Executive Summary
| Summary | |
|---|---|
| Title | kernel security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2012:0721 | First vendor Publication | 2012-06-12 |
| Vendor | RedHat | Last vendor Modification | 2012-06-12 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated kernel packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: * It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level. (CVE-2012-0217, Important) * It was found that guests could trigger a bug in earlier AMD CPUs, leading to a CPU hard lockup, when running on the Xen hypervisor implementation. An unprivileged user in a 64-bit para-virtualized guest could use this flaw to crash the host. Warning: After installing this update, hosts that are using an affected AMD CPU (refer to Red Hat Bugzilla bug #824966 for a list) will fail to boot. In order to boot such hosts, the new kernel parameter, allow_unsafe, can be used ("allow_unsafe=on"). This option should only be used with hosts that are running trusted guests, as setting it to "on" reintroduces the flaw (allowing guests to crash the host). (CVE-2012-2934, Moderate) Note: For Red Hat Enterprise Linux guests, only privileged guest users can exploit the CVE-2012-0217 and CVE-2012-2934 issues. Red Hat would like to thank the Xen project for reporting these issues. Upstream acknowledges Rafal Wojtczuk as the original reporter of CVE-2012-0217. Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system. 5. Bugs fixed (http://bugzilla.redhat.com/): 813428 - CVE-2012-0217 kernel: x86-64: avoid sysret to non-canonical address 824966 - CVE-2012-2934 kernel: denial of service due to AMD Erratum #121 |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2012-0721.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:15596 | |||
| Oval ID: | oval:org.mitre.oval:def:15596 | ||
| Title: | User Mode Scheduler Memory Corruption Vulnerability (CVE-2012-0217) | ||
| Description: | The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-0217 | Version: | 8 |
| Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2008 R2 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18625 | |||
| Oval ID: | oval:org.mitre.oval:def:18625 | ||
| Title: | DSA-2501-1 xen - several | ||
| Description: | Several vulnerabilities were discovered in Xen, a hypervisor. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2501-1 CVE-2012-0217 CVE-2012-0218 CVE-2012-2934 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | xen |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:19281 | |||
| Oval ID: | oval:org.mitre.oval:def:19281 | ||
| Title: | CRITICAL PATCH UPDATE OCTOBER 2012 | ||
| Description: | The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2012-0217 | Version: | 3 |
| Platform(s): | Sun Solaris 10 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:19861 | |||
| Oval ID: | oval:org.mitre.oval:def:19861 | ||
| Title: | DSA-2508-1 kfreebsd-8 - privilege escalation | ||
| Description: | Rafal Wojtczuk from Bromium discovered that FreeBSD wasn't handling correctly uncanonical return addresses on Intel amd64 CPUs, allowing privilege escalation to kernel for local users. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2508-1 CVE-2012-0217 | Version: | 5 |
| Platform(s): | Debian GNU/kFreeBSD 6.0 | Product(s): | kfreebsd-8 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27635 | |||
| Oval ID: | oval:org.mitre.oval:def:27635 | ||
| Title: | ELSA-2012-0721-1 -- kernel security update (important) | ||
| Description: | kernel: [2.6.18-308.8.2.0.1.el5] - [net] bonding: fix carrier detect when bond is down [orabug 12377284] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] +- [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] [2.6.18-308.8.2.el5] - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970] | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012-0721-1 CVE-2012-0217 CVE-2012-2934 | Version: | 5 |
| Platform(s): | Oracle Linux 5 | Product(s): | kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27730 | |||
| Oval ID: | oval:org.mitre.oval:def:27730 | ||
| Title: | DEPRECATED: ELSA-2012-0721 -- kernel security update (important) | ||
| Description: | kernel: [2.6.18-308.8.2.el5] - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970] ocfs2: [1.4.10] - ocfs2/dlm: Cleanup mlogs in dlmthread.c dlmast.c and dlmdomain.c - ocfs2/dlm: make existing convertion precedent over new lock - ocfs2/dlm: Cleanup dlmdebug.c - ocfs2/dlm: Minor cleanup - ocfs2/dlm: Hard code the values for enums - ocfs2: Wakeup down convert thread just after clearing OCFS2 LOCK UPCONVERT FINISHING - ocfs2/dlm: Take inflight reference count for remotely mastered resources too - ocfs2/dlm: dlmlock remote needs to account for remastery - ocfs2: Add some trace log for orphan scan - ocfs2: Remove unused old id in ocfs2_commit_cache - ocfs2: Remove obsolete comments before ocfs2_start_trans - ocfs2: Initialize the bktcnt variable properly and call it bucket_count - ocfs2: Use cpu to le16 for e leaf clusters in ocfs2_bg_discontig_add_extent - ocfs2: validate bg free bits count after update - ocfs2: cluster Pin the remote node item in configfs - ocfs2: Release buffer head in case of error in ocfs2_double_lock - ocfs2: optimize ocfs2 check dir entry with unlikely() annotations - ocfs2: Little refactoring against ocfs2 iget - ocfs2: Initialize data ac might be used uninitializ - ocfs2 Skip mount recovery for hard ro mounts - ocfs2: make direntry invalid when deleting it - ocfs2: commit trans in error - ocfs2: Fix deadlock when allocating page - ocfs2: Avoid livelock in ocfs2 readpage | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012-0721 CVE-2012-0217 CVE-2012-2934 | Version: | 4 |
