The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0291 advisory.

  - The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in     the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files     that are setgid without group-execute permission, which allows local users to cause a denial of service     (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this     file's permissions. (CVE-2010-0727)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0178 advisory.

  - Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote     attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that     triggers a certain state change in the absence of an aggregation session. (CVE-2009-4027)

  - The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-     assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed     ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex     value). (CVE-2009-4307)

  - The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in     the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files     that are setgid without group-execute permission, which allows local users to cause a denial of service     (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this     file's permissions. (CVE-2010-0727)

  - Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when     IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service     (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not     properly handled and causes the skb structure to be freed. (CVE-2010-1188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

Updated gfs-kmod packages that fix one security issue are now available for Red Hat Enterprise Linux 5.4 Extended Update Support, kernel release 2.6.18-164.19.1.el5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The gfs-kmod packages contain modules that provide the ability to mount and use GFS file systems.

A flaw was found in the gfs_lock() implementation. The GFS locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS file system mounted could use this flaw to cause a kernel panic. (CVE-2010-0727)

These updated gfs-kmod packages are in sync with the latest kernel (2.6.18-164.19.1.el5). The modules in earlier gfs-kmod packages failed to load because they did not match the running kernel. It was possible to force-load the modules. With this update, however, users no longer need to.

Users are advised to upgrade to these latest gfs-kmod packages, updated for use with the 2.6.18-164.19.1.el5 kernel, which contain a backported patch to correct this issue.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.4 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a race condition was found in the mac80211 implementation, a framework used for writing drivers for wireless devices. An attacker could trigger this flaw by sending a Delete Block ACK (DELBA) packet to a target system, resulting in a remote denial of service. Note:
This issue only affected users on 802.11n networks, and that also use the iwlagn driver with Intel wireless hardware. (CVE-2009-4027, Important)

* a use-after-free flaw was found in the tcp_rcv_state_process() function in the Linux kernel TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic (denial of service). (CVE-2010-1188, Important)

* a flaw was found in the gfs2_lock() implementation. The GFS2 locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS2 file system mounted could use this flaw to cause a kernel panic (denial of service). (CVE-2010-0727, Moderate)

* a divide-by-zero flaw was found in the ext4 file system code. A local attacker could use this flaw to cause a denial of service by mounting a specially crafted ext4 file system. (CVE-2009-4307, Low)

Bug fixes :

* if a program that calls posix_fadvise() were compiled on x86, and then run on a 64-bit system, that program could experience various problems, including performance issues and the call to posix_fadvise() failing, causing the program to not run as expected or even abort.
With this update, when such programs attempt to call posix_fadvise() on 64-bit systems, sys32_fadvise64() is called instead, which resolves this issue. This update also fixes other 32-bit system calls that were mistakenly called on 64-bit systems (including systems running the kernel-xen kernel). (BZ#569597)

* on some systems able to set a P-State limit via the BIOS, it was not possible to set the limit to a higher frequency if the system was rebooted while a low limit was set:
'/sys/devices/system/cpu/cpu[x]/cpufreq/scaling_max_freq' would retain the low limit in these situations. With this update, limits are correctly set, even after being changed after a system reboot.
(BZ#569727)

* certain Intel ICH hardware (using the e1000e driver) has an NFS filtering capability that did not work as expected, causing memory corruption, which could lead to kernel panics, or other unexpected behavior. In a reported case, a panic occurred when running NFS connection tests. This update resolves this issue by disabling the filtering capability. (BZ#569797)

* if 'open(/proc/[PID]/[xxxx])' was called at the same time the process was exiting, the call would fail with an EINVAL error (an incorrect error for this situation). With this update, the correct error, ENOENT, is returned in this situation. (BZ#571362)

* multiqueue is used for transmitting data, but a single queue transmit ON/OFF scheme was used. This led to a race condition on systems with the bnx2x driver in situations where one queue became full, but not stopped, and the other queue enabled transmission. With this update, only a single queue is used. (BZ#576951)

* the '/proc/sys/vm/mmap_min_addr' tunable helps prevent unprivileged users from creating new memory mappings below the minimum address. The sysctl value for mmap_min_addr could be changed by a process or user that has an effective user ID (euid) of 0, even if the process or user does not have the CAP_SYS_RAWIO capability. This update adds a capability check for the CAP_SYS_RAWIO capability before allowing the mmap_min_addr value to be changed. (BZ#577206)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0291 advisory.

