Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020.

The SUSE Linux Enterprise 10 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs have been fixed :

CVE-2015-2041: A information leak in the llc2_timeout_table was fixed (bnc#919007).

CVE-2014-9322: arch/x86/kernel/entry_64.S in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space (bnc#910251).

CVE-2014-9090: The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel did not properly handle faults associated with the Stack Segment (SS) segment register, which allowed local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the 1-clock-tests test suite (bnc#907818).

CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel did not properly manage a certain backlog value, which allowed remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (bnc#885422).

CVE-2014-3673: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c (bnc#902346).

CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response (bnc#896391).

CVE-2014-3184: The report_fixup functions in the HID subsystem in the Linux kernel might have allowed physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c (bnc#896390).

CVE-2014-1874: The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel allowed local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context (bnc#863335).

CVE-2014-0181: The Netlink implementation in the Linux kernel did not provide a mechanism for authorizing socket operations based on the opener of a socket, which allowed local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program (bnc#875051).

CVE-2013-4299: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel allowed remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device (bnc#846404).

CVE-2013-2147: The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel did not initialize certain data structures, which allowed local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c (bnc#823260).

CVE-2012-6657: The sock_setsockopt function in net/core/sock.c in the Linux kernel did not ensure that a keepalive action is associated with a stream socket, which allowed local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket (bnc#896779).

CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem (bnc#769784).

CVE-2012-2319: Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel allowed local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020 (bnc#760902).

CVE-2012-2313: The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel did not restrict access to the SIOCSMIIREG command, which allowed local users to write data to an Ethernet adapter via an ioctl call (bnc#758813).

CVE-2011-4132: The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allowed local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an 'invalid log first block value' (bnc#730118).

CVE-2011-4127: The Linux kernel did not properly restrict SG_IO ioctl calls, which allowed local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume (bnc#738400).

CVE-2011-1585: The cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel did not properly determine the associations between users and sessions, which allowed local users to bypass CIFS share authentication by leveraging a mount of a share by a different user (bnc#687812).

CVE-2011-1494: Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel might have allowed local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow (bnc#685402).

CVE-2011-1495: drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel did not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions (bnc#685402).

CVE-2011-1493: Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel allowed remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket (bnc#681175).

CVE-2011-4913: The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel did not validate the FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP fields, which allowed remote attackers to (1) cause a denial of service (integer underflow, heap memory corruption, and panic) via a small length value in data sent to a ROSE socket, or (2) conduct stack-based buffer overflow attacks via a large length value in data sent to a ROSE socket (bnc#681175).

CVE-2011-4914: The ROSE protocol implementation in the Linux kernel did not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via crafted data to a ROSE socket (bnc#681175).

CVE-2011-1476: Integer underflow in the Open Sound System (OSS) subsystem in the Linux kernel on unspecified non-x86 platforms allowed local users to cause a denial of service (memory corruption) by leveraging write access to /dev/sequencer (bnc#681999).

CVE-2011-1477: Multiple array index errors in sound/oss/opl3.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer (bnc#681999).

CVE-2011-1163: The osf_partition function in fs/partitions/osf.c in the Linux kernel did not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing (bnc#679812).

CVE-2011-1090: The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel stored NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allowed local users to cause a denial of service (panic) via a crafted attempt to set an ACL (bnc#677286).

CVE-2014-9584: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel did not validate a length value in the Extensions Reference (ER) System Use Field, which allowed local users to obtain sensitive information from kernel memory via a crafted iso9660 image (bnc#912654).

CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the Linux kernel did not restrict the number of Rock Ridge continuation entries, which allowed local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image (bnc#911325).

CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry (bnc#892490).

CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel allowed local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry (bnc#892490).

CVE-2014-3917: kernel/auditsc.c in the Linux kernel, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allowed local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number (bnc#880484).

CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (bnc#883795).

CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allowed local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call (bnc#883795).

CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not properly maintain the user_ctl_count value, which allowed local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls (bnc#883795).

CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel did not ensure possession of a read/write lock, which allowed local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access (bnc#883795).

CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function (bnc#883795).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2012:1323 :

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the way socket buffers (skb) requiring TSO (TCP segment offloading) were handled by the sfc driver. If the skb did not fit within the minimum-size of the transmission queue, the network card could repeatedly reset itself. A remote attacker could use this flaw to cause a denial of service. (CVE-2012-3412, Important)

* A use-after-free flaw was found in the xacct_add_tsk() function in the Linux kernel's taskstats subsystem. A local, unprivileged user could use this flaw to cause an information leak or a denial of service. (CVE-2012-3510, Moderate)

* A buffer overflow flaw was found in the hfs_bnode_read() function in the HFS Plus (HFS+) file system implementation in the Linux kernel. A local user able to mount a specially crafted HFS+ file system image could use this flaw to cause a denial of service or escalate their privileges. (CVE-2012-2319, Low)

* A flaw was found in the way the msg_namelen variable in the rds_recvmsg() function of the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation was initialized. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space.
(CVE-2012-3430, Low)

Red Hat would like to thank Ben Hutchings of Solarflare (tm) for reporting CVE-2012-3412, and Alexander Peslyak for reporting CVE-2012-3510. The CVE-2012-3430 issue was discovered by the Red Hat InfiniBand team.

