10 - RHSA-2010:0631

Problem Description:

Updated kernel-rt packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise MRG 1.2.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

MRG Realtime for RHEL 5 Server - i386, noarch, x86_64

3. Description:

These packages contain the Linux kernel, the core of any Linux operating system.

Security fixes:

* unsafe sprintf() use in the Bluetooth implementation. Creating a large number of Bluetooth L2CAP, SCO, or RFCOMM sockets could result in arbitrary memory pages being overwritten, allowing a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2010-1084, Important)

* a flaw in the Unidirectional Lightweight Encapsulation implementation, allowing a remote attacker to send a specially-crafted ISO MPEG-2 Transport Stream frame to a target system, resulting in a denial of service. (CVE-2010-1086, Important)

* NULL pointer dereference in nfs_wb_page_cancel(), allowing a local user on a system that has an NFS-mounted file system to cause a denial of service or escalate their privileges on that system. (CVE-2010-1087, Important)

* flaw in sctp_process_unk_param(), allowing a remote attacker to send a specially-crafted SCTP packet to an SCTP listening port on a target system, causing a denial of service. (CVE-2010-1173, Important)

* race condition between finding a keyring by name and destroying a freed keyring in the key management facility, allowing a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2010-1437, Important)

* systems using the kernel NFS server to export a shared memory file system and that have the sysctl overcommit_memory variable set to never overcommit (a value of 2; by default, it is set to 0), may experience a NULL pointer dereference, allowing a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2008-7256, CVE-2010-1643, Important)

* when an application has a stack overflow, the stack could silently overwrite another memory mapped area instead of a segmentation fault occurring, which could lead to local privilege escalation on 64-bit systems. This issue is fixed with an implementation of a stack guard feature. (CVE-2010-2240, Important)

* flaw in CIFSSMBWrite() could allow a remote attacker to send a specially-crafted SMB response packet to a target CIFS client, resulting in a denial of service. (CVE-2010-2248, Important)

* buffer overflow flaws in the kernel's implementation of the server-side XDR for NFSv4 could allow an attacker on the local network to send a specially-crafted large compound request to the NFSv4 server, possibly resulting in a denial of service or code execution. (CVE-2010-2521, Important)

* NULL pointer dereference in the firewire-ohci driver used for OHCI compliant IEEE 1394 controllers could allow a local, unprivileged user with access to /dev/fw* files to issue certain IOCTL calls, causing a denial of service or privilege escalation. The FireWire modules are blacklisted by default. If enabled, only root has access to the files noted above by default. (CVE-2009-4138, Moderate)

* flaw in the link_path_walk() function. Using the file descriptor returned by open() with the O_NOFOLLOW flag on a subordinate NFS-mounted file system, could result in a NULL pointer dereference, causing a denial of service or privilege escalation. (CVE-2010-1088, Moderate)

* memory leak in release_one_tty() could allow a local, unprivileged user to cause a denial of service. (CVE-2010-1162, Moderate)

* information leak in the USB implementation. Certain USB errors could result in an uninitialized kernel buffer being sent to user-space. An attacker with physical access to a target system could use this flaw to cause an information leak. (CVE-2010-1083, Low)

Red Hat would like to thank Neil Brown for reporting CVE-2010-1084; Ang Way Chuang for reporting CVE-2010-1086; Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; the X.Org security team for reporting CVE-2010-2240, with upstream acknowledging Rafal Wojtczuk as the original reporter; and Marcus Meissner for reporting CVE-2010-1083.

4. Solution:

Users should upgrade to these updated packages, which contain backported patches to correct these issues and fix the bugs noted in the Kernel Security Update document, linked to in the References. The system must be rebooted for this update to take effect.

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259

To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system.

5. Bugs fixed (http://bugzilla.redhat.com/):

547236 - CVE-2009-4138 kernel: firewire: ohci: handle receive packets with a data length of zero 555671 - MRG -146/-147 kernels have older broadcom drivers compared with RHEL5.4 562075 - kernel: vfs: add MNT_NOFOLLOW flag to umount(2) [mrg-1] 566624 - CVE-2010-1083 kernel: information leak via userspace USB interface 567184 - CVE-2010-1087 kernel: NFS: Fix an Oops when truncating a file 567813 - CVE-2010-1088 kernel: fix LOOKUP_FOLLOW on automount "symlinks" 569237 - CVE-2010-1086 kernel: dvb-core: DoS bug in ULE decapsulation code 576018 - CVE-2010-1084 kernel: bluetooth: potential bad memory access with sysfs files 582076 - CVE-2010-1162 kernel: tty: release_one_tty() forgets to put pids 584645 - CVE-2010-1173 kernel: sctp: crash due to malformed SCTPChunkInit packet 585094 - CVE-2010-1437 kernel: keyrings: find_keyring_by_name() can gain the freed keyring 594630 - kernel: security: testing the wrong variable in create_by_name() [mrg-1] 595970 - CVE-2008-7256 CVE-2010-1643 kernel: nfsd: fix vm overcommit crash 601210 - Fusion MPT misc device (ioctl) driver too verbose in message/fusion/mptctl.c::mptctl_ioctl() 606611 - CVE-2010-2240 kernel: mm: keep a guard page below a grow-down stack segment 608583 - CVE-2010-2248 kernel: cifs: Fix a kernel BUG with remote OS/2 server 612028 - CVE-2010-2521 kernel: nfsd4: bug in read_buf