Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the command header of a Logical Link Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.

Updated kernel-rt packages that fix multiple security issues and various bugs are now available for Red Hat Enterprise MRG 2.0.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Security fixes :

* A flaw in the SCTP and DCCP implementations could allow a remote attacker to cause a denial of service. (CVE-2010-4526, CVE-2011-1770, Important)

* Flaws in the Management Module Support for Message Passing Technology (MPT) based controllers could allow a local, unprivileged user to cause a denial of service, an information leak, or escalate their privileges. (CVE-2011-1494, CVE-2011-1495, Important)

* Flaws in the AGPGART driver, and a flaw in agp_allocate_memory(), could allow a local user to cause a denial of service or escalate their privileges. (CVE-2011-1745, CVE-2011-2022, CVE-2011-1746, Important)

* A flaw in the client-side NLM implementation could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2491, Important)

* A flaw in the Bluetooth implementation could allow a remote attacker to cause a denial of service or escalate their privileges.
(CVE-2011-2497, Important)

* Flaws in the netlink-based wireless configuration interface could allow a local user, who has the CAP_NET_ADMIN capability, to cause a denial of service or escalate their privileges on systems that have an active wireless interface. (CVE-2011-2517, Important)

* The maximum file offset handling for ext4 file systems could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2695, Important)

* A local, unprivileged user could allocate large amounts of memory not visible to the OOM killer, causing a denial of service.
(CVE-2010-4243, Moderate)

* The proc file system could allow a local, unprivileged user to obtain sensitive information or possibly cause integrity issues.
(CVE-2011-1020, Moderate)

* A local, privileged user could possibly write arbitrary kernel memory via /sys/kernel/debug/acpi/custom_method. (CVE-2011-1021, Moderate)

* Inconsistency in the methods for allocating and freeing NFSv4 ACL data; CVE-2010-4250 fix caused a regression; a flaw in next_pidmap() and inet_diag_bc_audit(); flaws in the CAN implementation; a race condition in the memory merging support; a flaw in the taskstats subsystem; and the way mapping expansions were handled could allow a local, unprivileged user to cause a denial of service. (CVE-2011-1090, CVE-2011-1479, CVE-2011-1593, CVE-2011-2213, CVE-2011-1598, CVE-2011-1748, CVE-2011-2183, CVE-2011-2484, CVE-2011-2496, Moderate)

* A flaw in GRO could result in a denial of service when a malformed VLAN frame is received. (CVE-2011-1478, Moderate)

* napi_reuse_skb() could be called on VLAN packets allowing an attacker on the local network to possibly trigger a denial of service.
(CVE-2011-1576, Moderate)

* A denial of service could occur if packets were received while the ipip or ip_gre module was being loaded. (CVE-2011-1767, CVE-2011-1768, Moderate)

* Information leaks. (CVE-2011-1160, CVE-2011-2492, CVE-2011-2495, Low)

* Flaws in the EFI GUID Partition Table implementation could allow a local attacker to cause a denial of service. (CVE-2011-1577, CVE-2011-1776, Low)

* While a user has a CIFS share mounted that required successful authentication, a local, unprivileged user could mount that share without knowing the correct password if mount.cifs was setuid root.
(CVE-2011-1585, Low)

Red Hat would like to thank Dan Rosenberg for reporting CVE-2011-1770, CVE-2011-1494, CVE-2011-1495, CVE-2011-2497, and CVE-2011-2213;
Vasiliy Kulikov of Openwall for reporting CVE-2011-1745, CVE-2011-2022, CVE-2011-1746, CVE-2011-2484, and CVE-2011-2495; Vasily Averin for reporting CVE-2011-2491; Brad Spengler for reporting CVE-2010-4243; Kees Cook for reporting CVE-2011-1020; Robert Swiecki for reporting CVE-2011-1593 and CVE-2011-2496; Oliver Hartkopp for reporting CVE-2011-1748; Andrea Righi for reporting CVE-2011-2183;
Ryan Sweat for reporting CVE-2011-1478 and CVE-2011-1576; Peter Huewe for reporting CVE-2011-1160; Marek Kroemeke and Filip Palian for reporting CVE-2011-2492; and Timo Warns for reporting CVE-2011-1577 and CVE-2011-1776.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2025 advisory.