This update also fixes the following bugs :

* The cpuid_whitelist() function, masking the Enhanced Intel SpeedStep (EST) flag from all guests, prevented the 'cpuspeed' service from working in the privileged Xen domain (dom0). CPU scaling was therefore not possible. With this update, cpuid_whitelist() is aware whether the domain executing CPUID is privileged or not, and enables the EST flag for dom0. (BZ#846125)

* If a delayed-allocation write was performed before quota was enabled, the kernel displayed the following warning message :

WARNING: at fs/quota/dquot.c:988 dquot_claim_space+0x77/0x112()

This was because information about the delayed allocation was not recorded in the quota structure. With this update, writes prior to enabling quota are properly accounted for, and the message is not displayed. (BZ#847326)

* In Red Hat Enterprise Linux 5.9, the DSCP (Differentiated Services Code Point) netfilter module now supports mangling of the DSCP field.
(BZ#847327)

* Some subsystems clear the TIF_SIGPENDING flag during error handling in fork() paths. Previously, if the flag was cleared, the ERESTARTNOINTR error code could be returned. The underlying source code has been modified so that the error code is no longer returned.
(BZ#847359)

* An unnecessary check for the RXCW.CW bit could cause the Intel e1000e NIC (Network Interface Controller) to not work properly. The check has been removed so that the Intel e1000e NIC works as expected.
(BZ#852448)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The SUSE Linux Enterprise 11 SP1 kernel have been updated to fix various bugs and security issues.

The following security issues have been fixed :

  - Several buffer overread and overwrite errors in the UDF     logical volume descriptor code were fixed that might     have allowed local attackers able to mount UDF volumes     to crash the kernel or potentially gain privileges.
    (CVE-2012-3400)

  - A local denial of service in the last epoll fix was     fixed. (CVE-2012-3375)

  - A integer overflow in i915_gem_do_execbuffer() was fixed     that might be used by local attackers to crash the     kernel or potentially execute code. (CVE-2012-2384)

  - A integer overflow in i915_gem_execbuffer2() was fixed     that might be used by local attackers to crash the     kernel or potentially execute code. (CVE-2012-2383)

  - Memiory leaks in the hugetlbfs map reservation code were     fixed that could be used by local attackers to exhaust     machine memory. (CVE-2012-2390)

  - The filesystem capability handling was not fully     correct, allowing local users to bypass fscaps related     restrictions to disable e.g. address space     randomization. (CVE-2012-2123)

  - Validation of data_len before allocating fragments of     skbs was fixed that might have allowed a heap overflow.
    (CVE-2012-2136)

  - Fixed potential buffer overflows in the hfsplus     filesystem, which might be exploited by local attackers     able to mount such filesystems. (CVE-2012-2319)

Several leapsecond related bug fixes have been created :

  - hrtimer: provide clock_was_set_delayed(). (bnc#768632)

  - time: Fix leapsecond triggered hrtimer/futex load spike     issue. (bnc#768632)

  - ntp: fix leap second hrtimer deadlock. (bnc#768632)

  - ntp: avoid printk under xtime_lock (bnc#767684). The     following non-security issues have been fixed :

  - tcp: drop SYN+FIN messages to avoid memory leaks.
    (bnc#765102)

  - be2net: Fix EEH error reset before a flash dump     completes. (bnc#755546)

  - REVERT svcrpc: destroy server sockets all at once.
    (bnc#769210)

  - sched: Make sure to not re-read variables after     validation. (bnc#769685)

  - audit: Do not send uninitialized data for AUDIT_TTY_GET.
    (bnc#755513)

  - dlm: do not depend on sctp. (bnc#729247, bnc#763656)

  - RPC: killing RPC tasks races fixed. (bnc#765548)

  - vlan/core: Fix memory leak/corruption on VLAN GRO_DROP.
    (bnc#758058)

  - CPU hotplug, cpusets, suspend/resume: Do not modify     cpusets during suspend/resume. (bnc#752858)

  - ioat2: kill pending flag. (bnc#765022)

  - Fix massive driver induced spin_lock_bh() contention.

  - ipmi: Fix IPMI errors due to timing problems.
    (bnc#761988)

  - xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53.
    (bnc#760974)

  - xen: gntdev: fix multi-page slot allocation.
    (bnc#760974)

  - rpm/kernel-binary.spec.in: Own the right -kdump initrd.
    (bnc#764500)

  - kernel: pfault task state race (bnc#764098,LTC#81724).

