RHSA-2010:0842 - Security Advisory

Topic

Updated kernel packages that fix multiple security issues and several bugs
are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

[Updated 22 November 2010]
The packages list in this erratum has been updated to include four missing
debuginfo-common packages (one per architecture). No changes have been made
to the original packages.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issues:

• Missing sanity checks in the Intel i915 driver in the Linux kernel could

allow a local, unprivileged user to escalate their privileges.
(CVE-2010-2962, Important)

• compat_alloc_user_space() in the Linux kernel 32/64-bit compatibility

layer implementation was missing sanity checks. This function could be
abused in other areas of the Linux kernel if its length argument can be
controlled from user-space. On 64-bit systems, a local, unprivileged user
could use this flaw to escalate their privileges. (CVE-2010-3081,
Important)

• A buffer overflow flaw in niu_get_ethtool_tcam_all() in the niu Ethernet

driver in the Linux kernel, could allow a local user to cause a denial of
service or escalate their privileges. (CVE-2010-3084, Important)

• A flaw in the IA32 system call emulation provided in 64-bit Linux kernels

could allow a local user to escalate their privileges. (CVE-2010-3301,
Important)

• A flaw in sctp_packet_config() in the Linux kernel's Stream Control

Transmission Protocol (SCTP) implementation could allow a remote attacker
to cause a denial of service. (CVE-2010-3432, Important)

• A missing integer overflow check in snd_ctl_new() in the Linux kernel's

sound subsystem could allow a local, unprivileged user on a 32-bit system
to cause a denial of service or escalate their privileges. (CVE-2010-3442,
Important)

• A flaw was found in sctp_auth_asoc_get_hmac() in the Linux kernel's SCTP

implementation. When iterating through the hmac_ids array, it did not reset
the last id element if it was out of range. This could allow a remote
attacker to cause a denial of service. (CVE-2010-3705, Important)

• A function in the Linux kernel's Reliable Datagram Sockets (RDS) protocol

implementation was missing sanity checks, which could allow a local,
unprivileged user to escalate their privileges. (CVE-2010-3904, Important)

• A flaw in drm_ioctl() in the Linux kernel's Direct Rendering Manager

(DRM) implementation could allow a local, unprivileged user to cause an
information leak. (CVE-2010-2803, Moderate)

• It was found that wireless drivers might not always clear allocated

buffers when handling a driver-specific IOCTL information request. A local
user could trigger this flaw to cause an information leak. (CVE-2010-2955,
Moderate)

• A NULL pointer dereference flaw in ftrace_regex_lseek() in the Linux

kernel's ftrace implementation could allow a local, unprivileged user to
cause a denial of service. Note: The debugfs file system must be mounted
locally to exploit this issue. It is not mounted by default.
(CVE-2010-3079, Moderate)

• A flaw in the Linux kernel's packet writing driver could be triggered

via the PKT_CTRL_CMD_STATUS IOCTL request, possibly allowing a local,
unprivileged user with access to "/dev/pktcdvd/control" to cause an
information leak. Note: By default, only users in the cdrom group have
access to "/dev/pktcdvd/control". (CVE-2010-3437, Moderate)

• A flaw was found in the way KVM (Kernel-based Virtual Machine) handled

the reloading of fs and gs segment registers when they had invalid
selectors. A privileged host user with access to "/dev/kvm" could use this
flaw to crash the host. (CVE-2010-3698, Moderate)

Red Hat would like to thank Kees Cook for reporting CVE-2010-2962 and
CVE-2010-2803; Ben Hawkes for reporting CVE-2010-3081 and CVE-2010-3301;
Dan Rosenberg for reporting CVE-2010-3442, CVE-2010-3705, CVE-2010-3904,
and CVE-2010-3437; and Robert Swiecki for reporting CVE-2010-3079.

This update also fixes several bugs. Documentation for these bug fixes will
be available shortly from the Technical Notes document linked to in the
References section.