  - The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5     and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor     and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are     processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a     different vulnerability than CVE-2011-1478. (CVE-2011-1576)

  - Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not     have interrupt remapping, allows guest OS users to gain host OS privileges by using DMA to generate MSI     interrupts by writing to the interrupt injection registers. (CVE-2011-1898)

  - Race condition in the scan_get_next_rmap_item function in mm/ksm.c in the Linux kernel before 2.6.39.3,     when Kernel SamePage Merging (KSM) is enabled, allows local users to cause a denial of service (NULL     pointer dereference) or possibly have unspecified other impact via a crafted application. (CVE-2011-2183)

  - The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel     before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.
    (CVE-2011-2491)

  - The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data     structures, which allows local users to obtain potentially sensitive information from kernel memory via a     crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in     net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
    (CVE-2011-2492)

  - fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io     files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by     discovering the length of another user's password. (CVE-2011-2495)

  - Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel     before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have     unspecified other impact via a small command-size value within the command header of a Logical Link     Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.
    (CVE-2011-2497)

  - Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users     to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID     value. (CVE-2011-2517)

  - Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to     cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a     write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
    (CVE-2011-2695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1189 advisory.

  - kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal     sender via a sigqueueinfo system call. (CVE-2011-1182)

  - The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5     and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor     and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are     processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a     different vulnerability than CVE-2011-1478. (CVE-2011-1576)

  - Multiple integer overflows in the next_pidmap function in kernel/pid.c in the Linux kernel before 2.6.38.4     allow local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir     system call. (CVE-2011-1593)

  - The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size     of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically     proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive     information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability     than CVE-2011-1577. (CVE-2011-1776)

  - Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not     have interrupt remapping, allows guest OS users to gain host OS privileges by using DMA to generate MSI     interrupts by writing to the interrupt injection registers. (CVE-2011-1898)

  - Race condition in the scan_get_next_rmap_item function in mm/ksm.c in the Linux kernel before 2.6.39.3,     when Kernel SamePage Merging (KSM) is enabled, allows local users to cause a denial of service (NULL     pointer dereference) or possibly have unspecified other impact via a crafted application. (CVE-2011-2183)

  - The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel before 2.6.39.3 does not     properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite     loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an     INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880.
    (CVE-2011-2213)

  - The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel     before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.
    (CVE-2011-2491)

  - The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data     structures, which allows local users to obtain potentially sensitive information from kernel memory via a     crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in     net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
    (CVE-2011-2492)

  - fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io     files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by     discovering the length of another user's password. (CVE-2011-2495)

  - Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel     before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have     unspecified other impact via a small command-size value within the command header of a Logical Link     Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.
    (CVE-2011-2497)

  - Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users     to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID     value. (CVE-2011-2517)

  - The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the     size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of     service (BUG and system crash) by arranging for all resource groups to have too little free space.
    (CVE-2011-2689)

  - Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to     cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a     write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
    (CVE-2011-2695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security issues :

  - Using PCI passthrough without interrupt remapping     support allowed KVM guests to generate MSI interrupts     and thus potentially inject traps. A privileged guest     user could use this flaw to crash the host or possibly     escalate their privileges on the host. The fix for this     issue can prevent PCI passthrough working and guests     starting. (CVE-2011-1898, Important)

  - Flaw in the client-side NLM implementation could allow a     local, unprivileged user to cause a denial of service.
    (CVE-2011-2491, Important)

  - Integer underflow in the Bluetooth implementation could     allow a remote attacker to cause a denial of service or     escalate their privileges by sending a specially crafted     request to a target system via Bluetooth.
    (CVE-2011-2497, Important)