  - xfrm: take net hdr len into account for esp payload size     calculation. (bnc#759545)

  - bonding: do not dereference NULL pointer to device of     VLAN 0. (bnc#763830)

  - cifs: fix oops while traversing open file list (try #4).
    (bnc#756050)

  - nfsd: fix BUG at fs/nfsd/nfsfh.h:199 on unlink.
    (bnc#769777)

  - nfs: Ensure we never try to mount an NFS auto-mount dir     (bnc748601).

  - patches.suse/cgroup-disable-memcg-when-low-lowmem.patch:
    fix typo: use if defined(CONFIG_) rather than if CONFIG_

  - patches.suse/pagecache-limit-fix-shmem-deadlock.patch:
    Fixed the GFP_NOWAIT is zero and not suitable for tests     bug. (bnc#755537)

  - sys_poll: fix incorrect type for timeout parameter.
    (bnc#754428)

  - scsi_transport_fc: fix blocked bsg request when fc     object deleted. (bnc#761414, bnc#734300)

  - ehea: fix allmulticast support. (bnc#758013)

  - scsi: Silence unnecessary warnings about ioctl to     partition. (bnc#758104)

  - sched/x86: Fix overflow in cyc2ns_offset. (bnc#630970,     bnc#661605)

  - sched/rt: Do not throttle when PI boosting. (bnc#754085)

  - sched/rt: Keep period timer ticking when rt throttling     is active. (bnc#754085)

  - sched,rt: fix isolated CPUs leaving root_task_group     indefinitely throttled. (bnc#754085)

The SUSE Linux Enterprise 11 SP2 kernel was updated to 3.0.31, fixing many bugs and security issues.

Various security and bug fixes contained in the Linux 3.0 stable releases 3.0.27 up to 3.0.31 have been included, but are not explicitly listed below.

The following notable security issues have been fixed :

  - The dl2k network card driver lacked permission handling     for some ethtool ioctls, which could allow local     attackers to start/stop the network card.
    (CVE-2012-2313)

  - A use after free bug in hugetlb support could be used by     local attackers to crash the system. (CVE-2012-2133)

  - Various leaks in namespace handling over fork where     fixed, which could be exploited by e.g. vsftpd access by     remote users. (CVE-2012-2127)

  - A memory corruption when mounting a hfsplus filesystem     was fixed that could be used by local attackers able to     mount filesystem to crash the system. (CVE-2012-2319)

The following non security bugs have been fixed by this update :

  - BTRFS

  - Partial revert of truncation improvements.

  - Fix eof while discarding extents.

  - Check return value of bio_alloc() properly.

  - Return void from clear_state_bit.

  - Avoid possible use-after-free in clear_extent_bit().

  - Make free_ipath() deal gracefully with NULL pointers.

  - Do not call free_extent_buffer twice in iterate_irefs.

  - Add missing read locks in backref.c.

  - Fix max chunk size check in chunk allocator.

  - Double unlock bug in error handling.

  - Do not return EINTR.

  - Fix btrfs_ioctl_dev_info() crash on missing device.

  - Fix that check_int_data mount option was ignored.

  - Do not mount when we have a sectorsize unequal to     PAGE_SIZE.

  - Avoid possible use-after-free in clear_extent_bit().

  - Retrurn void from clear_state_bit.

  - Fix typo in free-space-cache.c.

  - Remove the ideal caching code.

  - Remove search_start and search_end from find_free_extent     and callers.

  - Adjust the write_lock_level as we unlock.

  - Actually call btrfs_init_lockdep.

  - Fix regression in scrub path resolving.

  - Show useful info in space reservation tracepoint.

  - Flush out and clean up any block device pages during     mount.

  - Fix deadlock during allocating chunks.

  - Fix race between direct io and autodefrag.

  - Fix the mismatch of page->mapping.

  - Fix recursive defragment with autodefrag option.

  - Add a check to decide if we should defrag the range.

  - Do not bother to defrag an extent if it is a big real     extent.

  - Update to the right index of defragment.

  - Fix use-after-free in __btrfs_end_transaction.

  - Stop silently switching single chunks to raid0 on     balance.

  - Add wrappers for working with alloc profiles.

  - Make profile_is_valid() check more strict.

  - Move alloc_profile_is_valid() to volumes.c.

  - Add get_restripe_target() helper.

  - Add __get_block_group_index() helper.

  - Improve the logic in btrfs_can_relocate().

  - Validate target profiles only if we are going to use     them.

  - Allow dup for data chunks in mixed mode.

  - Fix memory leak in resolver code.

  - Fix infinite loop in btrfs_shrink_device().

  - Error handling locking fixu.

  - Fix uninit variable in repair_eb_io_failure.

  - Always store the mirror we read the eb from.

  - Do not count CRC or header errors twice while scrubbing.

  - Do not start delalloc inodes during sync.

  - Fix repair code for RAID10.

  - Prevent root_list corruption.

  - Fix block_rsv and space_info lock ordering.

  - Fix space checking during fs resize.

  - Avoid deadlocks from GFP_KERNEL allocations during     btrfs_real_readdir().

  - Reduce lock contention during extent insertion.

  - Add properly locking around add_root_to_dirty_list().

