Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2003)

This script is Copyright (C) 2013-2015 Tenable Network Security, Inc.

Synopsis :

The remote Oracle Linux host is missing one or more security updates.

Description :

Description of changes:

* CVE-2012-0207: Denial of service bug in IGMP.

The IGMP subsystem's compatibility handling of v2 packets had a bug in
the computation of a delay field which could result in division by
zero (causing a kernel panic).

* CVE-2012-0045: Denial of service in KVM system call emulation.

A bug in the system call emulation for allowed local users on a 32-bit
KVM guest system to cause the guest system to panic.

* CVE-2012-0038: In-memory corruption in XFS ACL processing.

A missing check in xfs_acl_from_disk on the number of XFS ACLs could
result in in-memory corruption and a kernel panic.

* CVE-2011-4622: NULL pointer deference in KVM interval timer emulation.

Starting PIT timers in the absence of irqchip support could cause a
NULL pointer dereference and kernel OOPs.

* CVE-2011-4347: Denial of service in KVM device assignment.

Several bugs that allowed unprivileged users to improperly assign
devices to KVM guests could result in a denial of service.

* CVE-2011-4132: Denial of service in Journaling Block Device layer.

A flaw in the way the Journaling Block Device (JBD) layer handled an
invalid log first block value allowed an attacker to mount a malicious
ext3 or ext4 image that would crash the system.

* CVE-2011-4081: NULL pointer dereference in GHASH cryptographic algorithm.

Nick Bowler reported an issue in the GHASH message digest
algorithm. ghash_update can pass a NULL pointer to gf128mul_4k_lle in some
cases, leading to a NULL pointer dereference (kernel OOPS).

* CVE-2011-4077: Buffer overflow in xfs_readlink.

A flaw in the way the XFS filesystem implementation handled links with
pathnames larger than MAXPATHLEN allowed an attacker to mount a
malicious XFS image that could crash the system or result in privilege

- [fs] xfs: Fix possible memory corruption in xfs_readlink (Carlos
Maiolino) {CVE-2011-4077}
- [scsi] increase qla2xxx firmware ready time-out (Joe Jin)
- [scsi] qla2xxx: Module parameter to control use of async or sync port
login (Joe Jin)
- [net] tg3: Fix single-vector MSI-X code (Joe Jin)
- [net] qlge: fix size of external list for TX address descriptors (Joe Jin)
- [net] e1000e: Avoid wrong check on TX hang (Joe Jin)
- crypto: ghash - Avoid NULL pointer dereference if no key is set (Nick
Bowler) {CVE-2011-4081}
- jbd/jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan)
- KVM: Device assignment permission checks (Joe Jin) {CVE-2011-4347}
- KVM: x86: Prevent starting PIT timers in the absence of irqchip
support (Jan Kiszka) {CVE-2011-4622}
- xfs: validate acl count (Joe Jin) {CVE-2012-0038}
- KVM: x86: fix missing checks in syscall emulation (Joe Jin)
- KVM: x86: extend 'struct x86_emulate_ops' with 'get_cpuid' (Joe Jin)
- igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Ben
Hutchings) {CVE-2012-0207}
- ipv4: correct IGMP behavior on v3 query during v2-compatibility mode
(David Stevens)
- fuse: fix fuse request unique id (Srinivas Eeda) [orabug 13816349]

- net: remove extra register in ip_gre (Guru Anbalagane) [Orabug: 13633287]

- [netdrv] fnic: return zero on fnic_reset() success (Joe Jin)
- [e1000e] Add entropy generation back for network interrupts (John Sobecki)
13476821] (John Sobecki)
(John Sobecki)
- [sunrpc] Add patch for a mount crash in __rpc_create_common [orabug
13322773] (John Sobecki)

- SPEC: fix dependency on firmware/mkinitrd (Guru Anbalagane) [orabug
- xfs: fix acl count validation in xfs_acl_from_disk() (Dan Carpenter)
- [SCSI] scsi_dh: check queuedata pointer before proceeding further
(Moger Babu)
[orabug 13615419]

See also :

Solution :

Update the affected unbreakable enterprise kernel packages.

Risk factor :

High / CVSS Base Score : 7.8
CVSS Temporal Score : 6.1
Public Exploit Available : true