  - Buffer overflows in the netlink-based wireless     configuration interface implementation could allow a     local user, who has the CAP_NET_ADMIN capability, to     cause a denial of service or escalate their privileges     on systems that have an active wireless interface.
    (CVE-2011-2517, Important)

  - Flaw in the way the maximum file offset was handled for     ext4 file systems could allow a local, unprivileged user     to cause a denial of service. (CVE-2011-2695, Important)

  - Flaw allowed napi_reuse_skb() to be called on VLAN     packets. An attacker on the local network could use this     flaw to send crafted packets to a target, possibly     causing a denial of service. (CVE-2011-1576, Moderate)

  - Integer signedness error in next_pidmap() could allow a     local, unprivileged user to cause a denial of service.
    (CVE-2011-1593, Moderate)

  - Race condition in the memory merging support (KSM) could     allow a local, unprivileged user to cause a denial of     service. KSM is off by default, but on systems running     VDSM, or on KVM hosts, it is likely turned on by the     ksm/ksmtuned services. (CVE-2011-2183, Moderate)

  - Flaw in inet_diag_bc_audit() could allow a local,     unprivileged user to cause a denial of service.
    (CVE-2011-2213, Moderate)

  - Flaw in the way space was allocated in the Global File     System 2 (GFS2) implementation. If the file system was     almost full, and a local, unprivileged user made an     fallocate() request, it could result in a denial of     service. Setting quotas to prevent users from using all     available disk space would prevent exploitation of this     flaw. (CVE-2011-2689, Moderate)

  - Local, unprivileged users could send signals via the     sigqueueinfo system call, with si_code set to SI_TKILL     and with spoofed process and user IDs, to other     processes. This flaw does not allow existing permission     checks to be bypassed; signals can only be sent if your     privileges allow you to already do so. (CVE-2011-1182,     Low)

  - Heap overflow in the EFI GUID Partition Table (GPT)     implementation could allow a local attacker to cause a     denial of service by mounting a disk containing crafted     partition tables. (CVE-2011-1776, Low)

  - Structure padding in two structures in the Bluetooth     implementation was not initialized properly before being     copied to user-space, possibly allowing local,     unprivileged users to leak kernel stack memory to     user-space. (CVE-2011-2492, Low)

  - /proc/[PID]/io is world-readable by default. Previously,     these files could be read without any further     restrictions. A local, unprivileged user could read     these files, belonging to other, possibly privileged     processes to gather confidential information, such as     the length of a password used in a process.
    (CVE-2011-2495, Low)

It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities. (CVE-2011-1020)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-1078)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly check that device name strings were NULL terminated. A local attacker could exploit this to crash the system, leading to a denial of service, or leak contents of kernel stack memory, leading to a loss of privacy. (CVE-2011-1079)

Vasiliy Kulikov discovered that bridge network filtering did not check that name fields were NULL terminated. A local attacker could exploit this to leak contents of kernel stack memory, leading to a loss of privacy. (CVE-2011-1080)

Johan Hovold discovered that the DCCP network stack did not correctly handle certain packet combinations. A remote attacker could send specially crafted network traffic that would crash the system, leading to a denial of service. (CVE-2011-1093)

Peter Huewe discovered that the TPM device did not correctly initialize memory. A local attacker could exploit this to read kernel heap memory contents, leading to a loss of privacy. (CVE-2011-1160)

Dan Rosenberg discovered that the IRDA subsystem did not correctly check certain field sizes. If a system was using IRDA, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-1180)

Ryan Sweat discovered that the GRO code did not correctly validate memory. In some configurations on systems using VLANs, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2011-1478)

It was discovered that the security fix for CVE-2010-4250 introduced a regression. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-1479)

Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fields. If a system was running with Rose enabled, a remote attacker could send specially crafted traffic to gain root privileges. (CVE-2011-1493)

It was discovered that the Stream Control Transmission Protocol (SCTP) implementation incorrectly calculated lengths. If the net.sctp.addip_enable variable was turned on, a remote attacker could send specially crafted traffic to crash the system. (CVE-2011-1573)

Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

Phil Oester discovered that the network bonding system did not correctly handle large queues. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2011-1581)

It was discovered that CIFS incorrectly handled authentication. When a user had a CIFS share mounted that required authentication, a local user could mount the same share without knowing the correct password.
(CVE-2011-1585)

It was discovered that the GRE protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ip_gre module was loading, and crash the system, leading to a denial of service. (CVE-2011-1767)

It was discovered that the IP/IP protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ipip module was loading, and crash the system, leading to a denial of service. (CVE-2011-1768)

Ben Greear discovered that CIFS did not correctly handle direct I/O. A local attacker with access to a CIFS partition could exploit this to crash the system, leading to a denial of service. (CVE-2011-1771)

Timo Warns discovered that the EFI GUID partition table was not correctly parsed. A physically local attacker that could insert mountable devices could exploit this to crash the system or possibly gain root privileges. (CVE-2011-1776)

Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. (CVE-2011-1833)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

It was discovered that an mmap() call with the MAP_PRIVATE flag on '/dev/zero' was incorrectly handled. A local attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-2479)

Vasiliy Kulikov discovered that taskstats listeners were not correctly handled. A local attacker could exploit this to exhaust memory and CPU resources, leading to a denial of service. (CVE-2011-2484)

It was discovered that Bluetooth l2cap and rfcomm did not correctly initialize structures. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy.
(CVE-2011-2492)

Sami Liedes discovered that ext4 did not correctly handle missing root inodes. A local attacker could trigger the mount of a specially crafted filesystem to cause the system to crash, leading to a denial of service. (CVE-2011-2493)

Robert Swiecki discovered that mapping extensions were incorrectly handled. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2496)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

Ben Pfaff discovered that Classless Queuing Disciplines (qdiscs) were being incorrectly handled. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2525)

It was discovered that GFS2 did not correctly check block sizes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2689)

It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2695)

Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.
(CVE-2011-2699)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2918)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Qianfeng Zhang discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-2942)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)

Yasuaki Ishimatsu discovered a flaw in the kernel's clock implementation. A local unprivileged attacker could exploit this causing a denial of service. (CVE-2011-3209)

Yogesh Sharma discovered that CIFS did not correctly handle UNCs that had no prefixpaths. A local attacker with access to a CIFS partition could exploit this to crash the system, leading to a denial of service. (CVE-2011-3363)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

A flaw was found in the Linux kernel's /proc/*/*map* interface. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-3637)

Scot Doyle discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-4087)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Ben Hutchings discovered several flaws in the Linux Rose (X.25 PLP) layer. A local user or a remote user on an X.25 network could exploit these flaws to execute arbitrary code as root. (CVE-2011-4914).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)

Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. (CVE-2011-1833)

Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494)

Vasiliy Kulikov discovered that /proc/PID/io did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2495)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2695)

Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.
(CVE-2011-2699)

Christian Ohm discovered that the perf command looks for configuration files in the current directory. If a privileged user were tricked into running perf in a directory containing a malicious configuration file, an attacker could run arbitrary commands and possibly gain privileges.
(CVE-2011-2905)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service.
(CVE-2011-3353)

Gideon Naim discovered a flaw in the Linux kernel's handling VLAN 0 frames. An attacker on the local network could exploit this flaw to cause a denial of service. (CVE-2011-3593).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2695)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)

Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. (CVE-2011-1833)

Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494)

Vasiliy Kulikov discovered that /proc/PID/io did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2495)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2695)

Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.
(CVE-2011-2699)

Christian Ohm discovered that the perf command looks for configuration files in the current directory. If a privileged user were tricked into running perf in a directory containing a malicious configuration file, an attacker could run arbitrary commands and possibly gain privileges.
(CVE-2011-2905)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service.
(CVE-2011-3353)

Gideon Naim discovered a flaw in the Linux kernel's handling VLAN 0 frames. An attacker on the local network could exploit this flaw to cause a denial of service. (CVE-2011-3593).

