- Issued:
- 2007-06-25
- Updated:
- 2007-06-25
RHSA-2007:0488 - Security Advisory
Synopsis
Important: kernel security update
Type/Severity
Security Advisory: Important
Topic
Updated kernel packages that fix several security issues and bugs in the
Red Hat Enterprise Linux 4 kernel are now available.
This security advisory has been rated as having important security impact
by the Red Hat Security Response Team.
Description
The Linux kernel handles the basic functions of the operating system.
These new kernel packages contain fixes for the security issues described
below:
- a flaw in the connection tracking support for SCTP that allowed a remote
user to cause a denial of service by dereferencing a NULL pointer.
(CVE-2007-2876, Important) - a flaw in the mount handling routine for 64-bit systems that allowed a
local user to cause denial of service (crash). (CVE-2006-7203, Important) - a flaw in the IPv4 forwarding base that allowed a local user to cause an
out-of-bounds access. (CVE-2007-2172, Important) - a flaw in the PPP over Ethernet implementation that allowed a local user
to cause a denial of service (memory consumption) by creating a socket
using connect and then releasing it before the PPPIOCGCHAN ioctl has been
called. (CVE-2007-2525, Important) - a flaw in the fput ioctl handling of 32-bit applications running on
64-bit platforms that allowed a local user to cause a denial of service
(panic). (CVE-2007-0773, Important) - a flaw in the NFS locking daemon that allowed a local user to cause
denial of service (deadlock). (CVE-2006-5158, Moderate) - a flaw in the sysfs_readdir function that allowed a local user to cause a
denial of service by dereferencing a NULL pointer. (CVE-2007-3104, Moderate) - a flaw in the core-dump handling that allowed a local user to create core
dumps from unreadable binaries via PT_INTERP. (CVE-2007-0958, Low) - a flaw in the Bluetooth subsystem that allowed a local user to trigger an
information leak. (CVE-2007-1353, Low)
In addition, the following bugs were addressed:
- the NFS could recurse on the same spinlock. Also, NFS, under certain
conditions, did not completely clean up Posix locks on a file close,
leading to mount failures. - the 32bit compatibility didn't return to userspace correct values for the
rt_sigtimedwait system call. - the count for unused inodes could be incorrect at times, resulting in
dirty data not being written to disk in a timely manner. - the cciss driver had an incorrect disk size calculation (off-by-one
error) which prevented disk dumps.
Red Hat would like to thank Ilja van Sprundel and the OpenVZ Linux kernel
team for reporting issues fixed in this erratum.
All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels
to the packages associated with their machine architectures and
configurations as listed in this erratum.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
Affected Products
- Red Hat Enterprise Linux Server 4 x86_64
- Red Hat Enterprise Linux Server 4 ia64
- Red Hat Enterprise Linux Server 4 i386
- Red Hat Enterprise Linux Server - Extended Update Support 4.5 x86_64
- Red Hat Enterprise Linux Server - Extended Update Support 4.5 ia64
- Red Hat Enterprise Linux Server - Extended Update Support 4.5 i386
- Red Hat Enterprise Linux Workstation 4 x86_64
- Red Hat Enterprise Linux Workstation 4 ia64
- Red Hat Enterprise Linux Workstation 4 i386
- Red Hat Enterprise Linux Desktop 4 x86_64
- Red Hat Enterprise Linux Desktop 4 i386
- Red Hat Enterprise Linux for IBM z Systems 4 s390x
- Red Hat Enterprise Linux for IBM z Systems 4 s390
- Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390x
- Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390
- Red Hat Enterprise Linux for Power, big endian 4 ppc
- Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5 ppc
Fixes
- BZ - 240855 - kernel spinlock panic in inode.c
- BZ - 241784 - dirty data is not flushed on a timely manner
- BZ - 242558 - CVE-2007-3104 Null pointer to an inode in a dentry can cause an oops in sysfs_readdir
- BZ - 243251 - CVE-2006-5158 NFS lockd deadlock
- BZ - 243252 - CVE-2007-0773 lost fput in a 32-bit ioctl on 64-bit x86 systems
- BZ - 243256 - CVE-2007-0958 core-dumping unreadable binaries via PT_INTERP
- BZ - 243259 - CVE-2007-1353 Bluetooth setsockopt() information leaks
- BZ - 243261 - CVE-2007-2172 fib_semantics.c out of bounds access vulnerability
- BZ - 243262 - CVE-2007-2525 PPPoE socket PPPIOCGCHAN denial of service
- BZ - 243263 - CVE-2006-7203 oops in compat_sys_mount() when data pointer is NULL
- BZ - 243746 - CVE-2007-2876 {ip, nf}_conntrack_sctp: remotely triggerable NULL ptr dereference
- BZ - 243902 - diskdump to cciss fails due to off-by-one size calculation
CVEs
- CVE-2007-0958
- CVE-2007-2172
- CVE-2007-2525
- CVE-2006-7203
- CVE-2007-1353
- CVE-2007-0773
- CVE-2006-5158
- CVE-2007-3104
- CVE-2007-2876
References
Note:
More recent versions of these packages may be available.