Users should upgrade to these updated packages, which contain backported
patches to correct these issues. The system must be rebooted for this
update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 621435 - CVE-2010-2803 kernel: drm ioctls infoleak
• BZ - 628434 - CVE-2010-2955 kernel: wireless: fix 64K kernel heap content leak via ioctl
• BZ - 631623 - CVE-2010-3079 kernel: ftrace NULL ptr deref
• BZ - 632069 - CVE-2010-3084 kernel: niu: buffer overflow for ETHTOOL_GRXCLSRLALL
• BZ - 632292 - RHEL55.x32 crashes when installing under RHEL6 KVM on an AMD host [rhel-6.0.z]
• BZ - 633864 - block: fix s390 tape block driver crash that occurs when it switches the IO scheduler [rhel-6.0.z]
• BZ - 633865 - [FIPS140][RHEL6] kernel module should failed to load if DSA signature check fails when FIPS mode is on [rhel-6.0.z]
• BZ - 633964 - RHEL-UV: kernel panic on boot uvsw-sys [rhel-6.0.z]
• BZ - 633966 - winxp BSOD when boot with cpu mode name [rhel-6.0.z]
• BZ - 634449 - CVE-2010-3301 kernel: IA32 System Call Entry Point Vulnerability
• BZ - 634457 - CVE-2010-3081 kernel: 64-bit Compatibility Mode Stack Pointer Underflow
• BZ - 634973 - Detect and recover from cxgb3 adapter parity errors [rhel-6.0.z]
• BZ - 634984 - RHEL6 can NOT boot(displays nothing) on boards with RS880 [rhel-6.0.z]
• BZ - 635951 - kernel-kdump-debuginfo rpm does not contain debug symbols for s390 [rhel-6.0.z]
• BZ - 636116 - MADV_HUGEPAGE undeclared [rhel-6.0.z]
• BZ - 637087 - Kernel Memory dump to a FCP device fails with panic [rhel-6.0.z]
• BZ - 637675 - CVE-2010-3432 kernel: sctp: do not reset the packet during sctp_packet_config
• BZ - 637688 - CVE-2010-2962 kernel: arbitrary kernel memory write via i915 GEM ioctl
• BZ - 638085 - CVE-2010-3437 kernel: pktcdvd ioctl dev_minor missing range check
• BZ - 638478 - CVE-2010-3442 kernel: prevent heap corruption in snd_ctl_new()
• BZ - 638973 - [RHEL6 Snapshot 13]: The boot parameters 'nomodeset xforcevesa' is needed to install on Precision M4500 [rhel-6.0.z]
• BZ - 639412 - block: must prevent merges of discard and write requests [rhel-6.0.z]
• BZ - 639879 - CVE-2010-3698 kvm: invalid selector in fs/gs causes kernel panic
• BZ - 640036 - CVE-2010-3705 kernel: sctp memory corruption in HMAC handling
• BZ - 641258 - fix split_huge_page error like mapcount 3 page_mapcount 2 [rhel-6.0.z]
• BZ - 641454 - Output 'JBD: spotted dirty metadata buffer' message when usrquota is enabled [rhel-6.0.z]
• BZ - 641455 - [Intel 6.0 Bug] NPIV broken in SW FCoE [rhel-6.0.z]
• BZ - 641456 - [Intel 6.1 Bug] FCoE Boot ROM, unable to see LUN during system install thru NPV [rhel-6.0.z]
• BZ - 641457 - FCoE: Do not fall back to non-FIP FLOGI [rhel-6.0.z]
• BZ - 641458 - vmstat incorrectly reports disk IO as swap in [rhel-6.0.z]
• BZ - 641459 - Don't lose dirty bits leading to data corruption during KSM swapping [rhel-6.0.z]
• BZ - 641460 - KSM: fix page_address_in_vma anon_vma oops [rhel-6.0.z]
• BZ - 641483 - Stack size mapping is decreased through mlock/munlock call [rhel-6.0.z]
• BZ - 641907 - lpfc driver oops during rhel6 installation with snapshot 12/13 and emulex FC [rhel-6.0.z]
• BZ - 642043 - slow memory leak in i915 module on all intel hw [rhel-6.0.z]
• BZ - 642045 - major memory leak in radeon driver due when scrolling certain sites in firefox [rhel-6.0.z]
• BZ - 642465 - CVE-2010-2963 kernel: v4l: VIDIOCSMICROCODE arbitrary write
• BZ - 642679 - kernel BUG at mm/huge_memory.c:1279! [rhel-6.0.z]
• BZ - 642680 - XFS: accounting of reclaimable inodes is incorrect [rhel-6.0.z]
• BZ - 642896 - CVE-2010-3904 RDS sockets local privilege escalation
• BZ - 644037 - kernel BUG at mm/huge_memory.c:1267! - mapcount 5 page_mapcount 4 [rhel-6.0.z]
• BZ - 644038 - avoid crashes: backport hold mm->page_table_lock patch [rhel-6.0.z]
• BZ - 644636 - kernel wastes huge amounts of memory due to CONFIG_IMA [rhel-6.0.z]
• BZ - 644926 - calling elevator_change immediately after blk_init_queue results in a null pointer dereference [rhel-6.0.z]
• BZ - 646994 - Booting AMD Dinar system results in softlockups in ttm code [rhel-6.0.z]

CVEs

• CVE-2010-3081
• CVE-2010-2955
• CVE-2010-3904
• CVE-2010-2803
• CVE-2010-3079
• CVE-2010-3432
• CVE-2010-3442
• CVE-2010-3437
• CVE-2010-3084
• CVE-2010-3301
• CVE-2010-3698
• CVE-2010-3705
• CVE-2010-2962

References

• http://www.redhat.com/security/updates/classification/#important
• http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Technical_Notes/index.html#RHSA-2010:0842