It was discovered that the Stream Control Transmission Protocol (SCTP) implementation incorrectly calculated lengths. If the net.sctp.addip_enable variable was turned on, a remote attacker could send specially crafted traffic to crash the system. (CVE-2011-1573)

Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)

Timo Warns discovered that the EFI GUID partition table was not correctly parsed. A physically local attacker that could insert mountable devices could exploit this to crash the system or possibly gain root privileges. (CVE-2011-1776)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2494)

Vasiliy Kulikov discovered that /proc/PID/io did not enforce access restrictions. A local attacker could exploit this to read certain information, leading to a loss of privacy. (CVE-2011-2495)

Robert Swiecki discovered that mapping extensions were incorrectly handled. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2496)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

It was discovered that the wireless stack incorrectly verified SSID lengths. A local attacker could exploit this to cause a denial of service or gain root privileges. (CVE-2011-2517)

Ben Pfaff discovered that Classless Queuing Disciplines (qdiscs) were being incorrectly handled. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2525)

It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2695)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Christian Ohm discovered that the perf command looks for configuration files in the current directory. If a privileged user were tricked into running perf in a directory containing a malicious configuration file, an attacker could run arbitrary commands and possibly gain privileges. (CVE-2011-2905)

Vasiliy Kulikov discovered that the Comedi driver did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-2909)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)

Yogesh Sharma discovered that CIFS did not correctly handle UNCs that had no prefixpaths. A local attacker with access to a CIFS partition could exploit this to crash the system, leading to a denial of service. (CVE-2011-3363)

Timo Warns discovered that the EFI GUID partition table was not correctly parsed. A physically local attacker that could insert mountable devices could exploit this to crash the system or possibly gain root privileges. (CVE-2011-1776)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2695)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)

Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)

Timo Warns discovered that the EFI GUID partition table was not correctly parsed. A physically local attacker that could insert mountable devices could exploit this to crash the system or possibly gain root privileges. (CVE-2011-1776)

Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. (CVE-2011-1833)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.
(CVE-2011-2699)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2918)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)

Gideon Naim discovered a flaw in the Linux kernel's handling VLAN 0 frames. An attacker on the local network could exploit this flaw to cause a denial of service. (CVE-2011-3593).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Timo Warns discovered that the EFI GUID partition table was not correctly parsed. A physically local attacker that could insert mountable devices could exploit this to crash the system or possibly gain root privileges. (CVE-2011-1776)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.
(CVE-2011-2699)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)

Timo Warns discovered that the EFI GUID partition table was not correctly parsed. A physically local attacker that could insert mountable devices could exploit this to crash the system or possibly gain root privileges. (CVE-2011-1776)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4067     Rafael Dominguez Vega of MWR InfoSecurity reported an     issue in the auerswald module, a driver for Auerswald     PBX/System Telephone USB devices. Attackers with     physical access to a system's USB ports could obtain     elevated privileges using a specially crafted USB     device.

  - CVE-2011-0712     Rafael Dominguez Vega of MWR InfoSecurity reported an     issue in the caiaq module, a USB driver for Native     Instruments USB audio devices. Attackers with physical     access to a system's USB ports could obtain elevated     privileges using a specially crafted USB device.

  - CVE-2011-1020     Kees Cook discovered an issue in the /proc filesystem     that allows local users to gain access to sensitive     process information after execution of a setuid binary.

  - CVE-2011-2209     Dan Rosenberg discovered an issue in the osf_sysinfo()     system call on the alpha architecture. Local users could     obtain access to sensitive kernel memory.

  - CVE-2011-2211     Dan Rosenberg discovered an issue in the osf_wait4()     system call on the alpha architecture permitting local     users to gain elevated privileges.

  - CVE-2011-2213     Dan Rosenberg discovered an issue in the INET socket     monitoring interface. Local users could cause a denial     of service by injecting code and causing the kernel to     execute an infinite loop.

