RHSA-2008:1017 - Security Advisory

Topic

Updated kernel packages that resolve several security issues and fix
various bugs are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

• Olaf Kirch reported a flaw in the i915 kernel driver. This flaw could,

potentially, lead to local privilege escalation. Note: the flaw only
affects systems based on the Intel G33 Express Chipset and newer.
(CVE-2008-3831, Important)

• Miklos Szeredi reported a missing check for files opened with O_APPEND in

the sys_splice(). This could allow a local, unprivileged user to bypass the
append-only file restrictions. (CVE-2008-4554, Important)

• a deficiency was found in the Linux kernel Stream Control Transmission

Protocol (SCTP) implementation. This could lead to a possible denial of
service if one end of a SCTP connection did not support the AUTH extension.
(CVE-2008-4576, Important)

In addition, these updated packages fix the following bugs:

• on Itanium(r) systems, when a multithreaded program was traced using the

command "strace -f", messages such as

PANIC: attached pid 10740 exited
PANIC: handle_group_exit: 10740 leader 10721
...

will be displayed, and after which the trace would stop. With these
updated packages, "strace -f" command no longer results in these error
messages, and strace terminates normally after tracing all threads.

• on big-endian systems such as PowerPC, the getsockopt() function

incorrectly returned 0 depending on the parameters passed to it when the
time to live (TTL) value equaled 255.

• when using an NFSv4 file system, accessing the same file with two

separate processes simultaneously resulted in the NFS client process
becoming unresponsive.

• on AMD64 and Intel(r) 64 hypervisor-enabled systems, when a syscall

correctly returned '-1' in code compiled on Red Hat Enterprise Linux 5, the
same code, when run with the strace utility, would incorrectly return an
invalid return value. This has been fixed: on AMD64 and Intel(r) 64
hypervisor-enabled systems, syscalls in compiled code return the same,
correct values as syscalls run with strace.

• on the Itanium(r) architecture, fully-virtualized guest domains created

using more than 64 GB of memory caused other guest domains not to receive
interrupts. This caused soft lockups on other guests. All guest domains are
now able to receive interrupts regardless of their allotted memory.

• when user-space used SIGIO notification, which was not disabled before

closing a file descriptor and was then re-enabled in a different process,
an attempt by the kernel to dereference a stale pointer led to a kernel
crash. With this fix, such a situation no longer causes a kernel crash.

• modifications to certain pages made through a memory-mapped region could

have been lost in cases when the NFS client needed to invalidate the page
cache for that particular memory-mapped file.

• fully-virtualized Windows(r) guests became unresponsive due to the vIOSAPIC

component being multiprocessor-unsafe. With this fix, vIOSAPIC is
multiprocessor-safe and Windows guests do not become unresponsive.

• on certain systems, keyboard controllers could not withstand continuous

requests to switch keyboard LEDs on or off. This resulted in some or all
key presses not being registered by the system.

• on the Itanium(r) architecture, setting the "vm.nr_hugepages" sysctl

parameter caused a kernel stack overflow resulting in a kernel panic, and
possibly stack corruption. With this fix, setting vm.nr_hugepages works
correctly.

• hugepages allow the Linux kernel to utilize the multiple page size

capabilities of modern hardware architectures. In certain configurations,
systems with large amounts of memory could fail to allocate most of this
memory for hugepages even if it was free. This could result, for example,
in database restart failures.

Users should upgrade to these updated packages, which contain backported
patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.2 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.2 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 248710 - Local keyboard DoS through LED switching
• BZ - 450335 - LTC41974-Pages of a memory mapped NFS file get corrupted.
• BZ - 459080 - [Xen][5.2.z] softlockup occurs while creating a guest which has large memory.
• BZ - 464502 - CVE-2008-3831 kernel: i915 kernel drm driver arbitrary ioremap
• BZ - 465744 - kernel: rtc: fix kernel panic on second use of SIGIO notification
• BZ - 466079 - CVE-2008-4576 kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH
• BZ - 466707 - CVE-2008-4554 kernel: don't allow splice() to files opened with O_APPEND
• BZ - 467727 - [Xen][5.2] Network Performance Test causes Guest Hang.
• BZ - 469150 - [REG][5.2] The trace of some threads unexpectedly stops when being traced by 'strace -f'.
• BZ - 469649 - getsockopt() returning incorrectly in PPC
• BZ - 469650 - [REG][5.2][NFSv4] Accessing the same file at the same time causes NFSv4 open() call to stall forever on NFS4ERR_DELAY
• BZ - 470853 - [RHEL5.2]: Running strace with a bad syscall doesn't return -ENOSYS
• BZ - 474347 - [REG][5.3] Kernel panics when you prepare hugepages.
• BZ - 474760 - [RHEL5 patch] Allow hugepage allocation to use most of memory.

CVEs

• CVE-2008-4554
• CVE-2008-3831
• CVE-2008-4576

References

• http://www.redhat.com/security/updates/classification/#important