The Linux kernel before 2.6.37 does not properly implement a certain clock-update optimization, which allows local users to cause a denial of service (system hang) via an application that executes code in a loop.

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. (CVE-2011-1927)

Vegard Nossum discovered a leak in the kernel's inotify_init() system call. A local, unprivileged user could exploit this to cause a denial of service. (CVE-2010-4250)

An error was discovered in the kernel's handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)

A flaw was found in the kernel's Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006)

A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. (CVE-2011-0716)

Dan Rosenberg reported errors in the OSS (Open Sound System) MIDI interface. A local attacker on non-x86 systems might be able to cause a denial of service. (CVE-2011-1476)

Dan Rosenberg reported errors in the kernel's OSS (Open Sound System) driver for Yamaha FM synthesizer chips. A local user can exploit this to cause memory corruption, causing a denial of service or privilege escalation. (CVE-2011-1477)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

It was discovered that some import kernel threads can be blocked by a user level process. An unprivileged local user could exploit this flaw to cause a denial of service. (CVE-2011-4621)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044)

Updated kernel packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fix :

* Using the SG_IO IOCTL to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged user only had access to a single partition or LVM volume, they could use this flaw to bypass those restrictions and gain read and write access (and be able to issue other SCSI commands) to the entire block device.

In KVM (Kernel-based Virtual Machine) environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests (and other SCSI commands) on the host, and possibly access the data of other guests that reside on the same underlying block device. Partition-based and LVM-based storage pools are not used by default. Refer to Red Hat Bugzilla bug 752375 for further details and a mitigation script for users who cannot apply this update immediately. (CVE-2011-4127, Important)

Bug fixes :

* Previously, idle load balancer kick requests from other CPUs could be serviced without first receiving an inter-processor interrupt (IPI). This could have led to a deadlock. (BZ#750459)

* This update fixes a performance regression that may have caused processes (including KVM guests) to hang for a number of seconds.
(BZ#751403)

* When md_raid1_unplug_device() was called while holding a spinlock, under certain device failure conditions, it was possible for the lock to be requested again, deeper in the call chain, causing a deadlock.
Now, md_raid1_unplug_device() is no longer called while holding a spinlock. (BZ#755545)

* In hpet_next_event(), an interrupt could have occurred between the read and write of the HPET (High Performance Event Timer) and the value of HPET_COUNTER was then beyond that being written to the comparator (HPET_Tn_CMP). Consequently, the timers were overdue for up to several minutes. Now, a comparison is performed between the value of the counter and the comparator in the HPET code. If the counter is beyond the comparator, the '-ETIME' error code is returned.
(BZ#756426)

* Index allocation in the virtio-blk module was based on a monotonically increasing variable 'index'. Consequently, released indexes were not reused and after a period of time, no new were available. Now, virtio-blk uses the ida API to allocate indexes.
(BZ#756427)

* A bug related to Context Caching existed in the Intel IOMMU support module. On some newer Intel systems, the Context Cache mode has changed from previous hardware versions, potentially exposing a Context coherency race. The bug was exposed when performing a series of hot plug and unplug operations of a Virtual Function network device which was immediately configured into the network stack, i.e., successfully performed dynamic host configuration protocol (DHCP).
When the coherency race occurred, the assigned device would not work properly in the guest virtual machine. With this update, the Context coherency is corrected and the race and potentially resulting device assignment failure no longer occurs. (BZ#757671)

* The align_va_addr kernel parameter was ignored if secondary CPUs were initialized. This happened because the parameter settings were overridden during the initialization of secondary CPUs. Also, the align_va_addr parameter documentation contained incorrect parameter arguments. With this update, the underlying code has been modified to prevent the overriding and the documentation has been updated. This update also removes the unused code introduced by the patch for BZ#739456. (BZ#758028)

* Dell systems based on a future Intel processor with graphics acceleration required the selection of the install system with basic video driver installation option. This update removes this requirement. (BZ#758513)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1849 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    Security fix:

    * Using the SG_IO IOCTL to issue SCSI requests to partitions or LVM volumes     resulted in the requests being passed to the underlying block device. If a     privileged user only had access to a single partition or LVM volume, they     could use this flaw to bypass those restrictions and gain read and write     access (and be able to issue other SCSI commands) to the entire block     device.