  - CVE-2011-2484     Vasiliy Kulikov of Openwall discovered that the number     of exit handlers that a process can register is not     capped, resulting in local denial of service through     resource exhaustion (CPU time and memory).

  - CVE-2011-2491     Vasily Averin discovered an issue with the NFS locking     implementation. A malicious NFS server can cause a     client to hang indefinitely in an unlock call.

  - CVE-2011-2492     Marek Kroemeke and Filip Palian discovered that     uninitialized struct elements in the Bluetooth subsystem     could lead to a leak of sensitive kernel memory through     leaked stack memory.

  - CVE-2011-2495     Vasiliy Kulikov of Openwall discovered that the io file     of a process' proc directory was world-readable,     resulting in local information disclosure of information     such as password lengths.

  - CVE-2011-2496     Robert Swiecki discovered that mremap() could be abused     for local denial of service by triggering a BUG_ON     assert.

  - CVE-2011-2497     Dan Rosenberg discovered an integer underflow in the     Bluetooth subsystem, which could lead to denial of     service or privilege escalation.

  - CVE-2011-2525     Ben Pfaff reported an issue in the network scheduling     code. A local user could cause a denial of service (NULL     pointer dereference) by sending a specially crafted     netlink message.

  - CVE-2011-2928     Timo Warns discovered that insufficient validation of Be     filesystem images could lead to local denial of service     if a malformed filesystem image is mounted.

  - CVE-2011-3188     Dan Kaminsky reported a weakness of the sequence number     generation in the TCP protocol implementation. This can     be used by remote attackers to inject packets into an     active session.

  - CVE-2011-3191     Darren Lavender reported an issue in the Common Internet     File System (CIFS). A malicious file server could cause     memory corruption leading to a denial of service.

This update also includes a fix for a regression introduced with the previous security fix for CVE-2011-1768 (Debian bug #633738).

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-1020     Kees Cook discovered an issue in the /proc filesystem     that allows local users to gain access to sensitive     process information after execution of a setuid binary.

  - CVE-2011-1576     Ryan Sweat discovered an issue in the VLAN     implementation. Local users may be able to cause a     kernel memory leak, resulting in a denial of service.

  - CVE-2011-2484     Vasiliy Kulikov of Openwall discovered that the number     of exit handlers that a process can register is not     capped, resulting in local denial of service through     resource exhaustion (CPU time and memory).

  - CVE-2011-2491     Vasily Averin discovered an issue with the NFS locking     implementation. A malicious NFS server can cause a     client to hang indefinitely in an unlock call.

  - CVE-2011-2492     Marek Kroemeke and Filip Palian discovered that     uninitialized struct elements in the Bluetooth subsystem     could lead to a leak of sensitive kernel memory through     leaked stack memory.

  - CVE-2011-2495     Vasiliy Kulikov of Openwall discovered that the io file     of a process' proc directory was world-readable,     resulting in local information disclosure of information     such as password lengths.

  - CVE-2011-2496     Robert Swiecki discovered that mremap() could be abused     for local denial of service by triggering a BUG_ON     assert.

  - CVE-2011-2497     Dan Rosenberg discovered an integer underflow in the     Bluetooth subsystem, which could lead to denial of     service or privilege escalation.

  - CVE-2011-2517     It was discovered that the netlink-based wireless     configuration interface performed insufficient length     validation when parsing SSIDs, resulting in buffer     overflows. Local users with the CAP_NET_ADMIN capability     can cause a denial of service.

  - CVE-2011-2525     Ben Pfaff reported an issue in the network scheduling     code. A local user could cause a denial of service (NULL     pointer dereference) by sending a specially crafted     netlink message.

  - CVE-2011-2700     Mauro Carvalho Chehab of Red Hat reported a buffer     overflow issue in the driver for the Si4713 FM Radio     Transmitter driver used by N900 devices. Local users     could exploit this issue to cause a denial of service or     potentially gain elevated privileges.

