Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This script is Copyright (C) 2012 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issues :

- Using the SG_IO ioctl to issue SCSI requests to
partitions or LVM volumes resulted in the requests being
passed to the underlying block device. If a privileged
user only had access to a single partition or LVM
volume, they could use this flaw to bypass those
restrictions and gain read and write access (and be able
to issue other SCSI commands) to the entire block
device. (CVE-2011-4127, Important)

- A flaw was found in the way the Linux kernel handled
robust list pointers of user-space held futexes across
exec() calls. A local, unprivileged user could use this
flaw to cause a denial of service or, eventually,
escalate their privileges. (CVE-2012-0028, Important)

- A flaw was found in the Linux kernel in the way
splitting two extents in
ext4_ext_convert_to_initialized() worked. A local,
unprivileged user with the ability to mount and unmount
ext4 file systems could use this flaw to cause a denial
of service. (CVE-2011-3638, Moderate)

- A flaw was found in the way the Linux kernel's
journal_unmap_buffer() function handled buffer head
states. On systems that have an ext4 file system with a
journal mounted, a local, unprivileged user could use
this flaw to cause a denial of service. (CVE-2011-4086,
Moderate)

- A divide-by-zero flaw was found in the Linux kernel's
igmp_heard_query() function. An attacker able to send
certain IGMP (Internet Group Management Protocol)
packets to a target system could use this flaw to cause
a denial of service. (CVE-2012-0207, Moderate)

This update also fixes the following bugs :

- When a host was in recovery mode and a SCSI scan
operation was initiated, the scan operation failed and
provided no error output. This bug has been fixed and
the SCSI layer now waits for recovery of the host to
complete scan operations for devices.

- SG_IO ioctls were not implemented correctly in the
previous virtio-blk driver. Sending an SG_IO ioctl
request to a virtio-blk disk caused the sending thread
to enter an uninterruptible sleep state ('D' state).
With this update, SG_IO ioctls are rejected by the
virtio-blk driver: the ioctl system call will simply
return an ENOTTY ('Inappropriate ioctl for device')
error and the thread will continue normally.

Users should upgrade to these updated packages, which contain
backported patches to correct these issues. The system must be
rebooted for this update to take effect.

See also :

http://www.nessus.org/u?75e6c708

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
Public Exploit Available : true

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 61241 ()

Bugtraq ID:

CVE ID: CVE-2011-3638
CVE-2011-4086
CVE-2011-4127
CVE-2012-0028
CVE-2012-0207