RHSA-2013:0829 - Security Advisory

Topic

Updated kernel-rt packages that fix several security issues and multiple
bugs are now available for Red Hat Enterprise MRG 2.3.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

Security fixes:

• It was found that the kernel-rt update RHBA-2012:0044 introduced an

integer conversion issue in the Linux kernel's Performance Events
implementation. This led to a user-supplied index into the
perf_swevent_enabled array not being validated properly, resulting in
out-of-bounds kernel memory access. A local, unprivileged user could use
this flaw to escalate their privileges. (CVE-2013-2094, Important)

A public exploit for CVE-2013-2094 that affects Red Hat Enterprise MRG 2 is
available. Refer to Red Hat Knowledge Solution 373743, linked to in the
References, for further information and mitigation instructions for users
who are unable to immediately apply this update.

• An integer overflow flaw, leading to a heap-based buffer overflow, was

found in the way the Intel i915 driver in the Linux kernel handled the
allocation of the buffer used for relocation copies. A local user with
console access could use this flaw to cause a denial of service or escalate
their privileges. (CVE-2013-0913, Important)

• It was found that the Linux kernel used effective user and group IDs

instead of real ones when passing messages with SCM_CREDENTIALS ancillary
data. A local, unprivileged user could leverage this flaw with a set user
ID (setuid) application, allowing them to escalate their privileges.
(CVE-2013-1979, Important)

• A race condition in install_user_keyrings(), leading to a NULL pointer

dereference, was found in the key management facility. A local,
unprivileged user could use this flaw to cause a denial of service.
(CVE-2013-1792, Moderate)

• A NULL pointer dereference flaw was found in the Linux kernel's XFS file

system implementation. A local user who is able to mount an XFS file
system could use this flaw to cause a denial of service. (CVE-2013-1819,
Moderate)

• An information leak was found in the Linux kernel's POSIX signals

implementation. A local, unprivileged user could use this flaw to bypass
the Address Space Layout Randomization (ASLR) security feature.
(CVE-2013-0914, Low)

• A use-after-free flaw was found in the tmpfs implementation. A local user

able to mount and unmount a tmpfs file system could use this flaw to cause
a denial of service or, potentially, escalate their privileges.
(CVE-2013-1767, Low)

• A NULL pointer dereference flaw was found in the Linux kernel's USB

Inside Out Edgeport Serial Driver implementation. A local user with
physical access to a system and with access to a USB device's tty file
could use this flaw to cause a denial of service. (CVE-2013-1774, Low)

• A format string flaw was found in the ext3_msg() function in the Linux

kernel's ext3 file system implementation. A local user who is able to
mount an ext3 file system could use this flaw to cause a denial of service
or, potentially, escalate their privileges. (CVE-2013-1848, Low)

• A heap-based buffer overflow flaw was found in the Linux kernel's

cdc-wdm driver, used for USB CDC WCM device management. An attacker with
physical access to a system could use this flaw to cause a denial of
service or, potentially, escalate their privileges. (CVE-2013-1860, Low)

• A heap-based buffer overflow in the way the tg3 Ethernet driver parsed

the vital product data (VPD) of devices could allow an attacker with
physical access to a system to cause a denial of service or, potentially,
escalate their privileges. (CVE-2013-1929, Low)

• Information leaks in the Linux kernel's cryptographic API could allow a

local user who has the CAP_NET_ADMIN capability to leak kernel stack memory
to user-space. (CVE-2013-2546, CVE-2013-2547, CVE-2013-2548, Low)

• Information leaks in the Linux kernel could allow a local, unprivileged

user to leak kernel stack memory to user-space. (CVE-2013-2634,
CVE-2013-2635, CVE-2013-3076, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225,
CVE-2013-3231, Low)

Red Hat would like to thank Andy Lutomirski for reporting CVE-2013-1979.
CVE-2013-1792 was discovered by Mateusz Guzik of Red Hat EMEA GSS SEG Team.

Solution

This update also fixes multiple bugs. Documentation for these changes will
be available shortly from the Technical Notes document linked to in the
References section.

Users should upgrade to these updated packages, which upgrade the kernel-rt
kernel to version kernel-rt-3.6.11.2-rt33, correct these issues, and fix
the bugs noted in the Red Hat Enterprise MRG 2 Technical Notes. The system
must be rebooted for this update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.

Affected Products

• MRG Realtime 2 x86_64

Fixes

• BZ - 915592 - CVE-2013-1767 Kernel: tmpfs: fix use-after-free of mempolicy object
• BZ - 916191 - CVE-2013-1774 Kernel: USB io_ti driver NULL pointer dereference in routine chase_port
• BZ - 916646 - CVE-2013-1792 Kernel: keys: race condition in install_user_keyrings()
• BZ - 918009 - CVE-2013-1819 kernel: xfs: _xfs_buf_find oops on blocks beyond the filesystem end
• BZ - 918098 - build id problem - needed for systemtap and perf annotations
• BZ - 918512 - kernel: crypto: info leaks in report API
• BZ - 920471 - CVE-2013-0913 Kernel: drm/i915: heap writing overflow
• BZ - 920499 - CVE-2013-0914 Kernel: sa_restorer information leak
• BZ - 920783 - CVE-2013-1848 kernel: ext3: format string issues
• BZ - 921970 - CVE-2013-1860 kernel: usb: cdc-wdm buffer overflow triggered by device
• BZ - 924689 - CVE-2013-2634 kernel: Information leak in the Data Center Bridging (DCB) component
• BZ - 924690 - CVE-2013-2635 kernel: Information leak in the RTNETLINK component
• BZ - 927026 - disable NO_HZ by default missing from v3.6-rt
• BZ - 949932 - CVE-2013-1929 Kernel: tg3: buffer overflow in VPD firmware parsing
• BZ - 955216 - CVE-2013-3222 Kernel: atm: update msg_namelen in vcc_recvmsg()
• BZ - 955599 - CVE-2013-3224 Kernel: Bluetooth: possible info leak in bt_sock_recvmsg()
• BZ - 955629 - CVE-2013-1979 kernel: net: incorrect SCM_CREDENTIALS passing
• BZ - 955649 - CVE-2013-3225 Kernel: Bluetooth: RFCOMM - missing msg_namelen update in rfcomm_sock_recvmsg
• BZ - 956094 - CVE-2013-3231 Kernel: llc: Fix missing msg_namelen update in llc_ui_recvmsg
• BZ - 956162 - CVE-2013-3076 Kernel: crypto: algif - suppress sending source address information in recvmsg
• BZ - 962792 - CVE-2013-2094 kernel: perf_swevent_enabled array out-of-bound access

CVEs

• CVE-2013-1792
• CVE-2013-1767
• CVE-2013-0913
• CVE-2013-1774
• CVE-2013-2094
• CVE-2013-1929
• CVE-2013-3231
• CVE-2013-2635
• CVE-2013-1860
• CVE-2013-3225
• CVE-2013-3224
• CVE-2013-2634
• CVE-2013-3076
• CVE-2013-2548
• CVE-2013-1819
• CVE-2013-3222
• CVE-2013-0914
• CVE-2013-1848
• CVE-2013-2546
• CVE-2013-2547
• CVE-2013-1979

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/site/solutions/373743
• https://rhn.redhat.com/errata/RHBA-2012-0044.html
• https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_MRG/2/html/Technical_Notes/RHSA-2013-0829.html