RHSA-2011:1065 - Security Advisory

Topic

Updated kernel packages that fix multiple security issues, address several
hundred bugs, and add numerous enhancements are now available as part of
the ongoing support and maintenance of Red Hat Enterprise Linux version 5.
This is the seventh regular update.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issues:

• A flaw was found in the way the Xen hypervisor implementation handled

instruction emulation during virtual machine exits. A malicious user-space
process running in an SMP guest could trick the emulator into reading a
different instruction than the one that caused the virtual machine to exit.
An unprivileged guest user could trigger this flaw to crash the host. This
only affects systems with both an AMD x86 processor and the AMD
Virtualization (AMD-V) extensions enabled. (CVE-2011-1780, Important)

• A flaw allowed the tc_fill_qdisc() function in the Linux kernel's packet

scheduler API implementation to be called on built-in qdisc structures. A
local, unprivileged user could use this flaw to trigger a NULL pointer
dereference, resulting in a denial of service. (CVE-2011-2525, Moderate)

• A flaw was found in the way space was allocated in the Linux kernel's

Global File System 2 (GFS2) implementation. If the file system was almost
full, and a local, unprivileged user made an fallocate() request, it could
result in a denial of service. Note: Setting quotas to prevent users from
using all available disk space would prevent exploitation of this flaw.
(CVE-2011-2689, Moderate)

These updated kernel packages include a number of bug fixes and
enhancements. Space precludes documenting all of these changes in this
advisory. Refer to the Red Hat Enterprise Linux 5.7 Technical Notes for
information about the most significant bug fixes and enhancements included
in this update:

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.7_Technical_Notes/kernel.html#RHSA-2011-1065