  - kernel: bug in GFS/GFS2 locking code leads to dos (CVE-2010-0727)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This updated gfs-kmod is already in SL 5.5.

A flaw was found in the gfs_lock() implementation. The GFS locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS file system mounted could use this flaw to cause a kernel panic. (CVE-2010-0727)

These updated gfs-kmod packages are in sync with the latest kernel (2.6.18-194.el5). The modules in earlier gfs-kmod packages failed to load because they did not match the running kernel. It was possible to force-load the modules. With this update, however, users no longer need to.

These updated gfs-kmod packages also fix the following bugs :

  - when SELinux was in permissive mode, a race condition     during file creation could have caused one or more     cluster nodes to be fenced and lock the remaining nodes     out of the GFS file system. This race condition no     longer occurs with this update. (BZ#471258)

  - when ACLs (Access Control Lists) are enabled on a GFS     file system, if a transaction that has started to do a     write request does not have enough spare blocks for the     operation it causes a kernel panic. This update ensures     that there are enough blocks for the write request     before starting the operation. (BZ#513885)

  - requesting a 'flock' on a file in GFS in either     read-only or read-write mode would sometimes cause a     'Resource temporarily unavailable' state error (error 11     for EWOULDBLOCK) to occur. In these cases, a flock could     not be obtained on the file in question. This has been     fixed with this update so that flocks can successfully     be obtained on GFS files without this error occurring.
    (BZ#515717)

  - the GFS withdraw function is a data integrity feature of     GFS file systems in a cluster. If the GFS kernel module     detects an inconsistency in a GFS file system following     an I/O operation, the file system becomes unavailable to     the cluster. The GFS withdraw function is less severe     than a kernel panic, which would cause another node to     fence the node. With this update, you can override the     GFS withdraw function by mounting the file system with     the '-o errors=panic' option specified. When this option     is specified, any errors that would normally cause the     system to withdraw cause the system to panic instead.
    This stops the node's cluster communications, which     causes the node to be fenced. (BZ#517145)

Finally, these updated gfs-kmod packages provide the following enhancement :

  - the GFS kernel modules have been updated to use the new     generic freeze and unfreeze ioctl interface that is also     supported by the following file systems: ext3, ext4,     GFS2, JFS and ReiserFS. With this update, GFS supports     freeze/unfreeze through the VFS-level FIFREEZE/FITHAW     ioctl interface. (BZ#487610)

A flaw was found in the gfs_lock() implementation. The GFS locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS file system mounted could use this flaw to cause a kernel panic. (CVE-2010-0727)

As well, these updated GFS packages are in sync with the latest kernel (2.4.21-63.EL). The modules in earlier GFS packages fail to load because they do not match the running kernel. It is possible to force-load the modules; however, with this update, force-loading the modules is not required. (BZ#525198)

Users are advised to upgrade to these latest GFS packages, which resolve this issue and are updated for use with the 2.4.21-63.EL kernel.

This update fixes various security issues and some bugs in the SUSE Linux Enterprise 9 kernel.

The following security issues were fixed :

  - A crafted NFS write request might have caused a buffer     overwrite, potentially causing a kernel crash.
    (CVE-2010-2521)

  - The x86_64 copy_to_user implementation might have leaked     kernel memory depending on specific user buffer setups.
    (CVE-2008-0598)

  - drivers/net/r8169.c in the r8169 driver in the Linux     kernel did not properly check the size of an Ethernet     frame that exceeds the MTU, which allows remote     attackers to (1) cause a denial of service (temporary     network outage) via a packet with a crafted size, in     conjunction with certain packets containing A characters     and certain packets containing E characters; or (2)     cause a denial of service (system crash) via a packet     with a crafted size, in conjunction with certain packets     containing '\0' characters, related to the value of the     status register and erroneous behavior associated with     the RxMaxSize register. NOTE: this vulnerability exists     because of an incorrect fix for CVE-2009-1389.
    (CVE-2009-4537)

