RHSA-2011:0833 - Security Advisory

Topic

Updated kernel packages that fix multiple security issues and several bugs
are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issues:

• A flaw in the dccp_rcv_state_process() function could allow a remote

attacker to cause a denial of service, even when the socket was already
closed. (CVE-2011-1093, Important)

• Multiple buffer overflow flaws were found in the Linux kernel's

Management Module Support for Message Passing Technology (MPT) based
controllers. A local, unprivileged user could use these flaws to cause a
denial of service, an information leak, or escalate their privileges.
(CVE-2011-1494, CVE-2011-1495, Important)

• A missing validation of a null-terminated string data structure element

in the bnep_sock_ioctl() function could allow a local user to cause an
information leak or a denial of service. (CVE-2011-1079, Moderate)

• Missing error checking in the way page tables were handled in the Xen

hypervisor implementation could allow a privileged guest user to cause the
host, and the guests, to lock up. (CVE-2011-1166, Moderate)

• A flaw was found in the way the Xen hypervisor implementation checked for

the upper boundary when getting a new event channel port. A privileged
guest user could use this flaw to cause a denial of service or escalate
their privileges. (CVE-2011-1763, Moderate)

• The start_code and end_code values in "/proc/[pid]/stat" were not

protected. In certain scenarios, this flaw could be used to defeat Address
Space Layout Randomization (ASLR). (CVE-2011-0726, Low)

• A missing initialization flaw in the sco_sock_getsockopt() function could

allow a local, unprivileged user to cause an information leak.
(CVE-2011-1078, Low)

• A missing validation of a null-terminated string data structure element

in the do_replace() function could allow a local user who has the
CAP_NET_ADMIN capability to cause an information leak. (CVE-2011-1080, Low)

• A buffer overflow flaw in the DEC Alpha OSF partition implementation in

the Linux kernel could allow a local attacker to cause an information leak
by mounting a disk that contains specially-crafted partition tables.
(CVE-2011-1163, Low)

• Missing validations of null-terminated string data structure elements in

the do_replace(), compat_do_replace(), do_ipt_get_ctl(), do_ip6t_get_ctl(),
and do_arpt_get_ctl() functions could allow a local user who has the
CAP_NET_ADMIN capability to cause an information leak. (CVE-2011-1170,
CVE-2011-1171, CVE-2011-1172, Low)

• A heap overflow flaw in the Linux kernel's EFI GUID Partition Table (GPT)

implementation could allow a local attacker to cause a denial of service
by mounting a disk that contains specially-crafted partition tables.
(CVE-2011-1577, Low)

Red Hat would like to thank Dan Rosenberg for reporting CVE-2011-1494 and
CVE-2011-1495; Vasiliy Kulikov for reporting CVE-2011-1079, CVE-2011-1078,
CVE-2011-1080, CVE-2011-1170, CVE-2011-1171, and CVE-2011-1172; Kees Cook
for reporting CVE-2011-0726; and Timo Warns for reporting CVE-2011-1163
and CVE-2011-1577.

This update also fixes several bugs. Documentation for these bug fixes will
be available shortly from the Technical Notes document linked to in the
References section.

Users should upgrade to these updated packages, which contain backported
patches to correct these issues, and fix the bugs noted in the Technical
Notes. The system must be rebooted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.6 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.6 x86_64
• Red Hat Enterprise Linux Server - AUS 5.6 ia64
• Red Hat Enterprise Linux Server - AUS 5.6 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 i386

Fixes

• BZ - 681259 - CVE-2011-1078 kernel: bt sco_conninfo infoleak
• BZ - 681260 - CVE-2011-1079 kernel: bnep device field missing NULL terminator
• BZ - 681262 - CVE-2011-1080 kernel: ebtables stack infoleak
• BZ - 682954 - CVE-2011-1093 kernel: dccp: fix oops on Reset after close
• BZ - 684569 - CVE-2011-0726 kernel: proc: protect mm start_code/end_code in /proc/pid/stat
• BZ - 688021 - CVE-2011-1163 kernel: fs/partitions: Corrupted OSF partition table infoleak
• BZ - 688156 - [5.6][REG]for some uses of 'nfsservctl' system call, the kernel crashes. [rhel-5.6.z]
• BZ - 688579 - CVE-2011-1166 kernel: xen: x86_64: fix error checking in arch_set_info_guest()
• BZ - 689321 - CVE-2011-1170 ipv4: netfilter: arp_tables: fix infoleak to userspace
• BZ - 689327 - CVE-2011-1171 ipv4: netfilter: ip_tables: fix infoleak to userspace
• BZ - 689345 - CVE-2011-1172 ipv6: netfilter: ip6_tables: fix infoleak to userspace
• BZ - 689699 - Deadlock between device driver attachment and device removal with a USB device [rhel-5.6.z]
• BZ - 689700 - [NetApp 5.6 Bug] QLogic 8G FC firmware dumps seen during IO [rhel-5.6.z]
• BZ - 690134 - Time runs too fast in a VM on processors with > 4GHZ freq [rhel-5.6.z]
• BZ - 690239 - gfs2: creating large files suddenly slow to a crawl [rhel-5.6.z]
• BZ - 694021 - CVE-2011-1494 CVE-2011-1495 kernel: drivers/scsi/mpt2sas: prevent heap overflows
• BZ - 695976 - CVE-2011-1577 kernel: corrupted GUID partition tables can cause kernel oops
• BZ - 696136 - RHEL 5.6 (kernel -238) causes audio issues [rhel-5.6.z]
• BZ - 697448 - slab corruption after seeing some nfs-related BUG: warning [rhel-5.6.z]
• BZ - 699808 - dasd: fix race between open and offline [rhel-5.6.z]
• BZ - 701240 - CVE-2011-1763 kernel: xen: improper upper boundary check in get_free_port() function

CVEs

• CVE-2011-1080
• CVE-2011-0726
• CVE-2011-1078
• CVE-2011-1172
• CVE-2011-1163
• CVE-2011-1171
• CVE-2011-1093
• CVE-2011-1170
• CVE-2011-1079
• CVE-2011-1494
• CVE-2011-1495
• CVE-2011-1763
• CVE-2011-1577
• CVE-2011-1166

References

• https://access.redhat.com/security/updates/classification/#important
• http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.6_Technical_Notes/kernel.html#RHSA-2011-0833