finding a keyring by name and destroying a
freed keyring was found in the Linux kernel key management facility. A
local user could use this flaw to cause a kernel panic (denial of
service) or escalate their privileges. (CVE-2010-1437, Important)
* a flaw was found in the link_path_walk() function in the Linux kernel.
Using the file descriptor returned by the open() function with the
O_NOFOLLOW flag on a subordinate NFS-mounted file system, could result
in a NULL pointer dereference, causing a denial of service or privilege
escalation. (CVE-2010-1088, Moderate)
* a missing permission check was found in the gfs2_set_flags() function
in the Linux kernel GFS2 implementation. A local user could use this
flaw to change certain file attributes of files, on a GFS2 file system,
that they do not own. (CVE-2010-1641, Low)
Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon
Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer,
for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly
reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting
CVE-2010-1641.
This update also fixes several bugs.
The system must be rebooted for this update to take effect.
SL 5.x
SRPMS:
kernel-2.6.18-194.8.1.el5.src.rpm
i386:
kernel-2.6.18-194.8.1.el5.i686.rpm
kernel-debug-2.6.18-194.8.1.el5.i686.rpm
kernel-debug-devel-2.6.18-194.8.1.el5.i686.rpm
kernel-devel-2.6.18-194.8.1.el5.i686.rpm
kernel-doc-2.6.18-194.8.1.el5.noarch.rpm
kernel-module-aufs-2.6.18-194.8.1.el5-0.20090202.cvs-6.sl5.i686.rpm
kernel-module-aufs-2.6.18-194.8.1.el5PAE-0.20090202.cvs-6.sl5.i686.rpm
kernel-module-aufs-2.6.18-194.8.1.el5xen-0.20090202.cvs-6.sl5.i686.rpm
kernel-module-ndiswrapper-2.6.18-194.8.1.el5-1.55-1.SL.i686.rpm
kernel-module-ndiswrapper-2.6.18-194.8.1.el5PAE-1.55-1.SL.i686.rpm
kernel-module-ndiswrapper-2.6.18-194.8.1.el5xen-1.55-1.SL.i686.rpm
kernel-module-xfs-2.6.18-194.8.1.el5-0.4-2.sl5.i686.rpm
kernel-module-xfs-2.6.18-194.8.1.el5PAE-0.4-2.sl5.i686.rpm
kernel-module-xfs-2.6.18-194.8.1.el5xen-0.4-2.sl5.i686.rpm
kernel-PAE-2.6.18-194.8.1.el5.i686.rpm
kernel-PAE-devel-2.6.18-194.8.1.el5.i686.rpm
kernel-xen-2.6.18-194.8.1.el5.i686.rpm
kernel-xen-devel-2.6.18-194.8.1.el5.i686.rpm
Dependancies for SL 55:
kernel-module-openafs-2.6.18-194.8.1.el5-1.4.12-79.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.8.1.el5PAE-1.4.12-79.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.8.1.el5xen-1.4.12-79.sl5.i686.rpm
Dependancies for SL 54:
kernel-module-openafs-2.6.18-194.8.1.el5-1.4.11-76.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.8.1.el5PAE-1.4.11-76.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.8.1.el5xen-1.4.11-76.sl5.i686.rpm
Dependancies for SL 50-53:
kernel-module-ipw3945-2.6.18-194.8.1.el5-1.2.0-2.sl5.i686.rpm
kernel-module-ipw3945-2.6.18-194.8.1.el5PAE-1.2.0-2.sl5.i686.rpm
kernel-module-ipw3945-2.6.18-194.8.1.el5xen-1.2.0-2.sl5.i686.rpm
kernel-module-madwifi-2.6.18-194.8.1.el5-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-2.6.18-194.8.1.el5PAE-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-2.6.18-194.8.1.el5xen-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-hal-2.6.18-194.8.1.el5-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-hal-2.6.18-194.8.1.el5PAE-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-hal-2.6.18-194.8.1.el5xen-0.9.4-15.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.8.1.el5-1.4.11-76.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.8.1.el5PAE-1.4.11-76.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.8.1.el5xen-1.4.11-76.sl5.i686.rpm
x86_64:
kernel-2.6.18-194.8.1.el5.x86_64.rpm
kernel-debug-2.6.18-194.8.1.el5.x86_64.rpm
kernel-debug-devel-2.6.18-194.8.1.el5.x86_64.rpm
kernel-devel-2.6.18-194.8.1.el5.x86_64.rpm
kernel-doc-2.6.18-194.8.1.el5.noarch.rpm
kernel-headers-2.6.18-194.8.1.el5.x86_64.rpm
kernel-module-aufs-2.6.18-194.8.1.el5-0.20090202.cvs-6.sl5.x86_64.rpm
kernel-module-aufs-2.6.18-194.8.1.el5xen-0.20090202.cvs-6.sl5.x86_64.rpm
kernel-module-ndiswrapper-2.6.18-194.8.1.el5-1.55-1.SL.x86_64.rpm
kernel-module-ndiswrapper-2.6.18-194.8.1.el5xen-1.55-1.SL.x86_64.rpm
kernel-xen-2.6.18-194.8.1.el5.x86_64.rpm
kernel-xen-devel-2.6.18-194.8.1.el5.x86_64.rpm
Dependancies for SL 55:
kernel-module-openafs-2.6.18-194.8.1.el5-1.4.12-79.sl5.x86_64.rpm
kernel-module-openafs-2.6.18-194.8.1.el5xen-1.4.12-79.sl5.x86_64.rpm
Dependancies for SL 54:
kernel-module-openafs-2.6.18-194.8.1.el5-1.4.11-76.sl5.x86_64.rpm
kernel-module-openafs-2.6.18-194.8.1.el5xen-1.4.11-76.sl5.x86_64.rpm
Dependancies for SL 50-53:
kernel-module-ipw3945-2.6.18-194.8.1.el5-1.2.0-2.sl5.x86_64.rpm
kernel-module-ipw3945-2.6.18-194.8.1.el5xen-1.2.0-2.sl5.x86_64.rpm
kernel-module-madwifi-2.6.18-194.8.1.el5-0.9.4-15.sl5.x86_64.rpm
kernel-module-madwifi-2.6.18-194.8.1.el5xen-0.9.4-15.sl5.x86_64.rpm
kernel-module-madwifi-hal-2.6.18-194.8.1.el5-0.9.4-15.sl5.x86_64.rpm
kernel-module-madwifi-hal-2.6.18-194.8.1.el5xen-0.9.4-15.sl5.x86_64.rpm
kernel-module-openafs-2.6.18-194.8.1.el5-1.4.11-76.sl5.x86_64.rpm
kernel-module-openafs-2.6.18-194.8.1.el5xen-1.4.11-76.sl5.x86_64.rpm
-Connie Sieh
-Troy Dawson
|
