Synopsis

Moderate: kexec-tools security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

An updated kexec-tools package that fixes three security issues, various
bugs, and adds enhancements is now available for Red Hat
Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Kexec allows for booting a Linux kernel from the context of an already
running kernel.

Kdump used the SSH (Secure Shell) "StrictHostKeyChecking=no" option when
dumping to SSH targets, causing the target kdump server's SSH host key not
to be checked. This could make it easier for a man-in-the-middle attacker
on the local network to impersonate the kdump SSH target server and
possibly gain access to sensitive information in the vmcore dumps.
(CVE-2011-3588)

mkdumprd created initrd files with world-readable permissions. A local user
could possibly use this flaw to gain access to sensitive information, such
as the private SSH key used to authenticate to a remote server when kdump
was configured to dump to an SSH target. (CVE-2011-3589)

mkdumprd included unneeded sensitive files (such as all files from the
"/root/.ssh/" directory and the host's private SSH keys) in the resulting
initrd. This could lead to an information leak when initrd files were
previously created with world-readable permissions. Note: With this update,
only the SSH client configuration, known hosts files, and the SSH key
configured via the newly introduced sshkey option in "/etc/kdump.conf" are
included in the initrd. The default is the key generated when running the
"service kdump propagate" command, "/root/.ssh/kdump_id_rsa".
(CVE-2011-3590)

Red Hat would like to thank Kevan Carstensen for reporting these issues.

This update also fixes several bugs and adds various enhancements.
Space precludes documenting all of these changes in this advisory.
Documentation for these bug fixes and enhancements will be available
shortly from the Technical Notes document, linked to in the References
section.

All kexec-tools users should upgrade to this updated package, which
contains backported patches to resolve these issues and add these
enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386

Fixes

• BZ - 681796 - Pass "noefi acpi_rsdp=X" to the second kernel
• BZ - 708503 - fails to build without downstream patches
• BZ - 716439 - CVE-2011-3588 CVE-2011-3589 CVE-2011-3590 kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
• BZ - 719105 - mkdumprd hang in depsolve_modlist when running kernel is not target kernel
• BZ - 725484 - kexec-tools: x86: Start using nr_cpus=1 instead of maxcpus=1
• BZ - 727892 - kexec-tools: Warn a user to use maxcpus=1 instead of nr_cpus=1 for older kernels
• BZ - 731394 - [kexec-tools] Remove warning when kdump service starts
• BZ - 734528 - kexec-tools: Add memory usage debugging capability in second kernel
• BZ - 739050 - non-fatal <unknown> scriptlet failure in rpm package fence-agents

CVEs

• CVE-2011-3590
• CVE-2011-3589
• CVE-2011-3588

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Technical_Notes/kexec-tools.html#RHSA-2011-1532

Red Hat Enterprise Linux Server 6

SRPM
kexec-tools-2.0.0-209.el6.src.rpm	SHA-256: 86d3f133c7807daa8e9a68179159021015c80fa387f1b02d2d03706eff96d018
x86_64
kexec-tools-2.0.0-209.el6.x86_64.rpm	SHA-256: 2296b32460d654185f80f45399fa2f01fc7f2e94cef547b670969f43a447005e
kexec-tools-debuginfo-2.0.0-209.el6.x86_64.rpm	SHA-256: 3fd8e2c22154e33533361bf64db809938382e4b690be14bbdfc2d760f18d4812
i386
kexec-tools-2.0.0-209.el6.i686.rpm	SHA-256: bed29b72c7f26d995e364d85c3e4bf474f96414b1562687b754cadc0ab98b130
kexec-tools-debuginfo-2.0.0-209.el6.i686.rpm	SHA-256: 193847a49b4ff9b5013026e785bf0716deb3e1296832d98044a85d6cfcc970ab

Red Hat Enterprise Linux Workstation 6

SRPM
kexec-tools-2.0.0-209.el6.src.rpm	SHA-256: 86d3f133c7807daa8e9a68179159021015c80fa387f1b02d2d03706eff96d018
x86_64
kexec-tools-2.0.0-209.el6.x86_64.rpm	SHA-256: 2296b32460d654185f80f45399fa2f01fc7f2e94cef547b670969f43a447005e
kexec-tools-debuginfo-2.0.0-209.el6.x86_64.rpm	SHA-256: 3fd8e2c22154e33533361bf64db809938382e4b690be14bbdfc2d760f18d4812
i386
kexec-tools-2.0.0-209.el6.i686.rpm	SHA-256: bed29b72c7f26d995e364d85c3e4bf474f96414b1562687b754cadc0ab98b130
kexec-tools-debuginfo-2.0.0-209.el6.i686.rpm	SHA-256: 193847a49b4ff9b5013026e785bf0716deb3e1296832d98044a85d6cfcc970ab