  - CVE-2011-2723     Brent Meshier reported an issue in the GRO (generic     receive offload) implementation. This can be exploited     by remote users to create a denial of service (system     crash) in certain network device configurations.

  - CVE-2011-2905     Christian Ohm discovered that the 'perf' analysis tool     searches for its config files in the current working     directory. This could lead to denial of service or     potential privilege escalation if a user with elevated     privileges is tricked into running 'perf' in a directory     under the control of the attacker.

  - CVE-2011-2909     Vasiliy Kulikov of Openwall discovered that a     programming error in the Comedi driver could lead to the     information disclosure through leaked stack memory.

  - CVE-2011-2918     Vince Weaver discovered that incorrect handling of     software event overflows in the 'perf' analysis tool     could lead to local denial of service.

  - CVE-2011-2928     Timo Warns discovered that insufficient validation of Be     filesystem images could lead to local denial of service     if a malformed filesystem image is mounted.

  - CVE-2011-3188     Dan Kaminsky reported a weakness of the sequence number     generation in the TCP protocol implementation. This can     be used by remote attackers to inject packets into an     active session.

  - CVE-2011-3191     Darren Lavender reported an issue in the Common Internet     File System (CIFS). A malicious file server could cause     memory corruption leading to a denial of service.

This update also includes a fix for a regression introduced with the previous security fix for CVE-2011-1768 (Debian bug #633738).

Updated kernel packages that fix several security issues, various bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Security issues :

* Using PCI passthrough without interrupt remapping support allowed KVM guests to generate MSI interrupts and thus potentially inject traps. A privileged guest user could use this flaw to crash the host or possibly escalate their privileges on the host. The fix for this issue can prevent PCI passthrough working and guests starting. Refer to Red Hat Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

* Flaw in the client-side NLM implementation could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2491, Important)

* Integer underflow in the Bluetooth implementation could allow a remote attacker to cause a denial of service or escalate their privileges by sending a specially crafted request to a target system via Bluetooth. (CVE-2011-2497, Important)

* Buffer overflows in the netlink-based wireless configuration interface implementation could allow a local user, who has the CAP_NET_ADMIN capability, to cause a denial of service or escalate their privileges on systems that have an active wireless interface.
(CVE-2011-2517, Important)

* Flaw in the way the maximum file offset was handled for ext4 file systems could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2695, Important)

* Flaw allowed napi_reuse_skb() to be called on VLAN packets. An attacker on the local network could use this flaw to send crafted packets to a target, possibly causing a denial of service.
(CVE-2011-1576, Moderate)

* Integer signedness error in next_pidmap() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-1593, Moderate)

* Race condition in the memory merging support (KSM) could allow a local, unprivileged user to cause a denial of service. KSM is off by default, but on systems running VDSM, or on KVM hosts, it is likely turned on by the ksm/ksmtuned services. (CVE-2011-2183, Moderate)

* Flaw in inet_diag_bc_audit() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-2213, Moderate)

* Flaw in the way space was allocated in the Global File System 2 (GFS2) implementation. If the file system was almost full, and a local, unprivileged user made an fallocate() request, it could result in a denial of service. Setting quotas to prevent users from using all available disk space would prevent exploitation of this flaw.
(CVE-2011-2689, Moderate)

* Local, unprivileged users could send signals via the sigqueueinfo system call, with si_code set to SI_TKILL and with spoofed process and user IDs, to other processes. This flaw does not allow existing permission checks to be bypassed; signals can only be sent if your privileges allow you to already do so. (CVE-2011-1182, Low)

* Heap overflow in the EFI GUID Partition Table (GPT) implementation could allow a local attacker to cause a denial of service by mounting a disk containing crafted partition tables. (CVE-2011-1776, Low)

* Structure padding in two structures in the Bluetooth implementation was not initialized properly before being copied to user-space, possibly allowing local, unprivileged users to leak kernel stack memory to user-space. (CVE-2011-2492, Low)

