The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - bonding: fixup typo in rlb mode of bond and bridge fix     (Guru Anbalagane) [Orabug: 16069448]

  - bonding: rlb mode of bond should not alter ARP     originating via bridge (zheng.li) [Orabug: 14650975]

  - compilation fix oracleasm typo (Maxim Uvarov)

  - mm/hotplug: correctly add new zone to all other nodes'     zone lists (Jiang Liu) [Orabug: 16020976 Bug-db: 14798]     (CVE-2012-5517)

  - Divide by zero in TCP congestion control Algorithm.
    (Jesper Dangaard Brouer) [Orabug: 16020656 Bug-db:
    14798] (CVE-2012-4565)

  - Fix length of buffer copied in __nfs4_get_acl_uncached     (Sachin Prabhu) [Bug- db: 14798] (CVE-2012-2375)

  - Avoid reading past buffer when calling GETACL (Sachin     Prabhu) [Bug-db: 14798] (CVE-2012-2375)

  - Avoid beyond bounds copy while caching ACL (Sachin     Prabhu) [Bug-db: 14798] (CVE-2012-2375)

  - oracleasm: Introduce module parameter for block size     selection (Martin K. Petersen) [Orabug: 15924773     16017829]

  - kernel posttrans remove all crashkernel=* (Jason Luan)     [Orabug: 15882974]

Updated kernel-rt packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise MRG 2.3.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A buffer overflow flaw was found in the way UTF-8 characters were converted to UTF-16 in the utf8s_to_utf16s() function of the Linux kernel's FAT file system implementation. A local user able to mount a FAT file system with the 'utf8=1' option could use this flaw to crash the system or, potentially, to escalate their privileges.
(CVE-2013-1773, Important)

* It was found that the RHSA-2012:0333 update did not correctly fix the CVE-2011-4131 issue. A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on the client. (CVE-2012-2375, Moderate)

* A memory disclosure flaw was found in the way the load_script() function in the binfmt_script binary format handler handled excessive recursions. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space by executing specially crafted scripts. (CVE-2012-4530, Low)

* A flaw was found in the way file permission checks for the '/dev/kmsg' file were performed in restricted root environments (for example, when using a capability-based security model). A local user able to write to this file could cause a denial of service.
(CVE-2013-1772, Low)

The CVE-2012-2375 issue was discovered by Jian Li of Red Hat.

This update also fixes multiple bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.6.11-rt28, correct these issues, and fix the bugs noted in the Red Hat Enterprise MRG 2 Technical Notes. The system must be rebooted for this update to take effect.

This update fixes the following security issues :

  - A flaw was found in the way the Linux kernel's IPv6     implementation handled certain UDP packets when the UDP     Fragmentation Offload (UFO) feature was enabled. A     remote attacker could use this flaw to crash the system     or, potentially, escalate their privileges on the     system. (CVE-2013-4387, Important)

  - A flaw was found in the way the Linux kernel handled the     creation of temporary IPv6 addresses. If the IPv6     privacy extension was enabled     (/proc/sys/net/ipv6/conf/eth0/use_tempaddr set to '2'),     an attacker on the local network could disable IPv6     temporary address generation, leading to a potential     information disclosure. (CVE-2013-0343, Moderate)

  - A flaw was found in the way the Linux kernel handled HID     (Human Interface Device) reports with an out-of-bounds     Report ID. An attacker with physical access to the     system could use this flaw to crash the system or,     potentially, escalate their privileges on the system.
    (CVE-2013-2888, Moderate)

  - An off-by-one flaw was found in the way the ANSI CPRNG     implementation in the Linux kernel processed non-block     size aligned requests. This could lead to random numbers     being generated with less bits of entropy than expected     when ANSI CPRNG was used. (CVE-2013-4345, Moderate)

  - It was found that the fix for CVE-2012-2375 released via     SLSA-2012:1580 accidentally removed a check for     small-sized result buffers. A local, unprivileged user     with access to an NFSv4 mount with ACL support could use     this flaw to crash the system or, potentially, escalate     their privileges on the system . (CVE-2013-4591,     Moderate)

  - A flaw was found in the way IOMMU memory mappings were     handled when moving memory slots. A malicious user on a     KVM host who has the ability to assign a device to a     guest could use this flaw to crash the host.
    (CVE-2013-4592, Moderate)

  - Heap-based buffer overflow flaws were found in the way     the Zeroplus and Pantherlord/GreenAsia game controllers     handled HID reports. An attacker with physical access to     the system could use these flaws to crash the system or,     potentially, escalate their privileges on the system.
    (CVE-2013-2889, CVE-2013-2892, Moderate)

  - Two information leak flaws were found in the logical     link control (LLC) implementation in the Linux kernel. A     local, unprivileged user could use these flaws to leak     kernel stack memory to user space. (CVE-2012-6542,     CVE-2013-3231, Low)

  - A heap-based buffer overflow in the way the tg3 Ethernet     driver parsed the vital product data (VPD) of devices     could allow an attacker with physical access to a system     to cause a denial of service or, potentially, escalate     their privileges. (CVE-2013-1929, Low)

  - Information leak flaws in the Linux kernel could allow a     privileged, local user to leak kernel memory to user     space. (CVE-2012-6545, CVE-2013-1928, CVE-2013-2164,     CVE-2013-2234, Low)

  - A format string flaw was found in the Linux kernel's     block layer. A privileged, local user could potentially     use this flaw to escalate their privileges to kernel     level (ring0). (CVE-2013-2851, Low)

The system must be rebooted for this update to take effect.