  - Use-after-free vulnerability in net/ipv4/tcp_input.c in     the Linux kernel 2.6 when IPV6_RECVPKTINFO is set on a     listening socket, allowed remote attackers to cause a     denial of service (kernel panic) via a SYN packet while     the socket is in a listening (TCP_LISTEN) state, which     is not properly handled causes the skb structure to be     freed. (CVE-2010-1188)

  - The (1) real_lookup and (2) __lookup_hash functions in     fs/namei.c in the vfs implementation in the Linux kernel     did not prevent creation of a child dentry for a deleted     (aka S_DEAD) directory, which allowed local users to     cause a denial of service ('overflow' of the UBIFS     orphan area) via a series of attempted file creations     within deleted directories. (CVE-2008-3275)

  - The nfs_lock function in fs/nfs/file.c in the Linux     kernel did not properly remove POSIX locks on files that     are setgid without group-execute permission, which     allows local users to cause a denial of service (BUG and     system crash) by locking a file on an NFS filesystem and     then changing this files permissions, a related issue to     CVE-2010-0727. (CVE-2007-6733)

  - The do_coredump function in fs/exec.c in Linux kernel     did not change the UID of a core dump file if it exists     before a root process creates a core dump in the same     location, which might have allowed local users to obtain     sensitive information. (CVE-2007-6206)

  - fs/namei.c in the Linux kernel did not always follow NFS     automount 'symlinks,' which allowed attackers to have an     unknown impact, related to LOOKUP_FOLLOW.
    (CVE-2010-1088)

  - Stack-based buffer overflow in the hfs subsystem in the     Linux kernel allowed remote attackers to have an     unspecified impact via a crafted Hierarchical File     System (HFS) filesystem, related to the hfs_readdir     function in fs/hfs/dir.c. (CVE-2009-4020)

  - The processcompl_compat function in     drivers/usb/core/devio.c in Linux kernel did not clear     the transfer buffer before returning to userspace when a     USB command fails, which might have made it easier for     physically proximate attackers to obtain sensitive     information (kernel memory). (CVE-2010-1083)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions. (CVE-2010-0727)

The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set. (CVE-2010-0415)

drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537. (CVE-2009-4538)

The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function. (CVE-2010-0307)

Aditionally, it was added support for some backlight models used in Samsung laptops and fixes to detect Saitek X52 joysticks.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

USN-947-1 fixed vulnerabilities in the Linux kernel. Fixes for CVE-2010-0419 caused failures when using KVM in certain situations.
This update reverts that fix until a better solution can be found.

We apologize for the inconvenience.

It was discovered that the Linux kernel did not correctly handle memory protection of the Virtual Dynamic Shared Object page when running a 32-bit application on a 64-bit kernel. A local attacker could exploit this to cause a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2009-4271)

It was discovered that the r8169 network driver did not correctly check the size of Ethernet frames. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2009-4537)

Wei Yongjun discovered that SCTP did not correctly validate certain chunks. A remote attacker could send specially crafted traffic to monopolize CPU resources, leading to a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2010-0008)

It was discovered that KVM did not correctly limit certain privileged IO accesses on x86. Processes in the guest OS with access to IO regions could gain further privileges within the guest OS. (Did not affect Ubuntu 6.06 LTS.) (CVE-2010-0298, CVE-2010-0306, CVE-2010-0419)

Evgeniy Polyakov discovered that IPv6 did not correctly handle certain TUN packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(Only affected Ubuntu 8.04 LTS.) (CVE-2010-0437)

Sachin Prabhu discovered that GFS2 did not correctly handle certain locks. A local attacker with write access to a GFS2 filesystem could exploit this to crash the system, leading to a denial of service. (CVE-2010-0727)

Jamie Strandboge discovered that network virtio in KVM did not correctly handle certain high-traffic conditions. A remote attacker could exploit this by sending specially crafted traffic to a guest OS, causing the guest to crash, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0741)

