Oracle Linux 5 : kernel (ELSA-2014-0740)

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote Oracle Linux host is missing one or more security updates.

Description :

From Red Hat Security Advisory 2014:0740 :

Updated kernel packages that fix three security issues and several
bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

* A flaw was found in the way the Linux kernel's floppy driver handled
user space provided data in certain error code paths while processing
FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX
could use this flaw to free (using the kfree() function) arbitrary
kernel memory. (CVE-2014-1737, Important)

* It was found that the Linux kernel's floppy driver leaked internal
kernel memory addresses to user space during the processing of the
FDRAWCMD IOCTL command. A local user with write access to /dev/fdX
could use this flaw to obtain information about the kernel heap
arrangement. (CVE-2014-1738, Low)

Note: A local user with write access to /dev/fdX could use these two
flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate
their privileges on the system.

* A NULL pointer dereference flaw was found in the
rds_ib_laddr_check() function in the Linux kernel's implementation of
Reliable Datagram Sockets (RDS). A local, unprivileged user could use
this flaw to crash the system. (CVE-2013-7339, Moderate)

Red Hat would like to thank Matthew Daley for reporting CVE-2014-1737
and CVE-2014-1738.

This update also fixes the following bugs :

* A bug in the futex system call could result in an overflow when
passing a very large positive timeout. As a consequence, the
FUTEX_WAIT operation did not work as intended and the system call was
timing out immediately. A backported patch fixes this bug by limiting
very large positive timeouts to the maximal supported value.
(BZ#1091832)

* A new Linux Security Module (LSM) functionality related to the
setrlimit hooks should produce a warning message when used by a third
party module that could not cope with it. However, due to a
programming error, the kernel could print this warning message when a
process was setting rlimits for a different process, or if rlimits
were modified by another than the main thread even though there was no
incompatible third party module. This update fixes the relevant code
and ensures that the kernel handles this warning message correctly.
(BZ#1092869)

* Previously, the kernel was unable to detect KVM on system boot if
the Hyper-V emulation was enabled. A patch has been applied to ensure
that both KVM and Hyper-V hypervisors are now correctly detected
during system boot. (BZ#1094152)

* A function in the RPC code responsible for verifying whether cached
credentials match the current process did not perform the check
correctly. The code checked only whether the groups in the current
process credentials appear in the same order as in the cached
credentials but did not ensure that no other groups are present in the
cached credentials. As a consequence, when accessing files in NFS
mounts, a process with the same UID and GID as the original process
but with a non-matching group list could have been granted an
unauthorized access to a file, or under certain circumstances, the
process could have been wrongly prevented from accessing the file. The
incorrect test condition has been fixed and the problem can no longer
occur. (BZ#1095062)

* When being under heavy load, some Fibre Channel storage devices,
such as Hitachi and HP Open-V series, can send a logout (LOGO) message
to the host system. However, due to a bug in the lpfc driver, this
could result in a loss of active paths to the storage and the paths
could not be recovered without manual intervention. This update
corrects the lpfc driver to ensure automatic recovery of the lost
paths to the storage in this scenario. (BZ#1096061)

All kernel users are advised to upgrade to these updated packages,
which contain backported patches to correct these issues. The system
must be rebooted for this update to take effect.

See also :

https://oss.oracle.com/pipermail/el-errata/2014-June/004191.html

Solution :

Update the affected kernel packages.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.3
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Oracle Linux Local Security Checks

Nessus Plugin ID: 74482 ()

Bugtraq ID: 66351
67300
67302

CVE ID: CVE-2013-7339
CVE-2014-1737
CVE-2014-1738