All Red Hat Enterprise Linux 5 users are advised to install these updated
packages, which correct these issues. The system must be rebooted for this
update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 390451 - Pick up paging performance improvements from upstream Xen
• BZ - 431738 - lsattr doesn't show attributes of ext3 quota files
• BZ - 441730 - [rhts] connectathon nfsidem test failing
• BZ - 452650 - [RHEL5.2]: Blktap is limited to 100 disks total
• BZ - 460821 - pv-on-hvm: disk shows up twice.
• BZ - 465876 - NMI Watchdog detected LOCKUP in :sctp:sctp_copy_local_addr_list
• BZ - 477032 - kdump hang on HP xw9400
• BZ - 481546 - HTB qdisc miscalculates bandwidth with TSO enabled
• BZ - 481629 - update myri10g driver from 1.3.2 to 1.5.2
• BZ - 491740 - export of an NFSV3 file system via kerberos requires AUTH_SYS as well
• BZ - 491786 - s2io should check inputs for rx_ring_sz
• BZ - 494927 - Read-only filesystem after 'ext3_free_blocks_sb: bit already cleared for block' errors
• BZ - 501314 - No beep when running xen kernel
• BZ - 511901 - [NFS]: silly renamed .nfs0000* files can be left on fs forever
• BZ - 517629 - Sequence id issue with nfs4/kerberos between RHEL kernel and Fedora 11
• BZ - 525898 - soft lockups with kswapd in RHEL 5.4 kernel 2.6.18-164.el5 x86_64
• BZ - 537277 - KERNEL: QLA2XXX 0000:0E:00.0: RISC PAUSED -- HCCR=0, DUMPING FIRMWARE!
• BZ - 553411 - xts crypto module missing from RHEL5 installer runtime
• BZ - 553803 - GFS2: recovery stuck on transaction lock
• BZ - 567449 - RHEL5.6: iw_cxgb4 driver inclusion
• BZ - 567540 - unregister_netdevice: waiting for veth5 to become free when I remove netloop
• BZ - 579000 - [RFE] Support L2 packets under bonding layer
• BZ - 579858 - Wrong RX bytes/packet count on vlan interface with igb driver
• BZ - 589512 - slab corruption after seeing some nfs-related BUG: warning
• BZ - 603345 - i5k_amb does not work for Intel 5000 Chipset (kernel)
• BZ - 607114 - System panic in pskb_expand_head When arp_validate option is specified in bonding ARP monitor mode
• BZ - 611407 - kvm guest unable to kdump without noapic
• BZ - 621916 - Host panic on cross-vendor migration (RHEL 5.5 guest)
• BZ - 622542 - Xorg failures on machines using intel video card driver
• BZ - 622647 - Reading /proc/locks yelds corrupt data
• BZ - 623979 - synch arch/i386/pci/irq-xen.c
• BZ - 626585 - GFS2: [RFE] fallocate support for GFS2
• BZ - 626974 - nfs: too many GETATTR and ACCESS calls after direct i/o
• BZ - 626977 - [nfs] make close(2) asynchronous when closing nfs o_direct files
• BZ - 627496 - Fix shrinking windows with window scaling
• BZ - 631950 - remove FS-Cache code from NFS
• BZ - 632399 - Misleading message from fs/nfs/file.c:do_vfs_lock()
• BZ - 633196 - testing NMI watchdog ... <4>WARNING: CPU#0: NMI appears to be stuck (62->62)!
• BZ - 635992 - Areca driver, arcmsr, update
• BZ - 637970 - GFS2: Not enough space reserved in gfs2_write_begin and possibly elsewhere.
• BZ - 642388 - ip_nat_ftp not working if ack for "227 Enter Passive mode" packet is lost
• BZ - 643292 - [netfront] ethtool -i should return proper information for netfront device
• BZ - 643872 - [netback] ethtool -i should return proper information for netback device
• BZ - 645343 - ISCSI/multipath hang - must propagate SCSI device deletion to DM mpath
• BZ - 645528 - SIGPROF keeps a large task from ever completing a fork()
• BZ - 645646 - RFE: Virtio nic should be support "ethtool -i virtio nic"
• BZ - 646513 - HP_GETHOSTINFO ioctl always causes mpt controller reset
• BZ - 648572 - virtio GSO makes IPv6 very slow
• BZ - 648657 - fseek()/NFS performance regression between RHEL4 and RHEL5
• BZ - 648854 - linux-2.6.18: netback: take net_schedule_list_lock when removing entry from net_schedule_list
• BZ - 651333 - RHEL5.6: EHCI: AMD periodic frame list table quirk
• BZ - 651409 - BAD SEQID error messages returned by the NFS server
• BZ - 651512 - e1000 driver tracebacks when running under VMware ESX4
• BZ - 652321 - jbd2_stats_proc_init has wrong location.
• BZ - 652369 - temporary loss of path to SAN results in persistent EIO with msync
• BZ - 653286 - [5.6][REG]for some uses of 'nfsservctl' system call, the kernel crashes.
• BZ - 653828 - bonding failover in every monitor interval with virtio-net driver
• BZ - 654293 - sunrpc: need a better way to set tcp_slot_table_entries in RHEL 5
• BZ - 656836 - Memory leak in virtio-console driver if driver probe routine fails
• BZ - 657166 - XFS causes kernel panic due to double free of log tickets
• BZ - 658012 - NMI panic during xfs forced shutdown
• BZ - 658418 - Kernel warning at boot: i7core_edac: probe of 0000:80:14.0 failed with error -22
• BZ - 659594 - Kernel panic when restart network on vlan with bonding
• BZ - 659715 - cifs: ia64 kernel unaligned access
• BZ - 659816 - Performance counters don't work on HP Magnycours machines
• BZ - 660368 - dm-crypt: backport changes to support xts crypto mode
• BZ - 660661 - fsck.gfs2 reported statfs error after gfs2_grow
• BZ - 660728 - [LSI 5.7 feat] Update megaraid_sas to 5.34 and Include "Thunderbolt" support
• BZ - 660871 - mpctl module doesn't release fasync_struct at file close
• BZ - 661300 - xfstest 222: filesystem on /dev/loop0 is inconsistent
• BZ - 661306 - [Cisco 5.7 FEAT] Update enic driver to version 2.1.1.9
• BZ - 661904 - GFS2: Kernel changes necessary to allow growing completely full filesystems.
• BZ - 663041 - gfs2 FIEMAP oops
• BZ - 663123 - /proc/partitions not updating after creating LUNs via hpacucli
• BZ - 663563 - [ext4/xfstests] 011 caused filesystem corruption after running many times in a loop