| Platform(s): | Oracle Linux 5 | Product(s): | kernel |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-12-18 | Name : Fedora Update for xen FEDORA-2012-19828 File : nvt/gb_fedora_2012_19828_xen_fc16.nasl |
| 2012-12-14 | Name : Fedora Update for xen FEDORA-2012-19717 File : nvt/gb_fedora_2012_19717_xen_fc17.nasl |
| 2012-12-13 | Name : SuSE Update for XEN openSUSE-SU-2012:1572-1 (XEN) File : nvt/gb_suse_2012_1572_1.nasl |
| 2012-12-13 | Name : SuSE Update for xen openSUSE-SU-2012:0886-1 (xen) File : nvt/gb_suse_2012_0886_1.nasl |
| 2012-11-23 | Name : Fedora Update for xen FEDORA-2012-18242 File : nvt/gb_fedora_2012_18242_xen_fc17.nasl |
| 2012-11-23 | Name : Fedora Update for xen FEDORA-2012-18249 File : nvt/gb_fedora_2012_18249_xen_fc16.nasl |
| 2012-11-15 | Name : CentOS Update for kernel CESA-2012:1445 centos5 File : nvt/gb_CESA-2012_1445_kernel_centos5.nasl |
| 2012-11-15 | Name : RedHat Update for kernel RHSA-2012:1445-01 File : nvt/gb_RHSA-2012_1445-01_kernel.nasl |
| 2012-11-15 | Name : Fedora Update for xen FEDORA-2012-17204 File : nvt/gb_fedora_2012_17204_xen_fc17.nasl |
| 2012-11-15 | Name : Fedora Update for xen FEDORA-2012-17408 File : nvt/gb_fedora_2012_17408_xen_fc16.nasl |
| 2012-09-22 | Name : Fedora Update for xen FEDORA-2012-13434 File : nvt/gb_fedora_2012_13434_xen_fc17.nasl |
| 2012-09-22 | Name : Fedora Update for xen FEDORA-2012-13443 File : nvt/gb_fedora_2012_13443_xen_fc16.nasl |
| 2012-08-30 | Name : Fedora Update for xen FEDORA-2012-9386 File : nvt/gb_fedora_2012_9386_xen_fc17.nasl |
| 2012-08-30 | Name : Fedora Update for xen FEDORA-2012-11182 File : nvt/gb_fedora_2012_11182_xen_fc17.nasl |
| 2012-08-30 | Name : Fedora Update for xen FEDORA-2012-11755 File : nvt/gb_fedora_2012_11755_xen_fc17.nasl |
| 2012-08-24 | Name : Fedora Update for xen FEDORA-2012-11785 File : nvt/gb_fedora_2012_11785_xen_fc16.nasl |
| 2012-08-10 | Name : Debian Security Advisory DSA 2508-1 (kfreebsd-8) File : nvt/deb_2508_1.nasl |
| 2012-08-10 | Name : FreeBSD Ports: FreeBSD File : nvt/freebsd_FreeBSD16.nasl |
| 2012-08-10 | Name : Debian Security Advisory DSA 2501-1 (xen) File : nvt/deb_2501_1.nasl |
| 2012-08-06 | Name : Fedora Update for xen FEDORA-2012-11190 File : nvt/gb_fedora_2012_11190_xen_fc16.nasl |
| 2012-07-30 | Name : CentOS Update for kernel CESA-2012:0721 centos5 File : nvt/gb_CESA-2012_0721_kernel_centos5.nasl |
| 2012-06-28 | Name : Fedora Update for xen FEDORA-2012-9399 File : nvt/gb_fedora_2012_9399_xen_fc16.nasl |
| 2012-06-28 | Name : Fedora Update for xen FEDORA-2012-9430 File : nvt/gb_fedora_2012_9430_xen_fc15.nasl |
| 2012-06-15 | Name : RedHat Update for kernel RHSA-2012:0721-01 File : nvt/gb_RHSA-2012_0721-01_kernel.nasl |
| 2012-06-13 | Name : Microsoft Windows Kernel Privilege Elevation Vulnerabilities (2711167) File : nvt/secpod_ms12-042.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-06-12 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2015-0068.nasl - Type : ACT_GATHER_INFO |
| 2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2012-0022.nasl - Type : ACT_GATHER_INFO |
| 2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2012-0021.nasl - Type : ACT_GATHER_INFO |
| 2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2012-0020.nasl - Type : ACT_GATHER_INFO |
| 2014-07-26 | Name : The remote Solaris system is missing a security patch from CPU oct2012. File : solaris_oct2012_SRU10_5.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-812.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-811.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-404.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-403.nasl - Type : ACT_GATHER_INFO |
| 2013-09-28 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201309-24.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0721-1.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0721.nasl - Type : ACT_GATHER_INFO |
| 2013-01-25 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_xen-201206-120606.nasl - Type : ACT_GATHER_INFO |
| 2013-01-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0720.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120612_kernel_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-07-23 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2508.nasl - Type : ACT_GATHER_INFO |
| 2012-06-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2501.nasl - Type : ACT_GATHER_INFO |
| 2012-06-28 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_aed44c4ec06711e1b5e0000c299b62e1.nasl - Type : ACT_GATHER_INFO |
| 2012-06-26 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9430.nasl - Type : ACT_GATHER_INFO |
| 2012-06-26 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9399.nasl - Type : ACT_GATHER_INFO |
| 2012-06-26 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9386.nasl - Type : ACT_GATHER_INFO |
| 2012-06-14 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0721.nasl - Type : ACT_GATHER_INFO |
| 2012-06-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_xen-201206-8180.nasl - Type : ACT_GATHER_INFO |
| 2012-06-13 | Name : The Windows kernel is affected by multiple elevation of privilege vulnerabili... File : smb_nt_ms12-042.nasl - Type : ACT_GATHER_INFO |
| 2012-06-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0721.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:55:59 |
|
| 2012-12-04 13:22:29 |
|
