RHSA-2009:0014 - Security Advisory

Topic

Updated kernel packages that resolve several security issues and fix
various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update addresses the following security issues:

• the sendmsg() function in the Linux kernel did not block during UNIX

socket garbage collection. This could, potentially, lead to a local denial
of service. (CVE-2008-5300, Important)

• when fput() was called to close a socket, the __scm_destroy() function in

the Linux kernel could make indirect recursive calls to itself. This could,
potentially, lead to a local denial of service. (CVE-2008-5029, Important)

• a deficiency was found in the Linux kernel virtual file system (VFS)

implementation. This could allow a local, unprivileged user to make a
series of file creations within deleted directories, possibly causing a
denial of service. (CVE-2008-3275, Moderate)

• a buffer underflow flaw was found in the Linux kernel IB700 SBC watchdog

timer driver. This deficiency could lead to a possible information leak. By
default, the "/dev/watchdog" device is accessible only to the root user.
(CVE-2008-5702, Low)

• the hfs and hfsplus file systems code failed to properly handle corrupted

data structures. This could, potentially, lead to a local denial of
service. (CVE-2008-4933, CVE-2008-5025, Low)

• a flaw was found in the hfsplus file system implementation. This could,

potentially, lead to a local denial of service when write operations were
performed. (CVE-2008-4934, Low)

This update also fixes the following bugs:

• when running Red Hat Enterprise Linux 4.6 and 4.7 on some systems running

Intel® CPUs, the cpuspeed daemon did not run, preventing the CPU speed from
being changed, such as not being reduced to an idle state when not in use.

• mmap() could be used to gain access to beyond the first megabyte of RAM,

due to insufficient checks in the Linux kernel code. Checks have been added
to prevent this.

• attempting to turn keyboard LEDs on and off rapidly on keyboards with

slow keyboard controllers, may have caused key presses to fail.

• after migrating a hypervisor guest, the MAC address table was not

updated, causing packet loss and preventing network connections to the
guest. Now, a gratuitous ARP request is sent after migration. This
refreshes the ARP caches, minimizing network downtime.

• writing crash dumps with diskdump may have caused a kernel panic on

Non-Uniform Memory Access (NUMA) systems with certain memory
configurations.

• on big-endian systems, such as PowerPC, the getsockopt() function

incorrectly returned 0 depending on the parameters passed to it when the
time to live (TTL) value equaled 255, possibly causing memory corruption
and application crashes.

• a problem in the kernel packages provided by the RHSA-2008:0508 advisory

caused the Linux kernel's built-in memory copy procedure to return the
wrong error code after recovering from a page fault on AMD64 and Intel 64
systems. This may have caused other Linux kernel functions to return wrong
error codes.

• a divide-by-zero bug in the Linux kernel process scheduler, which may

have caused kernel panics on certain systems, has been resolved.

• the netconsole kernel module caused the Linux kernel to hang when slave

interfaces of bonded network interfaces were started, resulting in a system
hang or kernel panic when restarting the network.

• the "/proc/xen/" directory existed even if systems were not running Red

Hat Virtualization. This may have caused problems for third-party software
that checks virtualization-ability based on the existence of "/proc/xen/".
Note: this update will remove the "/proc/xen/" directory on systems not
running Red Hat Virtualization.

All Red Hat Enterprise Linux 4 users should upgrade to these updated
packages, which contain backported patches to resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7 ppc

Fixes

• BZ - 248710 - Local keyboard DoS through LED switching
• BZ - 457858 - CVE-2008-3275 Linux kernel local filesystem DoS
• BZ - 460862 - kernel: devmem: add range_is_allowed() check to mmap_mem() [rhel-4.7.z]
• BZ - 469631 - CVE-2008-4933 kernel: hfsplus: fix Buffer overflow with a corrupted image
• BZ - 469640 - CVE-2008-4934 kernel: hfsplus: check read_mapping_page() return value
• BZ - 469891 - lost packets when live migrating (RHEL4 XEN)
• BZ - 470034 - HP-Japan: RHEL4.6 diskdump fails when NUMA is on
• BZ - 470196 - getsockopt() returning incorrectly in PPC
• BZ - 470201 - CVE-2008-5029 kernel: Unix sockets kernel panic
• BZ - 470769 - CVE-2008-5025 kernel: hfs: fix namelength memory corruption
• BZ - 471015 - RHSA-2008:0508 linux-2.6.9-x86_64-copy_user-zero-tail.patch broken
• BZ - 471222 - erroneous load balancing for isolated CPUs leads to divide-by-zero panic in find_busiest_group()
• BZ - 471391 - netconsole hang the system on ifenslave operation
• BZ - 473259 - CVE-2008-5300 kernel: fix soft lockups/OOM issues with unix socket garbage collector
• BZ - 475733 - CVE-2008-5702 kernel: watchdog: ib700wdt.c - buffer_underflow bug
• BZ - 476534 - Xen balloon driver on RHEL4 x86_64 with 2.6.9-78.0.1.ELsmp

CVEs

• CVE-2008-3275
• CVE-2008-4933
• CVE-2008-5029
• CVE-2008-4934
• CVE-2008-5300
• CVE-2008-5025
• CVE-2008-5702

References

• http://www.redhat.com/security/updates/classification/#important