RHSA-2009:1211 - Security Advisory

Topic

Updated kernel packages that fix several security issues and several bugs
are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

These updated packages fix the following security issues:

• Michael Tokarev reported a flaw in the Realtek r8169 Ethernet driver in

the Linux kernel. This driver allowed interfaces using this driver to
receive frames larger than what could be handled. This could lead to a
remote denial of service or code execution. (CVE-2009-1389, Important)

• a buffer overflow flaw was found in the CIFSTCon() function of the Linux

kernel Common Internet File System (CIFS) implementation. When mounting a
CIFS share, a malicious server could send an overly-long string to the
client, possibly leading to a denial of service or privilege escalation on
the client mounting the CIFS share. (CVE-2009-1439, Important)

• several flaws were found in the way the Linux kernel CIFS implementation

handles Unicode strings. CIFS clients convert Unicode strings sent by a
server to their local character sets, and then write those strings into
memory. If a malicious server sent a long enough string, it could write
past the end of the target memory region and corrupt other memory areas,
possibly leading to a denial of service or privilege escalation on the
client mounting the CIFS share. (CVE-2009-1633, Important)

These updated packages also fix the following bugs:

• when using network bonding in the "balance-tlb" or "balance-alb" mode,

the primary setting for the primary slave device was lost when said
device was brought down (ifdown). Bringing the slave interface back up
(ifup) did not restore the primary setting (the device was not made the
active slave). (BZ#507563)

• a bug in timer_interrupt() may have caused the system time to move up to

two days or more into the future, or to be delayed for several minutes.
This bug only affected Intel 64 and AMD64 systems that have the High
Precision Event Timer (HPET) enabled in the BIOS, and could have caused
problems for applications that require timing to be accurate. (BZ#508835)

• a race condition was resolved in the Linux kernel block layer between

show_partition() and rescan_partitions(). This could have caused a NULL
pointer dereference in show_partition(), leading to a system crash (kernel
panic). This issue was most likely to occur on systems running monitoring
software that regularly scanned hard disk partitions, or from repeatedly
running commands that probe for partition information. (BZ#512310)

• previously, the Stratus memory tracker missed certain modified pages.

With this update, information about the type of page (small page or
huge page) is passed to the Stratus memory tracker, which resolves this
issue. The fix for this issue does not affect systems that do not use
memory tracking. (BZ#513182)

• a bug may have caused a system crash when using the cciss driver, due to

an uninitialized kernel structure. A reported case of this issue occurred
after issuing consecutive SCSI TUR commands (sg_turs sends SCSI
test-unit-ready commands in a loop). (BZ#513189)

• a bug in the SCSI implementation caused "Aborted Command - internal

target failure" errors to be sent to Device-Mapper Multipath, without
retries, resulting in Device-Mapper Multipath marking the path as failed
and making a path group switch. With this update, all errors that return a
sense key in the SCSI mid layer (including "Aborted Command - internal
target failure") are retried. (BZ#514007)

Users should upgrade to these updated packages, which contain backported
patches to correct these issues. The system must be rebooted for this
update to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc

Fixes

• BZ - 494275 - CVE-2009-1439 kernel: cifs: memory overwrite when saving nativeFileSystem field during mount
• BZ - 496572 - CVE-2009-1633 kernel: cifs: fix potential buffer overruns when converting unicode strings sent by server
• BZ - 504726 - CVE-2009-1389 kernel: r8169: fix crash when large packets are received
• BZ - 507563 - A bond's preferred primary setting is lost after bringing down and up of the primary slave.
• BZ - 508835 - [4.6] The system time leaps 2 days 21 hours 41 min future.
• BZ - 512310 - show_partition() oops when race with rescan_partitions().
• BZ - 513182 - Function unmap_hugepage_range passing PMD instead of PTE to ptep_get_and_clear
• BZ - 513189 - RHEL4.8: crash in do_cciss_request()
• BZ - 514007 - Make Aborted Command (internal target failure) retryable at SCSI layer (sense B 44 00)

CVEs

• CVE-2009-1439
• CVE-2009-1633
• CVE-2009-1389

References

• http://www.redhat.com/security/updates/classification/#important