Marcus Meissner discovered that the USB subsystem did not correctly handle certain error conditions. A local attacker with access to a USB device could exploit this to read recently used kernel memory, leading to a loss of privacy and potentially root privilege escalation. (CVE-2010-1083)

Neil Brown discovered that the Bluetooth subsystem did not correctly handle large amounts of traffic. A physically proximate remote attacker could exploit this by sending specially crafted traffic that would consume all available system memory, leading to a denial of service. (Ubuntu 6.06 LTS and 10.04 LTS were not affected.) (CVE-2010-1084)

Jody Bruchon discovered that the sound driver for the AMD780V did not correctly handle certain conditions. A local attacker with access to this hardward could exploit the flaw to cause a system crash, leading to a denial of service.
(CVE-2010-1085)

Ang Way Chuang discovered that the DVB driver did not correctly handle certain MPEG2-TS frames. An attacker could exploit this by delivering specially crafted frames to monopolize CPU resources, leading to a denial of service.
(Ubuntu 10.04 LTS was not affected.) (CVE-2010-1086)

Trond Myklebust discovered that NFS did not correctly handle truncation under certain conditions. A local attacker with write access to an NFS share could exploit this to crash the system, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1087)

Al Viro discovered that automount of NFS did not correctly handle symlinks under certain conditions. A local attacker could exploit this to crash the system, leading to a denial of service. (Ubuntu 6.06 LTS and Ubuntu 10.04 LTS were not affected.) (CVE-2010-1088)

Matt McCutchen discovered that ReiserFS did not correctly protect xattr files in the .reiserfs_priv directory. A local attacker could exploit this to gain root privileges or crash the system, leading to a denial of service. (CVE-2010-1146)

Eugene Teo discovered that CIFS did not correctly validate arguments when creating new files. A local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges if mmap_min_addr was not set. (CVE-2010-1148)

Catalin Marinas and Tetsuo Handa discovered that the TTY layer did not correctly release process IDs. A local attacker could exploit this to consume kernel resources, leading to a denial of service. (CVE-2010-1162)

Neil Horman discovered that TIPC did not correctly check its internal state. A local attacker could send specially crafted packets via AF_TIPC that would cause the system to crash, leading to a denial of service. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1187)

Masayuki Nakagawa discovered that IPv6 did not correctly handle certain settings when listening. If a socket were listening with the IPV6_RECVPKTINFO flag, a remote attacker could send specially crafted traffic that would cause the system to crash, leading to a denial of service. (Only Ubuntu 6.06 LTS was affected.) (CVE-2010-1188)

Oleg Nesterov discovered that the Out-Of-Memory handler did not correctly handle certain arrangements of processes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-1488).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Linux kernel did not correctly handle memory protection of the Virtual Dynamic Shared Object page when running a 32-bit application on a 64-bit kernel. A local attacker could exploit this to cause a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2009-4271)

It was discovered that the r8169 network driver did not correctly check the size of Ethernet frames. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2009-4537)

Wei Yongjun discovered that SCTP did not correctly validate certain chunks. A remote attacker could send specially crafted traffic to monopolize CPU resources, leading to a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2010-0008)

It was discovered that KVM did not correctly limit certain privileged IO accesses on x86. Processes in the guest OS with access to IO regions could gain further privileges within the guest OS. (Did not affect Ubuntu 6.06 LTS.) (CVE-2010-0298, CVE-2010-0306, CVE-2010-0419)

Evgeniy Polyakov discovered that IPv6 did not correctly handle certain TUN packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0437)

Sachin Prabhu discovered that GFS2 did not correctly handle certain locks. A local attacker with write access to a GFS2 filesystem could exploit this to crash the system, leading to a denial of service.
(CVE-2010-0727)

Jamie Strandboge discovered that network virtio in KVM did not correctly handle certain high-traffic conditions. A remote attacker could exploit this by sending specially crafted traffic to a guest OS, causing the guest to crash, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0741)

Marcus Meissner discovered that the USB subsystem did not correctly handle certain error conditions. A local attacker with access to a USB device could exploit this to read recently used kernel memory, leading to a loss of privacy and potentially root privilege escalation.
(CVE-2010-1083)