  - Fix mismatching struct members in ioctl.h.

  - netfilter :

  - nf_conntrack: make event callback registration per     netns.

  - DRM :

  - edid: Add a workaround for 1366x768 HD panel.

  - edid: Add extra_modes.

  - edid: Add packed attribute to new gtf2 and cvt structs.

  - edid: Add the reduced blanking DMT modes to the DMT list

  - edid: Allow drm_mode_find_dmt to hunt for     reduced-blanking modes.

  - edid: Do drm_dmt_modes_for_range() for all range     descriptor types.

  - edid: Document drm_mode_find_dmt.

  - edid: Fix some comment typos in the DMT mode list

  - edid: Generate modes from extra_modes for range     descriptors

  - edid: Give the est3 mode struct a real name.

  - edid: Remove a misleading comment.

  - edid: Rewrite drm_mode_find_dmt search loop.

  - edid: Update range descriptor struct for EDID 1.4

  - edid: add missing NULL checks.

  - edid: s/drm_gtf_modes_for_range/drm_dmt_modes_for_range/

  - Fix kABI for drm EDID improvement patches.

  - Fix the case where multiple modes are returned from EDID

  - i915: Add more standard modes to LVDS output.

  - i915: Disable LVDS at mode change.

  - i915: add Ivy Bridge GT2 Server entries.

  - i915: delay drm_irq_install() at resume.

  - EDD: Check for correct EDD 3.0 length.

  - XEN

  - blkfront: make blkif_io_lock spinlock per-device.

  - blkback: streamline main processing loop (fate#309305).

  - blkback: Implement discard requests handling     (fate#309305).

  - blkback: Enhance discard support with secure erasing     support (fate#309305).

  - blkfront: Handle discard requests (fate#309305).

  - blkfront: Enhance discard support with secure erasing     support (fate#309305).

  - blkif: support discard (fate#309305).

  - blkif: Enhance discard support with secure erasing     support (fate#309305).

  - xen/smpboot: adjust ordering of operations.

  - x86-64: provide a memset() that can deal with 4Gb or     above at a time.

  - Update Xen patches to 3.0.27.

  - Update Xen patches to 3.0.31.

  - xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53.

  - xen/gntdev: fix multi-page slot allocation.

  - TG3

  - Avoid panic from reserved statblk field access.

  - Fix 5717 serdes powerdown problem.

  - Fix RSS ring refill race condition.

  - Fix single-vector MSI-X code.

  - fix ipv6 header length computation.

  - S/390

  - dasd: Fix I/O stall when reserving dasds.

  - af_iucv: detect down state of HS transport interface     (LTC#80859).

  - af_iucv: allow shutdown for HS transport sockets     (LTC#80860).

  - mm: s390: Fix BUG by using __set_page_dirty_no_writeback     on swap.

  - qeth: Improve OSA Express 4 blkt defaults (LTC#80325).

  - zcrypt: Fix parameter checking for ZSECSENDCPRB ioctl     (LTC#80378).

  - zfcpdump: Implement async sdias event processing     (LTC#81330).

  - ALSA

  - hda: Always resume the codec immediately.

  - hda: Add Creative CA0132 HDA codec support.

  - hda: Fix error handling in patch_ca0132.c.

  - hda: Add the support for Creative SoundCore3D.

  - OTHER

  - ixgbe: fix ring assignment issues for SR-IOV and drop     cases.

  - ixgbe: add missing rtnl_lock in PM resume path.

  - MCE, AMD: Drop too granulary family model checks.

  - EDAC, MCE, AMD: Print CPU number when reporting the     error.

  - EDAC, MCE, AMD: Print valid addr when reporting an     error.

  - libata: skip old error history when counting probe     trials.

  - x86: kdb: restore kdb stack trace.

  - ehea: fix allmulticast support,

  - ehea: fix promiscuous mode.

  - ehea: only register irq after setting up ports.

  - ehea: fix losing of NEQ events when one event occurred     early.

  - scsi: Silence unnecessary warnings about ioctl to     partition.

  - scsi_dh_rdac: Update match function to check page C8.

  - scsi_dh_rdac: Add new NetApp IDs.

  - bluetooth: Add support for Foxconn/Hon Hai AR5BBU22     0489:E03C.

  - x86/amd: Add missing feature flag for fam15h models     10h-1fh processors.

  - x86: Report cpb and eff_freq_ro flags correctly.

  - x86, amd: Fix up numa_node information for AMD CPU     family 15h model 0-0fh northbridge functions.

  - x86/PCI: amd: Kill misleading message about enablement     of IO access to PCI ECS.

  - cdc-wdm: fix race leading leading to memory corruption.

  - tlan: add cast needed for proper 64 bit operation.

  - bonding:update speed/duplex for NETDEV_CHANGE.

  - bonding: comparing a u8 with -1 is always false.

  - bonding: start slaves with link down for ARP monitor.

  - bonding: do not increase rx_dropped after processing     LACPDUs

  - x86: fix the initialization of physnode_map.

