RHSA-2009:1193 - Security Advisory

Topic

Updated kernel packages that fix several security issues and several bugs
are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security fixes:

• the possibility of a timeout value overflow was found in the Linux kernel

high-resolution timers functionality, hrtimers. This could allow a local,
unprivileged user to execute arbitrary code, or cause a denial of service
(kernel panic). (CVE-2007-5966, Important)

• a flaw was found in the Intel PRO/1000 network driver in the Linux

kernel. Frames with sizes near the MTU of an interface may be split across
multiple hardware receive descriptors. Receipt of such a frame could leak
through a validation check, leading to a corruption of the length check. A
remote attacker could use this flaw to send a specially-crafted packet that
would cause a denial of service or code execution. (CVE-2009-1385,
Important)

• Michael Tokarev reported a flaw in the Realtek r8169 Ethernet driver in

the Linux kernel. This driver allowed interfaces using this driver to
receive frames larger than could be handled, which could lead to a remote
denial of service or code execution. (CVE-2009-1389, Important)

• the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a

setuid or setgid program was executed. A local, unprivileged user could use
this flaw to bypass the mmap_min_addr protection mechanism and perform a
NULL pointer dereference attack, or bypass the Address Space Layout
Randomization (ASLR) security feature. (CVE-2009-1895, Important)

• Ramon de Carvalho Valle reported two flaws in the Linux kernel eCryptfs

implementation. A local attacker with permissions to perform an eCryptfs
mount could modify the metadata of the files in that eCrypfts mount to
cause a buffer overflow, leading to a denial of service or privilege
escalation. (CVE-2009-2406, CVE-2009-2407, Important)

• Konstantin Khlebnikov discovered a race condition in the ptrace

implementation in the Linux kernel. This race condition can occur when the
process tracing and the process being traced participate in a core dump. A
local, unprivileged user could use this flaw to trigger a deadlock,
resulting in a partial denial of service. (CVE-2009-1388, Moderate)

Bug fixes (see References below for a link to more detailed notes):

• possible dom0 crash when a Xen para-virtualized guest was installed while

another para-virtualized guest was rebooting. (BZ#497812)

• no directory removal audit record if the directory and its subtree were

recursively watched by an audit rule. (BZ#507561)

• running "echo 1 > /proc/sys/vm/drop_caches" under high memory load could

cause a kernel panic. (BZ#503692)

• on 32-bit systems, core dumps for some multithreaded applications did not

include all thread information. (BZ#505322)

• a stack buffer used by get_event_name() was too small for nul terminator

sprintf() writes. This could lead to an invalid pointer or kernel panic.
(BZ#506906)

• when using the aic94xx driver, systems with SATA drives may not boot due

to a libsas bug. (BZ#506029)

• Wacom Cintiq 21UX and Intuos stylus buttons were handled incorrectly when

moved away from and back to these tablets. (BZ#508275)

• CPU "soft lockup" messages and possibe system hangs on systems with

certain Broadcom network devices and running the Linux kernel from the
kernel-xen package. (BZ#503689)

• on 64-bit PowerPC, getitimer() failed for programs using the ITIMER_REAL

timer that were also compiled for 64-bit systems. This caused such programs
to abort. (BZ#510018)

• write operations could be blocked even when using O_NONBLOCK. (BZ#510239)
• the "pci=nomsi" option was required for installing and booting Red Hat

Enterprise Linux 5.2 on systems with VIA VT3364 chipsets. (BZ#507529)

• shutting down, destroying, or migrating Xen guests with large amounts of

memory could cause other guests to be temporarily unresponsive. (BZ#512311)

Users should upgrade to these updated packages, which contain backported
patches to correct these issues. Systems must be rebooted for this update
to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.3 i386
• Red Hat Enterprise Linux Server - AUS 5.3 x86_64
• Red Hat Enterprise Linux Server - AUS 5.3 ia64
• Red Hat Enterprise Linux Server - AUS 5.3 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 453135 - CVE-2007-5966 kernel: non-root can trigger cpu_idle soft lockup
• BZ - 497812 - RH5.3 x64 RC2 reboots while installing a virtual machine
• BZ - 502981 - CVE-2009-1385 kernel: e1000_clean_rx_irq() denial of service
• BZ - 503689 - Call trace thrown up when stressing the network with bw_tcp
• BZ - 503692 - Possible panic when drop_pagecache_sb() and prune_icache() run concurrently.
• BZ - 504263 - CVE-2009-1388 kernel: do_coredump() vs ptrace_start() deadlock
• BZ - 504726 - CVE-2009-1389 kernel: r8169: fix crash when large packets are received
• BZ - 505322 - [Reg][RHEL5.3] Multi-threaded application dumps a core with wrong thread information
• BZ - 506029 - With Red Hat errata 128.1.6 installed system hangs with SATA drives installed.
• BZ - 506906 - kernel: TPM: get_event_name stack corruption [rhel-5.3.z]
• BZ - 507529 - disable MSI on VIA VT3364 chipsets
• BZ - 507561 - Removal of directory doesn't produce audit record if rule is recursive
• BZ - 508275 - Wacom driver with Intuos tablet does not report button press after a proximity leave/re-enter
• BZ - 510018 - setitimer(ITIMER_REAL, ...) failing in 64bit enviroment
• BZ - 510239 - [5.3]Write operation with O_NONBLOCK flag to TTY terminal is blocked
• BZ - 511171 - CVE-2009-1895 kernel: personality: fix PER_CLEAR_ON_SETID
• BZ - 512311 - A Shut down of a 32GB domU's freezes other domU's for several seconds
• BZ - 512861 - CVE-2009-2406 kernel: ecryptfs stack overflow in parse_tag_11_packet()
• BZ - 512885 - CVE-2009-2407 kernel: ecryptfs heap overflow in parse_tag_3_packet()

CVEs

• CVE-2007-5966
• CVE-2009-1385
• CVE-2009-1389
• CVE-2009-1895
• CVE-2009-1388
• CVE-2009-2406
• CVE-2009-2407

References

• http://www.redhat.com/security/updates/classification/#important
• http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.4/html/Technical_Notes/kernel.html#RHSA-2009-1193