Neil Brown discovered that the Bluetooth subsystem did not correctly handle large amounts of traffic. A physically proximate remote attacker could exploit this by sending specially crafted traffic that would consume all available system memory, leading to a denial of service. (Ubuntu 6.06 LTS and 10.04 LTS were not affected.) (CVE-2010-1084)

Jody Bruchon discovered that the sound driver for the AMD780V did not correctly handle certain conditions. A local attacker with access to this hardward could exploit the flaw to cause a system crash, leading to a denial of service. (CVE-2010-1085)

Ang Way Chuang discovered that the DVB driver did not correctly handle certain MPEG2-TS frames. An attacker could exploit this by delivering specially crafted frames to monopolize CPU resources, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1086)

Trond Myklebust discovered that NFS did not correctly handle truncation under certain conditions. A local attacker with write access to an NFS share could exploit this to crash the system, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1087)

Al Viro discovered that automount of NFS did not correctly handle symlinks under certain conditions. A local attacker could exploit this to crash the system, leading to a denial of service. (Ubuntu 6.06 LTS and Ubuntu 10.04 LTS were not affected.) (CVE-2010-1088)

Matt McCutchen discovered that ReiserFS did not correctly protect xattr files in the .reiserfs_priv directory. A local attacker could exploit this to gain root privileges or crash the system, leading to a denial of service. (CVE-2010-1146)

Eugene Teo discovered that CIFS did not correctly validate arguments when creating new files. A local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges if mmap_min_addr was not set. (CVE-2010-1148)

Catalin Marinas and Tetsuo Handa discovered that the TTY layer did not correctly release process IDs. A local attacker could exploit this to consume kernel resources, leading to a denial of service.
(CVE-2010-1162)

Neil Horman discovered that TIPC did not correctly check its internal state. A local attacker could send specially crafted packets via AF_TIPC that would cause the system to crash, leading to a denial of service. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1187)

Masayuki Nakagawa discovered that IPv6 did not correctly handle certain settings when listening. If a socket were listening with the IPV6_RECVPKTINFO flag, a remote attacker could send specially crafted traffic that would cause the system to crash, leading to a denial of service. (Only Ubuntu 6.06 LTS was affected.) (CVE-2010-1188)

Oleg Nesterov discovered that the Out-Of-Memory handler did not correctly handle certain arrangements of processes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-1488).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4537     Fabian Yamaguchi reported a missing check for Ethernet     frames larger than the MTU in the r8169 driver. This may     allow users on the local network to crash a system,     resulting in a denial of service.

  - CVE-2010-0727     Sachin Prabhu reported an issue in the GFS2 filesystem.
    Local users can trigger a BUG() altering the permissions     on a locked file, resulting in a denial of service.

  - CVE-2010-1083     Linus Torvalds reported an issue in the USB subsystem,     which may allow local users to obtain portions of     sensitive kernel memory.

  - CVE-2010-1084     Neil Brown reported an issue in the Bluetooth subsystem     that may permit remote attackers to overwrite memory     through the creation of large numbers of sockets,     resulting in a denial of service.

  - CVE-2010-1086     Ang Way Chuang reported an issue in the DVB subsystem     for Digital TV adapters. By creating a specially-encoded     MPEG2-TS frame, a remote attacker could cause the     receiver to enter an endless loop, resulting in a denial     of service.

  - CVE-2010-1087     Trond Myklebust reported an issue in the NFS filesystem.
    A local user may cause an oops by sending a fatal signal     during a file truncation operation, resulting in a     denial of service.

  - CVE-2010-1088     Al Viro reported an issue where automount symlinks may     not be followed when LOOKUP_FOLLOW is not set. This has     an unknown security impact.

  - CVE-2010-1162     Catalin Marinas reported an issue in the tty subsystem     that allows local attackers to cause a kernel memory     leak, possibly resulting in a denial of service.

  - CVE-2010-1173     Chris Guo from Nokia China and Jukka Taimisto and Olli     Jarva from Codenomicon Ltd reported an issue in the SCTP     subsystem that allows a remote attacker to cause a     denial of service using a malformed init package.