• BZ - 664592 - a test unit ready causes a panic on 5.6 (CCISS driver)
• BZ - 664931 - COW corruption using popen(3).
• BZ - 665197 - WARNING: APIC timer calibration may be wrong
• BZ - 665972 - ISVM bit (ECX:31) for CPUID 0x00000001 is missing for HVM on AMD
• BZ - 666080 - GFS2: Blocks not marked free on delete
• BZ - 666304 - scsi_dh_emc gives "error attaching hardware handler" for EMC active-active SANs
• BZ - 666866 - Heavy load on ath5k wireless device makes system unresponsive
• BZ - 667327 - lib: fix vscnprintf() if @size is == 0
• BZ - 667660 - [NetApp 5.7 Bug] Include new NetApp PID entry to the alua_dev_list array in the ALUA hardware handler
• BZ - 667810 - "modprobe ip_conntrack hashsize=NNNN" panics kernel if /etc/modprobe.conf has hashsize=MMMM
• BZ - 668934 - UDP transmit under VLAN causes guest freeze
• BZ - 669603 - incomplete local port reservation
• BZ - 669961 - [NetApp 5.6 Bug] Erroneous TPG ID check in SCSI ALUA Handler
• BZ - 670367 - scsi_dh_emc get_req function should set REQ_FAILFAST flags same as upstream and other modules
• BZ - 670373 - panic in kfree() due to race condition in acpi_bus_receive_event()
• BZ - 671238 - [bonding] crash when adding/removing slaves with master interface down
• BZ - 671595 - Flapping errors (and panic) with bonding and arp_interval while using be2net included in 2.6.18-238
• BZ - 672619 - transmission stops when tap does not consume
• BZ - 672724 - mmapping a read only file on a gfs2 filesystem incorrectly acquires an exclusive glock
• BZ - 672981 - lseek() over NFS is returning an incorrect file length under some circumstances
• BZ - 673058 - kernel panic in pg_init_done - pgpath already deleted
• BZ - 673242 - Time runs too fast in a VM on processors with > 4GHZ freq
• BZ - 673459 - virtio_console driver never returns from selecting for write when the queue is full
• BZ - 673616 - vdso gettimeofday causes a segmentation fault
• BZ - 674175 - Impossible to load sctp module with ipv6 disable=1
• BZ - 674226 - Panic in selinux_bprm_post_apply_creds() due to an empty tty_files list
• BZ - 674298 - [NetApp 5.6 Bug] QLogic 8G FC firmware dumps seen during IO
• BZ - 674514 - xenctx shows nonsensical values for 32-on-64 and HVM domains
• BZ - 675727 - vdso: missing wall_to_monotomic export
• BZ - 675986 - Fix block based fiemap
• BZ - 677703 - [RHEL5.5] Panic in iscsi_sw_tcp_data_ready()
• BZ - 677893 - [TestOnly] gfs regression testing for 5.7 beta
• BZ - 677902 - Incorrect "Speed" is recorded in the file "/proc/net/bonding/bondX"
• BZ - 678073 - qeth: allow channel path changes in recovery
• BZ - 678074 - [usb-audio] unable to set capture mixer levels
• BZ - 678359 - online disk resizing may cause data corruption
• BZ - 678571 - hap_gva_to_gfn_* do not preserve domain context
• BZ - 678618 - gdbsx hypervisor part backport
• BZ - 679120 - qeth: remove needless IPA-commands in offline
• BZ - 679407 - [5.7] niu: Fix races between up/down and get_stats.
• BZ - 679487 - [5.7] net: Fix netdev_run_todo serialization
• BZ - 680329 - sunrpc: reconnect race can lead to socket read corruption
• BZ - 681303 - backport vzalloc and vzalloc_node in support of drivers needing these functions
• BZ - 681586 - Out of vmalloc space
• BZ - 683155 - gfs2: creating large files suddenly slow to a crawl
• BZ - 683978 - need to backport common vpd infrastructure to rhel 5
• BZ - 684795 - missed unlock_page() in gfs2_write_begin()
• BZ - 688646 - intel_iommu domain id exhaustion
• BZ - 688989 - [5.6] sysctl tcp_syn_retries is not honored
• BZ - 689860 - guest with passthrough nic got kernel panic when send system_reset signal in QEMU monitor
• BZ - 689943 - GFS2 causes kernel panic in spectator mode
• BZ - 690555 - GFS2: resource group bitmap corruption resulting in panics and withdraws
• BZ - 692946 - need to backport debugfs_remove_recursive functionality
• BZ - 695357 - dasd: fix race between open and offline
• BZ - 696411 - Missing patch for full use of tcp_rto_min parameter
• BZ - 698432 - [Emulex 5.7] Update lpfc driver to version 8.2.0.96.1p
• BZ - 698879 - The pci resource for vf is not released after hot-removing Intel 82576 NIC
• BZ - 700546 - RHEL5: apparent file system corruption of snapshot fs with qla2xxx driver
• BZ - 702355 - NFS: Fix build break with CONFIG_NFS_V4=n
• BZ - 702652 - provide option to disable HPET
• BZ - 702657 - CVE-2011-1780 kernel: xen: svm: insufficiencies in handling emulated instructions during vm exits
• BZ - 703213 - GFS2: Add "dlm callback owed" glock flag
• BZ - 703416 - host kernel panic while guest running on 10G public bridge.
• BZ - 704497 - VT-d: Fix resource leaks on error paths in intremap code
• BZ - 705324 - cifs: regression in unicode conversion routines when mounting with -o mapchars
• BZ - 705455 - intel-iommu: missing flush prior to removing domains + avoid broken vm/si domain unlinking
• BZ - 705725 - hvm guest time may go backwards on some hosts
• BZ - 706414 - Adding slave to balance-tlb bond device results in soft lockup
• BZ - 709224 - setfacl does not update ctime when changing file permission on ext3/4
• BZ - 711450 - 12% degradation running IOzone with Outcache testing
• BZ - 717068 - Kernel panics during Veritas SF testing.
• BZ - 717742 - [RHEL5.7][kernel-xen] HVM guests hang during installation on AMD systems
• BZ - 720552 - CVE-2011-2525 kernel: kernel: net_sched: fix qdisc_notify()
• BZ - 720861 - CVE-2011-2689 kernel: gfs2: make sure fallocate bytes is a multiple of blksize

CVEs

• CVE-2011-2525
• CVE-2011-2689
• CVE-2011-1780

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.7_Technical_Notes/kernel.html#RHSA-2011-1065