    In KVM (Kernel-based Virtual Machine) environments using raw format virtio     disks backed by a partition or LVM volume, a privileged guest user could     bypass intended restrictions and issue read and write requests (and other     SCSI commands) on the host, and possibly access the data of other guests     that reside on the same underlying block device. Partition-based and     LVM-based storage pools are not used by default. Refer to Red Hat Bugzilla     bug 752375 for further details and a mitigation script for users who cannot     apply this update immediately. (CVE-2011-4127, Important)

    Bug fixes:

    * Previously, idle load balancer kick requests from other CPUs could be     serviced without first receiving an inter-processor interrupt (IPI). This     could have led to a deadlock. (BZ#750459)

    * This update fixes a performance regression that may have caused processes     (including KVM guests) to hang for a number of seconds. (BZ#751403)

    * When md_raid1_unplug_device() was called while holding a spinlock, under     certain device failure conditions, it was possible for the lock to be     requested again, deeper in the call chain, causing a deadlock. Now,     md_raid1_unplug_device() is no longer called while holding a spinlock.
    (BZ#755545)

    * In hpet_next_event(), an interrupt could have occurred between the read     and write of the HPET (High Performance Event Timer) and the value of     HPET_COUNTER was then beyond that being written to the comparator     (HPET_Tn_CMP). Consequently, the timers were overdue for up to several     minutes. Now, a comparison is performed between the value of the counter     and the comparator in the HPET code. If the counter is beyond the     comparator, the -ETIME error code is returned. (BZ#756426)

    * Index allocation in the virtio-blk module was based on a monotonically     increasing variable index. Consequently, released indexes were not reused     and after a period of time, no new were available. Now, virtio-blk uses the     ida API to allocate indexes. (BZ#756427)

    * A bug related to Context Caching existed in the Intel IOMMU support     module. On some newer Intel systems, the Context Cache mode has changed     from previous hardware versions, potentially exposing a Context coherency     race. The bug was exposed when performing a series of hot plug and unplug     operations of a Virtual Function network device which was immediately     configured into the network stack, i.e., successfully performed dynamic     host configuration protocol (DHCP). When the coherency race occurred, the     assigned device would not work properly in the guest virtual machine. With     this update, the Context coherency is corrected and the race and     potentially resulting device assignment failure no longer occurs.
    (BZ#757671)

    * The align_va_addr kernel parameter was ignored if secondary CPUs were     initialized. This happened because the parameter settings were overridden     during the initialization of secondary CPUs. Also, the align_va_addr     parameter documentation contained incorrect parameter arguments. With this     update, the underlying code has been modified to prevent the overriding and     the documentation has been updated. This update also removes the unused     code introduced by the patch for BZ#739456. (BZ#758028)

    * Dell systems based on a future Intel processor with graphics acceleration     required the selection of the install system with basic video driver     installation option. This update removes this requirement. (BZ#758513)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that KVM did not correctly initialize certain CPU registers. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3698)

Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user.
(CVE-2010-3865)

Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3875)

Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-3876)

Vasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-3877)

Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. (CVE-2010-3880)

Dan Rosenberg discovered that the ivtv V4L driver did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.
(CVE-2010-4079)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

It was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4248)

Vegard Nossum discovered a leak in the kernel's inotify_init() system call. A local, unprivileged user could exploit this to cause a denial of service. (CVE-2010-4250)

Nelson Elhage discovered that Econet did not correctly handle AUN packets over UDP. A local attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2010-4342)

Tavis Ormandy discovered that the install_special_mapping function could bypass the mmap_min_addr restriction. A local attacker could exploit this to mmap 4096 bytes below the mmap_min_addr area, possibly improving the chances of performing NULL pointer dereference attacks.
(CVE-2010-4346)

Dan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges. (CVE-2010-4527)

An error was reported in the kernel's ORiNOCO wireless driver's handling of TKIP countermeasures. This reduces the amount of time an attacker needs breach a wireless network using WPA+TKIP for security.
(CVE-2010-4648)

Dan Carpenter discovered that the Infiniband driver did not correctly handle certain requests. A local user could exploit this to crash the system or potentially gain root privileges. (CVE-2010-4649, CVE-2011-1044)

An error was discovered in the kernel's handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)

A flaw was found in the kernel's Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006)

It was discovered that some import kernel threads can be blocked by a user level process. An unprivileged local user could exploit this flaw to cause a denial of service. (CVE-2011-4621).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
58289	USN-1394-1 : Linux kernel (OMAP4) vulnerabilities	Nessus	Ubuntu Local Security Checks	high
57404	CentOS 6 : kernel (CESA-2011:1849)	Nessus	CentOS Local Security Checks	medium
57391	RHEL 6 : kernel (RHSA-2011:1849)	Nessus	Red Hat Local Security Checks	medium
52500	Ubuntu 10.10 : linux vulnerabilities (USN-1081-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2011-4621

medium

Tenable Plugins

high

medium

medium

high