  - CVE-2010-1187     Neil Hormon reported an issue in the TIPC subsystem.
    Local users can cause a denial of service by way of a     NULL pointer dereference by sending datagrams through     AF_TIPC before entering network mode.

  - CVE-2010-1437     Toshiyuki Okajima reported a race condition in the     keyring subsystem. Local users can cause memory     corruption via keyctl commands that access a keyring in     the process of being deleted, resulting in a denial of     service.

  - CVE-2010-1446     Wufei reported an issue with kgdb on the PowerPC     architecture, allowing local users to write to kernel     memory. Note: this issue does not affect binary kernels     provided by Debian. The fix is provided for the benefit     of users who build their own kernels from Debian source.

  - CVE-2010-1451     Brad Spengler reported an issue on the SPARC     architecture that allows local users to execute     non-executable pages.

This update also includes fixes a regression introduced by a previous update. See the referenced Debian bug page for details.

Updated kernel packages that fix three security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the fifth regular update.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a race condition was found in the mac80211 implementation, a framework used for writing drivers for wireless devices. An attacker could trigger this flaw by sending a Delete Block ACK (DELBA) packet to a target system, resulting in a remote denial of service. Note:
This issue only affected users on 802.11n networks, and that also use the iwlagn driver with Intel wireless hardware. (CVE-2009-4027, Important)

* a flaw was found in the gfs2_lock() implementation. The GFS2 locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS2 file system mounted could use this flaw to cause a kernel panic. (CVE-2010-0727, Moderate)

* a divide-by-zero flaw was found in the ext4 file system code. A local attacker could use this flaw to cause a denial of service by mounting a specially crafted ext4 file system. (CVE-2009-4307, Low)

These updated packages also include several hundred bug fixes for and enhancements to the Linux kernel. Space precludes documenting each of these changes in this advisory and users are directed to the Red Hat Enterprise Linux 5.5 Release Notes for information on the most significant of these changes :

http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.5/html/ Release_Notes/

Also, for details concerning every bug fixed in and every enhancement added to the kernel for this release, refer to the kernel chapter in the Red Hat Enterprise Linux 5.5 Technical Notes :

http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.5/html/ Technical_Notes/kernel.html

All Red Hat Enterprise Linux 5 users are advised to install these updated packages, which address these vulnerabilities as well as fixing the bugs and adding the enhancements noted in the Red Hat Enterprise Linux 5.5 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.

ID	Name	Product	Family	Severity
181112	Oracle Linux 5 : gfs-kmod (ELSA-2010-0291)	Nessus	Oracle Linux Local Security Checks	medium
180620	Oracle Linux 5 : Oracle / Enterprise / Linux / 5.5 / kernel (ELSA-2010-0178)	Nessus	Oracle Linux Local Security Checks	medium
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
63938	RHEL 5 : gfs-kmod (RHSA-2010:0521)	Nessus	Red Hat Local Security Checks	medium
63932	RHEL 5 : kernel (RHSA-2010:0380)	Nessus	Red Hat Local Security Checks	high
63925	RHEL 5 : gfs-kmod (RHSA-2010:0291)	Nessus	Red Hat Local Security Checks	medium
60768	Scientific Linux Security Update : gfs-kmod on SL 5.0-5.4 i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60760	Scientific Linux Security Update : GFS on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
48901	SuSE9 Security Update : Linux kernel (YOU Patch Number 12636)	Nessus	SuSE Local Security Checks	critical
48176	Mandriva Linux Security Advisory : kernel (MDVSA-2010:066)	Nessus	Mandriva Local Security Checks	critical
46811	Ubuntu 10.04 LTS : linux regression (USN-947-2)	Nessus	Ubuntu Local Security Checks	high
46810	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : linux, linux-source-2.6.15 vulnerabilities (USN-947-1)	Nessus	Ubuntu Local Security Checks	high
46725	Debian DSA-2053-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	high
46282	RHEL 5 : kernel (RHSA-2010:0178)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-0727

medium

Tenable Plugins

medium

medium

high

medium

high

medium

medium

medium

critical

critical

high

high

high

high