* /proc/[PID]/io is world-readable by default. Previously, these files could be read without any further restrictions. A local, unprivileged user could read these files, belonging to other, possibly privileged processes to gather confidential information, such as the length of a password used in a process. (CVE-2011-2495, Low)

Red Hat would like to thank Vasily Averin for reporting CVE-2011-2491;
Dan Rosenberg for reporting CVE-2011-2497 and CVE-2011-2213; Ryan Sweat for reporting CVE-2011-1576; Robert Swiecki for reporting CVE-2011-1593; Andrea Righi for reporting CVE-2011-2183; Julien Tinnes of the Google Security Team for reporting CVE-2011-1182; Timo Warns for reporting CVE-2011-1776; Marek Kroemeke and Filip Palian for reporting CVE-2011-2492; and Vasiliy Kulikov of Openwall for reporting CVE-2011-2495.

Update to kernel 2.6.35.14 :

http://ftp.kernel.org/pub/linux/kernel/v2.6/longterm/v2.6.35/ChangeLog
-2.6.35.14

NOTE: These upstream commits from 2.6.35.14 were already in the previous Fedora 14 kernel 2.6.35.13-92 :

b934c20de1398d4a82d2ecfeb588a214a910f13f 3cd01976e702ccaffb907727caff4f8789353599 9c047157a20521cd525527947b13b950d168d2e6 6b4e81db2552bad04100e7d5ddeed7e848f53b48 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f b522f02184b413955f3bc952e3776ce41edc6355 194b3da873fd334ef183806db751473512af29ce a1f74ae82d133ebb2aabb19d181944b4e83e9960 e9cdd343a5e42c43bcda01e609fa23089e026470 14fb57dccb6e1defe9f89a66f548fcb24c374c1d 221d1d797202984cb874e3ed9f1388593d34ee22 a294865978b701e4d0d90135672749531b9a900d

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes some bugs that were caused by upstream stable kernel updates, including a longstanding bug causing oopses when removing USB storage devices and optical media.

Fixes stalls on machines with the latest Intel graphics hardware (Sandybridge.)

Also fixes some important security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76634	RHEL 6 : MRG (RHSA-2011:1253)	Nessus	Red Hat Local Security Checks	high
68421	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2025)	Nessus	Oracle Linux Local Security Checks	high
68331	Oracle Linux 6 : kernel (ELSA-2011-1189)	Nessus	Oracle Linux Local Security Checks	high
61118	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
56768	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1256-1)	Nessus	Ubuntu Local Security Checks	critical
56747	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1253-1)	Nessus	Ubuntu Local Security Checks	critical
56645	Ubuntu 11.04 : linux vulnerabilities (USN-1246-1)	Nessus	Ubuntu Local Security Checks	critical
56644	Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1245-1)	Nessus	Ubuntu Local Security Checks	critical
56640	USN-1241-1 : linux-fsl-imx51 vulnerabilities	Nessus	Ubuntu Local Security Checks	critical
56639	Ubuntu 10.04 LTS : linux-mvl-dove vulnerabilities (USN-1240-1)	Nessus	Ubuntu Local Security Checks	critical
56638	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1239-1)	Nessus	Ubuntu Local Security Checks	critical
56479	USN-1228-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	critical
56466	Ubuntu 10.10 : linux vulnerabilities (USN-1227-1)	Nessus	Ubuntu Local Security Checks	critical
56388	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1225-1)	Nessus	Ubuntu Local Security Checks	critical
56345	USN-1220-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	critical
56344	Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1219-1)	Nessus	Ubuntu Local Security Checks	critical
56285	Debian DSA-2310-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	medium
56130	Debian DSA-2303-2 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	critical
55964	RHEL 6 : kernel (RHSA-2011:1189)	Nessus	Red Hat Local Security Checks	high
55955	Fedora 14 : kernel-2.6.35.14-95.fc14 (2011-11103)	Nessus	Fedora Local Security Checks	high
55583	Fedora 15 : kernel-2.6.38.8-35.fc15 (2011-9130)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2011-2497

medium

Tenable Plugins

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

high

high

high