  - sched,rt: fix isolated CPUs leaving root_task_group     indefinitely throttled.

  - Fix SLE11-SP1->SLE11-SP2 interrupt latency regression.
    Note that this change trades an approximately 400%     latency regression fix for power consumption progression     that skew removal bought (at high cost).

  - Revert mainline 0209f649 - rcu: limit rcu_node     leaf-level fanout.

  - md: fix possible corruption of array metadata on     shutdown.

  - md/bitmap: prevent bitmap_daemon_work running while     initialising bitmap.

  - md: ensure changes to write-mostly are reflected in     metadata.

  - cciss: Add IRQF_SHARED back in for the non-MSI(X)     interrupt handler.

  - procfs, namespace, pid_ns: fix leakage upon fork()     failure.

  - mqueue: fix a vfsmount longterm reference leak.

  - procfs: fix a vfsmount longterm reference leak.

  - scsi_dh_alua: Optimize stpg command.

  - scsi_dh_alua: Store pref bit from RTPG.

  - scsi_dh_alua: set_params interface.

  - uwb: fix error handling.

  - uwb: fix use of del_timer_sync() in interrupt.

  - usbhid: fix error handling of not enough bandwidth.

  - mm: Improve preservation of page-age information

  - pagecache limit: Fix the shmem deadlock.

  - USB: sierra: add support for Sierra Wireless MC7710.

  - USB: fix resource leak in xhci power loss path.

  - x86/iommu/intel: Fix identity mapping for sandy bridge.

  - ipv6: Check dest prefix length on original route not     copied one in rt6_alloc_cow().

  - ipv6: do not use inetpeer to store metrics for routes.

  - ipv6: fix problem with expired dst cache.

  - ipv6: unshare inetpeers.

  - bridge: correct IPv6 checksum after pull.

  - scsi: storvsc: Account for in-transit packets in the     RESET path.

  -     patches.fixes/mm-mempolicy.c-fix-pgoff-in-mbind-vma-merg     e.patch :

  -     patches.fixes/mm-mempolicy.c-refix-mbind_range-vma-issue     .patch: Fix vma merging issue during mbind affecting     JVMs.

  - ACPI, APEI: Fix incorrect APEI register bit width check     and usage.

  - vmxnet3: cap copy length at size of skb to prevent     dropped frames on tx.

  - rt2x00: rt2x00dev: move rfkill_polling register to     proper place.

  - pagecache: fix the BUG_ON safety belt

  - pagecache: Fixed the GFP_NOWAIT is zero and not suitable     for tests bug

  - igb: reset PHY after recovering from PHY power down.

  - igb: fix rtnl race in PM resume path.

  - watchdog: iTCO_wdt.c - problems with newer hardware due     to SMI clearing.

  - watchdog: iTCO_wdt.c - problems with newer hardware due     to SMI clearing redhat#727875).

  - cfq-iosched: Reduce linked group count upon group     destruction.

  - cdc_ether: Ignore bogus union descriptor for RNDIS     devices.

  - sys_poll: fix incorrect type for timeout parameter.

  - staging:rts_pstor:Avoid 'Bad target number' message when     probing driver.

  - staging:rts_pstor:Complete scanning_done variable.

  - staging:rts_pstor:Fix SDIO issue.

  - staging:rts_pstor: Fix a bug that a MMCPlus card ca not     be accessed.

  - staging:rts_pstor: Fix a miswriting.

  - staging:rts_pstor:Fix possible panic by NULL pointer     dereference.

  - staging:rts_pstor: fix thread synchronization flow.

  - freezer:do not unnecessarily set PF_NOFREEZE explicitly.

  - staging:rts_pstor: off by one in for loop.

  - patches.suse/cgroup-disable-memcg-when-low-lowmem.patch:
    fix typo: use if defined(CONFIG_) rather than if CONFIG_

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1347 advisory.

  - kernel: Buffer overflow in the HFS plus filesystem (different issue than CVE-2009-4020) (CVE-2012-2319)

  - kernel: sfc: potential remote denial of service through TCP MSS option (CVE-2012-3412)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the way socket buffers (skb) requiring TSO (TCP segment offloading) were handled by the sfc driver. If the skb did not fit within the minimum-size of the transmission queue, the network card could repeatedly reset itself. A remote attacker could use this flaw to cause a denial of service. (CVE-2012-3412, Important)

* A use-after-free flaw was found in the xacct_add_tsk() function in the Linux kernel's taskstats subsystem. A local, unprivileged user could use this flaw to cause an information leak or a denial of service. (CVE-2012-3510, Moderate)

* A buffer overflow flaw was found in the hfs_bnode_read() function in the HFS Plus (HFS+) file system implementation in the Linux kernel. A local user able to mount a specially crafted HFS+ file system image could use this flaw to cause a denial of service or escalate their privileges. (CVE-2012-2319, Low)

* A flaw was found in the way the msg_namelen variable in the rds_recvmsg() function of the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation was initialized. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space.
(CVE-2012-3430, Low)

Red Hat would like to thank Ben Hutchings of Solarflare (tm) for reporting CVE-2012-3412, and Alexander Peslyak for reporting CVE-2012-3510. The CVE-2012-3430 issue was discovered by the Red Hat InfiniBand team.

