RHEL 6 : kernel (RHSA-2012:1589)

This script is Copyright (C) 2013-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated kernel packages that fix one security issue and one bug are
now available for Red Hat Enterprise Linux 6.1 Extended Update
Support.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available from the
CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issue :

* A flaw was found in the way the Linux kernel's dl2k driver, used by
certain D-Link Gigabit Ethernet adapters, restricted IOCTLs. A local,
unprivileged user could use this flaw to issue potentially harmful
IOCTLs, which could cause Ethernet adapters using the dl2k driver to
malfunction (for example, losing network connectivity).
(CVE-2012-2313, Low)

Red Hat would like to thank Stephan Mueller for reporting this issue.

This update also fixes the following bug :

* The kernel allows high priority real time tasks, such as tasks
scheduled with the SCHED_FIFO policy, to be throttled. Previously, the
CPU stop tasks were scheduled as high priority real time tasks and
could be thus throttled accordingly. However, the replenishment timer,
which is responsible for clearing a throttle flag on tasks, could be
pending on the just disabled CPU. This could lead to the situation
that the throttled tasks were never scheduled to run. Consequently, if
any of such tasks was needed to complete the CPU disabling, the system
became unresponsive. This update introduces a new scheduler class,
which gives a task the highest possible system priority and such a
task cannot be throttled. The stop-task scheduling class is now used
for the CPU stop tasks, and the system shutdown completes as expected
in the scenario described. (BZ#876077)

Users should upgrade to these updated packages, which contain
backported patches to correct these issues. The system must be
rebooted for this update to take effect.

See also :

https://www.redhat.com/security/data/cve/CVE-2012-2313.html
http://rhn.redhat.com/errata/RHSA-2012-1589.html

Solution :

Update the affected packages.

Risk factor :

Low / CVSS Base Score : 1.2
(CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 1.0
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Red Hat Local Security Checks

Nessus Plugin ID: 64070 ()

Bugtraq ID: 53965

CVE ID: CVE-2012-2313