Click a package name for more details.
Red Hat Enterprise Linux Server 4
| SRPM | |
|---|---|
| x86_64 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| ia64 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| i386 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
Red Hat Enterprise Linux Server - Extended Update Support 4.5
| SRPM | |
|---|---|
| x86_64 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| ia64 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| i386 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
Red Hat Enterprise Linux Workstation 4
| SRPM | |
|---|---|
| x86_64 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| ia64 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| i386 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
Red Hat Enterprise Linux Desktop 4
| SRPM | |
|---|---|
| x86_64 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| i386 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
Red Hat Enterprise Linux for IBM z Systems 4
| SRPM | |
|---|---|
| s390x | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| s390 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5
| SRPM | |
|---|---|
| s390x | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| s390 | |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
Red Hat Enterprise Linux for Power, big endian 4
| SRPM | |
|---|---|
| ppc | |
| kernel-2.6.9-55.0.2.EL.ppc64.rpm | SHA-256: b51ec3ef92b78bedbac925e25f2235790281e8c69468278781813f0fa7976693 |
| kernel-2.6.9-55.0.2.EL.ppc64iseries.rpm | SHA-256: 20984b4f0672d12d423709f68d57bef0cffaac4e34dd0fb24a8c0b9071dc378e |
| kernel-devel-2.6.9-55.0.2.EL.ppc64.rpm | SHA-256: c8a58b2dccf4da5fee9f501ed782f49747dae68bd11b222a3c58cdc9d05895ac |
| kernel-devel-2.6.9-55.0.2.EL.ppc64iseries.rpm | SHA-256: 6937c098ea02a639047faa50fdb78c7934e4a9ef732edd302e70545ec63f2dc0 |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| kernel-largesmp-2.6.9-55.0.2.EL.ppc64.rpm | SHA-256: 9208b12ae4796919499804dac88b85befa98ca9df6c2f277323e051e716a3010 |
| kernel-largesmp-devel-2.6.9-55.0.2.EL.ppc64.rpm | SHA-256: 0dc272e60d673b661259a608b174f16a77b0190a3331f6731e65ba0b11c7cf8a |
Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5
| SRPM | |
|---|---|
| ppc | |
| kernel-2.6.9-55.0.2.EL.ppc64.rpm | SHA-256: b51ec3ef92b78bedbac925e25f2235790281e8c69468278781813f0fa7976693 |
| kernel-2.6.9-55.0.2.EL.ppc64iseries.rpm | SHA-256: 20984b4f0672d12d423709f68d57bef0cffaac4e34dd0fb24a8c0b9071dc378e |
| kernel-devel-2.6.9-55.0.2.EL.ppc64.rpm | SHA-256: c8a58b2dccf4da5fee9f501ed782f49747dae68bd11b222a3c58cdc9d05895ac |
| kernel-devel-2.6.9-55.0.2.EL.ppc64iseries.rpm | SHA-256: 6937c098ea02a639047faa50fdb78c7934e4a9ef732edd302e70545ec63f2dc0 |
| kernel-doc-2.6.9-55.0.2.EL.noarch.rpm | SHA-256: caaae8494b1cd897b9793991535147c416bf4ddf5863d8aec1f7e4e65e0e5ad1 |
| kernel-largesmp-2.6.9-55.0.2.EL.ppc64.rpm | SHA-256: 9208b12ae4796919499804dac88b85befa98ca9df6c2f277323e051e716a3010 |
| kernel-largesmp-devel-2.6.9-55.0.2.EL.ppc64.rpm | SHA-256: 0dc272e60d673b661259a608b174f16a77b0190a3331f6731e65ba0b11c7cf8a |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.