This update also fixes the following bugs :

* The cpuid_whitelist() function, masking the Enhanced Intel SpeedStep (EST) flag from all guests, prevented the 'cpuspeed' service from working in the privileged Xen domain (dom0). CPU scaling was therefore not possible. With this update, cpuid_whitelist() is aware whether the domain executing CPUID is privileged or not, and enables the EST flag for dom0. (BZ#846125)

* If a delayed-allocation write was performed before quota was enabled, the kernel displayed the following warning message :

WARNING: at fs/quota/dquot.c:988 dquot_claim_space+0x77/0x112()

This was because information about the delayed allocation was not recorded in the quota structure. With this update, writes prior to enabling quota are properly accounted for, and the message is not displayed. (BZ#847326)

* In Red Hat Enterprise Linux 5.9, the DSCP (Differentiated Services Code Point) netfilter module now supports mangling of the DSCP field.
(BZ#847327)

* Some subsystems clear the TIF_SIGPENDING flag during error handling in fork() paths. Previously, if the flag was cleared, the ERESTARTNOINTR error code could be returned. The underlying source code has been modified so that the error code is no longer returned.
(BZ#847359)

* An unnecessary check for the RXCW.CW bit could cause the Intel e1000e NIC (Network Interface Controller) to not work properly. The check has been removed so that the Intel e1000e NIC works as expected.
(BZ#852448)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A flaw was found in the way socket buffers (skb)     requiring TSO (TCP segment offloading) were handled by     the sfc driver. If the skb did not fit within the     minimum-size of the transmission queue, the network card     could repeatedly reset itself. A remote attacker could     use this flaw to cause a denial of service.
    (CVE-2012-3412, Important)

  - A use-after-free flaw was found in the xacct_add_tsk()     function in the Linux kernel's taskstats subsystem. A     local, unprivileged user could use this flaw to cause an     information leak or a denial of service. (CVE-2012-3510,     Moderate)

  - A buffer overflow flaw was found in the hfs_bnode_read()     function in the HFS Plus (HFS+) file system     implementation in the Linux kernel. A local user able to     mount a specially crafted HFS+ file system image could     use this flaw to cause a denial of service or escalate     their privileges. (CVE-2012-2319, Low)

  - A flaw was found in the way the msg_namelen variable in     the rds_recvmsg() function of the Linux kernel's     Reliable Datagram Sockets (RDS) protocol implementation     was initialized. A local, unprivileged user could use     this flaw to leak kernel stack memory to user-space.
    (CVE-2012-3430, Low)

This update also fixes the following bugs :

  - The cpuid_whitelist() function, masking the Enhanced     Intel SpeedStep (EST) flag from all guests, prevented     the 'cpuspeed' service from working in the privileged     Xen domain (dom0). CPU scaling was therefore not     possible. With this update, cpuid_whitelist() is aware     whether the domain executing CPUID is privileged or not,     and enables the EST flag for dom0.

  - If a delayed-allocation write was performed before quota     was enabled, the kernel displayed the following warning     message :

    WARNING: at fs/quota/dquot.c:988     dquot_claim_space+0x77/0x112()

This was because information about the delayed allocation was not recorded in the quota structure. With this update, writes prior to enabling quota are properly accounted for, and the message is not displayed.

  - Some subsystems clear the TIF_SIGPENDING flag during     error handling in fork() paths. Previously, if the flag     was cleared, the ERESTARTNOINTR error code could be     returned. The underlying source code has been modified     so that the error code is no longer returned.

  - An unnecessary check for the RXCW.CW bit could cause the     Intel e1000e NIC (Network Interface Controller) to not     work properly. The check has been removed so that the     Intel e1000e NIC works as expected.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Andy Adamson discovered a flaw in the Linux kernel's NFSv4 implementation. A remote NFS server (attacker) could exploit this flaw to cause a denial of service. (CVE-2011-4131)

Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. (CVE-2012-2123)

An error was discovered in the Linux kernel's network TUN/TAP device implementation. A local user with access to the TUN/TAP interface (which is not available to unprivileged users until granted by a root user) could exploit this flaw to crash the system or potential gain administrative privileges. (CVE-2012-2136)

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-2372)

A flaw was discovered in the Linux kernel's NFSv4 (Network file system) handling of ACLs (access control lists). A remote NFS server (attacker) could cause a denial of service (OOPS). (CVE-2012-2375)

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

A flaw was discovered in the Linux kernel's NFSv4 (Network file system) handling of ACLs (access control lists). A remote NFS server (attacker) could cause a denial of service (OOPS). (CVE-2012-2375).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andy Adamson discovered a flaw in the Linux kernel's NFSv4 implementation. A remote NFS server (attacker) could exploit this flaw to cause a denial of service. (CVE-2011-4131)

A flaw was discovered in the Linux kernel's KVM (kernel virtual machine). An administrative user in the guest OS could leverage this flaw to cause a denial of service in the host OS. (CVE-2012-2121)

Schacher Raindel discovered a flaw in the Linux kernel's memory handling when hugetlb is enabled. An unprivileged local attacker could exploit this flaw to cause a denial of service and potentially gain higher privileges. (CVE-2012-2133)

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of cliprect on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2383)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of buffer_count on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2384)

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel.