Red Hat Enterprise Linux Desktop 6

SRPM
kexec-tools-2.0.0-209.el6.src.rpm	SHA-256: 86d3f133c7807daa8e9a68179159021015c80fa387f1b02d2d03706eff96d018
x86_64
kexec-tools-2.0.0-209.el6.x86_64.rpm	SHA-256: 2296b32460d654185f80f45399fa2f01fc7f2e94cef547b670969f43a447005e
kexec-tools-debuginfo-2.0.0-209.el6.x86_64.rpm	SHA-256: 3fd8e2c22154e33533361bf64db809938382e4b690be14bbdfc2d760f18d4812
i386
kexec-tools-2.0.0-209.el6.i686.rpm	SHA-256: bed29b72c7f26d995e364d85c3e4bf474f96414b1562687b754cadc0ab98b130
kexec-tools-debuginfo-2.0.0-209.el6.i686.rpm	SHA-256: 193847a49b4ff9b5013026e785bf0716deb3e1296832d98044a85d6cfcc970ab

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
kexec-tools-2.0.0-209.el6.src.rpm	SHA-256: 86d3f133c7807daa8e9a68179159021015c80fa387f1b02d2d03706eff96d018
s390x
kexec-tools-2.0.0-209.el6.s390x.rpm	SHA-256: 577200938dd55f7e1bf680e8cfd41f84cda2cfdda3106f9bb22a2ba87bd663e9
kexec-tools-debuginfo-2.0.0-209.el6.s390x.rpm	SHA-256: 66efc563f7cd2b3cd63a1c97d894e496a672ee3ffd7d8f51db6364c0d67a8c01

Red Hat Enterprise Linux for Power, big endian 6

SRPM
kexec-tools-2.0.0-209.el6.src.rpm	SHA-256: 86d3f133c7807daa8e9a68179159021015c80fa387f1b02d2d03706eff96d018
ppc64
kexec-tools-2.0.0-209.el6.ppc64.rpm	SHA-256: f2b7991722791df530c71fe7ab920ac2dfb574ef09de8af287febe7348c36688
kexec-tools-debuginfo-2.0.0-209.el6.ppc64.rpm	SHA-256: 4b4fc87e38b8c5b37fa9bae78e68e4d01abaed08150446e12d255ffbabb9d44b

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
kexec-tools-2.0.0-209.el6.src.rpm	SHA-256: 86d3f133c7807daa8e9a68179159021015c80fa387f1b02d2d03706eff96d018
x86_64
kexec-tools-2.0.0-209.el6.x86_64.rpm	SHA-256: 2296b32460d654185f80f45399fa2f01fc7f2e94cef547b670969f43a447005e
kexec-tools-debuginfo-2.0.0-209.el6.x86_64.rpm	SHA-256: 3fd8e2c22154e33533361bf64db809938382e4b690be14bbdfc2d760f18d4812

Red Hat Enterprise Linux Server from RHUI 6

SRPM
kexec-tools-2.0.0-209.el6.src.rpm	SHA-256: 86d3f133c7807daa8e9a68179159021015c80fa387f1b02d2d03706eff96d018
x86_64
kexec-tools-2.0.0-209.el6.x86_64.rpm	SHA-256: 2296b32460d654185f80f45399fa2f01fc7f2e94cef547b670969f43a447005e
kexec-tools-debuginfo-2.0.0-209.el6.x86_64.rpm	SHA-256: 3fd8e2c22154e33533361bf64db809938382e4b690be14bbdfc2d760f18d4812
i386
kexec-tools-2.0.0-209.el6.i686.rpm	SHA-256: bed29b72c7f26d995e364d85c3e4bf474f96414b1562687b754cadc0ab98b130
kexec-tools-debuginfo-2.0.0-209.el6.i686.rpm	SHA-256: 193847a49b4ff9b5013026e785bf0716deb3e1296832d98044a85d6cfcc970ab