The following security issues have been fixed :

  - A memory corruption when mounting a hfsplus filesystem     was fixed that could be used by local attackers able to     mount filesystem to crash the system. (CVE-2012-2319)

  - The dl2k network card driver lacked permission handling     for some ethtool ioctls, which could allow local     attackers to start/stop the network card.
    (CVE-2012-2313)

  - The befs_follow_linkl function in fs/befs/linuxvfs.c in     the Linux kernel did not validate the lenght attribute     of long symlinsk, which allowed local users to cause a     denial of service (incorrect pointer dereference and     Ooops) by accessing a long symlink on a malformed Be     filesystem. (CVE-2011-2928)

  - Fixed a memory corruption possibility in xfs readlink,     which could be used by local attackers to crash the     system or potentially execute code by mounting a     prepared xfs filesystem image. (CVE-2011-4077)

  - A BUG() error report in the nfs4xdr routines on a NFSv4     mount was fixed that could happen during mknod.
    (CVE-2011-4324)

  - Mounting a corrupted hfs filesystem could lead to a     buffer overflow. (CVE-2011-4330)

The following non-security issues have been fixed :

  - kernel: pfault task state race (bnc#764128,LTC#81724).

  - ap: Toleration for ap bus devices with device type 10.
    (bnc#761389)

  - hugetlb, numa: fix interleave mpol reference count.
    (bnc#762111)

  - cciss: fixup kdump. (bnc#730200)

  - kdump: Avoid allocating bootmem map over crash reserved     region. (bnc#749168, bnc#722400, bnc#742881)

  - qeth: Improve OSA Express 4 blkt defaults     (bnc#754964,LTC#80325).

  - zcrypt: Fix parameter checking for ZSECSENDCPRB ioctl     (bnc#754964,LTC#80378).

  - virtio: add names to virtqueue struct, mapping from     devices to queues. (bnc#742148)

  - virtio: find_vqs/del_vqs virtio operations. (bnc#742148)

  - virtio_pci: optional MSI-X support. (bnc#742148)

  - virtio_pci: split up vp_interrupt. (bnc#742148)

  - knfsd: nfsd4: fix laundromat shutdown race (752556).

  - driver core: Check for valid device in     bus_find_device(). (bnc#729685)

  - VMware detection backport from mainline. (bnc#671124,     bnc#747381)

  - net: adding memory barrier to the poll and receive     callbacks. (bnc#746397 / bnc#750928)

  - qla2xxx: drop reference before wait for completion.
    (bnc#744592)

  - qla2xxx: drop reference before wait for completion.
    (bnc#744592)

  - ixgbe driver sets all WOL flags upon initialization so     that machine is powered on as soon at it is switched     off. (bnc#693639)

  - Properly release MSI(X) vector(s) when MSI(X) gets     disabled. (bnc#723294, bnc#721869)

  - scsi: Always retry internal target error. (bnc#745640)

  - cxgb4: fix parent device access in netdev_printk.
    (bnc#733155)

  - lcs: lcs offline failure (bnc#752486,LTC#79788).

  - qeth: add missing wake_up call (bnc#752486,LTC#79899).

  - NFSD: Fill in WCC data for REMOVE, RMDIR, MKNOD, and     MKDIR. (bnc#751880)

  - xenbus: Reject replies with payload >     XENSTORE_PAYLOAD_MAX.

  - xenbus_dev: add missing error checks to watch handling.

  - blkfront: properly fail packet requests. (bnc#745929)

  - blkback: failure to write 'feature-barrier' node is     non-fatal.

  - igb: Free MSI and MSIX interrupt vectors on driver     remove or shutdown. (bnc#723294)

  - igb: Fix for Alt MAC Address feature on 82580 and later     devices. (bnc#746980)

  - igb: Free MSI and MSIX interrupt vectors on driver     remove or shutdown. (bnc#723294)

  - cfq: Fix infinite loop in cfq_preempt_queue().
    (bnc#724692)

  - dasd: fix fixpoint divide exception in define_extent     (bnc#750168,LTC#79125).

  - ctcmpc: use correct idal word list for ctcmpc     (bnc#750168,LTC#79264).

  - patches.fixes/ext3-fix-reuse-of-freed-blocks.diff:
    Delete. Patch should not really be needed and apparently     causes a performance regression. (bnc#683270)

  - tcp: fix race condition leading to premature termination     of sockets in FIN_WAIT2 state and connection being     reset. (bnc#745760)

  - kernel: console interrupts vs. panic     (bnc#737325,LTC#77272).

  - af_iucv: remove IUCV-pathes completely     (bnc#737325,LTC#78292).

  - qdio: wrong buffers-used counter for ERROR buffers     (bnc#737325,LTC#78758).

  - ext3: Fix credit estimate for DIO allocation.
    (bnc#745732)

  - jbd: validate sb->s_first in journal_get_superblock().
    (bnc#730118)

  - ocfs2: serialize unaligned aio. (bnc#671479)

  - cifs: eliminate usage of kthread_stop for cifsd.
    (bnc#718343)

  - virtio: fix wrong type used, resulting in truncated     addresses in bigsmp kernel. (bnc#737899)

  - cciss: Adds simple mode functionality. (bnc#730200)

  - blktap: fix locking (again). (bnc#724734)

  - block: Initial support for data-less (or empty) barrier     support (bnc#734707 FATE#313126).

  - xen: Do not allow empty barriers to be passed down to     queues that do not grok them (bnc#734707 FATE#313126).

  - linkwatch: Handle jiffies wrap-around. (bnc#740131)

A flaw was discovered in the Linux kernel's KVM (kernel virtual machine). An administrative user in the guest OS could leverage this flaw to cause a denial of service in the host OS. (CVE-2012-2121)

Schacher Raindel discovered a flaw in the Linux kernel's memory handling when hugetlb is enabled. An unprivileged local attacker could exploit this flaw to cause a denial of service and potentially gain higher privileges. (CVE-2012-2133)

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of cliprect on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2383)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of buffer_count on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2384)

A flaw was discovered in the Linux kernel's KVM (kernel virtual machine). An administrative user in the guest OS could leverage this flaw to cause a denial of service in the host OS. (CVE-2012-2121)

Schacher Raindel discovered a flaw in the Linux kernel's memory handling when hugetlb is enabled. An unprivileged local attacker could exploit this flaw to cause a denial of service and potentially gain higher privileges. (CVE-2012-2133)

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of cliprect on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2383)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of buffer_count on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2384).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andy Adamson discovered a flaw in the Linux kernel's NFSv4 implementation. A remote NFS server (attacker) could exploit this flaw to cause a denial of service. (CVE-2011-4131)

A flaw was discovered in the Linux kernel's KVM (kernel virtual machine). An administrative user in the guest OS could leverage this flaw to cause a denial of service in the host OS. (CVE-2012-2121)

Schacher Raindel discovered a flaw in the Linux kernel's memory handling when hugetlb is enabled. An unprivileged local attacker could exploit this flaw to cause a denial of service and potentially gain higher privileges. (CVE-2012-2133)

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of cliprect on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2383)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of buffer_count on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2384).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-1323.

ID	Name	Product	Family	Severity
83723	SUSE SLES10 Security Update : kernel (SUSE-SU-2015:0812-1)	Nessus	SuSE Local Security Checks	high
68632	Oracle Linux 5 : kernel (ELSA-2012-1323)	Nessus	Oracle Linux Local Security Checks	high
68631	Oracle Linux 5 : kernel (ELSA-2012-1323-1)	Nessus	Oracle Linux Local Security Checks	high
64177	SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 6547 / 6548 / 6550)	Nessus	SuSE Local Security Checks	high
64174	SuSE 11.2 Security Update : Linux Kernel (SAT Patch Numbers 6338 / 6345 / 6349)	Nessus	SuSE Local Security Checks	high
64057	RHEL 5 : kernel (RHSA-2012:1347)	Nessus	Red Hat Local Security Checks	high
62431	CentOS 5 : kernel (CESA-2012:1323)	Nessus	CentOS Local Security Checks	high
62428	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20121002)	Nessus	Scientific Linux Local Security Checks	high
62405	RHEL 5 : kernel (RHSA-2012:1323)	Nessus	Red Hat Local Security Checks	high
61508	USN-1530-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	high
59816	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1493-1)	Nessus	Ubuntu Local Security Checks	high
59815	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1492-1)	Nessus	Ubuntu Local Security Checks	high
59814	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1491-1)	Nessus	Ubuntu Local Security Checks	high
59813	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1490-1)	Nessus	Ubuntu Local Security Checks	high
59811	Ubuntu 11.04 : linux vulnerabilities (USN-1488-1)	Nessus	Ubuntu Local Security Checks	high
59553	USN-1476-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	high
59522	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 8162)	Nessus	SuSE Local Security Checks	high
59521	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 8161)	Nessus	SuSE Local Security Checks	high
59496	USN-1474-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	high
59495	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1473-1)	Nessus	Ubuntu Local Security Checks	high
59476	Ubuntu 11.10 : linux vulnerabilities (USN-1472-1)	Nessus	Ubuntu Local Security Checks	high
59475	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1471-1)	Nessus	Ubuntu Local Security Checks	high
801527	CentOS RHSA-2012-1323 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-2319

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high