A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on the client. (CVE-2012-2375 , Moderate)

A divide-by-zero flaw was found in the TCP Illinois congestion control algorithm implementation in the Linux kernel. If the TCP Illinois congestion control algorithm were in use (the sysctl net.ipv4.tcp_congestion_control variable set to 'illinois'), a local, unprivileged user could trigger this flaw and cause a denial of service. (CVE-2012-4565 , Moderate)

A NULL pointer dereference flaw was found in the way a new node's hot added memory was propagated to other nodes' zonelists. By utilizing this newly added memory from one of the remaining nodes, a local, unprivileged user could use this flaw to cause a denial of service.
(CVE-2012-5517 , Moderate)

It was found that a prevoius kernel release did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service.
(CVE-2012-2100 , Low)

A flaw was found in the way the Linux kernel's IPv6 implementation handled overlapping, fragmented IPv6 packets. A remote attacker could potentially use this flaw to bypass protection mechanisms (such as a firewall or intrusion detection system (IDS)) when sending network packets to a target system. (CVE-2012-4444 , Low)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2507 advisory.

  - arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used,     does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service     (system crash) via a crafted application. (CVE-2013-0309)

  - The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call. (CVE-2013-0310)

  - The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly     handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging     KVM guest OS privileges. (CVE-2013-0311)

  - The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen     paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows     guest OS users to gain guest OS privileges via a crafted application. (CVE-2013-0228)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2047 advisory.

  - The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel     before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to     cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply.
    NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131. (CVE-2012-2375)

  - The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the     net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of     service (divide-by-zero error and OOPS) by reading TCP stats. (CVE-2012-4565)

  - The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact in opportunistic circumstances by using memory that was hot-added by an administrator.
    (CVE-2012-5517)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1580 advisory.

  - The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform     and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-     groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super     block with a large FLEX_BG group size (aka s_log_groups_per_flex value). NOTE: this vulnerability exists     because of an incomplete fix for CVE-2009-4307. (CVE-2012-2100)

  - The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel     before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to     cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply.
    NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131. (CVE-2012-2375)

  - The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote     attackers to bypass intended network restrictions via overlapping IPv6 fragments. (CVE-2012-4444)

  - The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the     net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of     service (divide-by-zero error and OOPS) by reading TCP stats. (CVE-2012-4565)

  - The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to     cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other     impact in opportunistic circumstances by using memory that was hot-added by an administrator.
    (CVE-2012-5517)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP2 kernel was updated to 3.0.34, fixing a lot of bugs and security issues.

The update from Linux kernel 3.0.31 to 3.0.34 also fixes various bugs not listed here.

The following security issues have been fixed :

  - Local attackers could trigger an overflow in     sock_alloc_send_pksb(), potentially crashing the machine     or escalate privileges. (CVE-2012-2136)

  - A memory leak in transparent hugepages on mmap failure     could be used by local attacker to run the machine out     of memory (local denial of service). (CVE-2012-2390)

  - A malicious guest driver could overflow the host stack     by passing a long descriptor, so potentially crashing     the host system or escalating privileges on the host.
    (CVE-2012-2119)

  - Malicious NFS server could crash the clients when more     than 2 GETATTR bitmap words are returned in response to     the FATTR4_ACL attribute requests, only incompletely     fixed by CVE-2011-4131. (CVE-2012-2375)

The following non-security bugs have been fixed :

Hyper-V :

  - storvsc: Properly handle errors from the host.
    (bnc#747404)

  - HID: hid-hyperv: Do not use hid_parse_report() directly.

  - HID: hyperv: Set the hid drvdata correctly.

  - drivers/hv: Get rid of an unnecessary check in     vmbus_prep_negotiate_resp().

  - drivers/hv: util: Properly handle version negotiations.

  - hv: fix return type of hv_post_message().

  - net/hyperv: Add flow control based on hi/low watermark.

  - usb/net: rndis: break out <1/rndis.h> defines. only     net/hyperv part

  - usb/net: rndis: remove ambiguous status codes. only     net/hyperv part

  - usb/net: rndis: merge command codes. only net/hyperv     part

  - net/hyperv: Adding cancellation to ensure rndis filter     is closed.

  - update hv drivers to 3.4-rc1, requires new hv_kvp_daemon :

  - drivers: hv: kvp: Add/cleanup connector defines.

  - drivers: hv: kvp: Move the contents of hv_kvp.h to     hyperv.h.

  - net/hyperv: Convert camel cased variables in     rndis_filter.c to lower cases.

  - net/hyperv: Correct the assignment in     netvsc_recv_callback().

  - net/hyperv: Remove the unnecessary memset in     rndis_filter_send().

  - drivers: hv: Cleanup the kvp related state in hyperv.h.

  - tools: hv: Use hyperv.h to get the KVP definitions.

  - drivers: hv: kvp: Cleanup the kernel/user protocol.

  - drivers: hv: Increase the number of VCPUs supported in     the guest.

  - net/hyperv: Fix data corruption in     rndis_filter_receive().

  - net/hyperv: Add support for vlan trunking from guests.

  - Drivers: hv: Add new message types to enhance KVP.

  - Drivers: hv: Support the newly introduced KVP messages     in the driver.

  - Tools: hv: Fully support the new KVP verbs in the user     level daemon.

  - Tools: hv: Support enumeration from all the pools.

  - net/hyperv: Fix the code handling tx busy.

  - patches.suse/suse-hv-pata_piix-ignore-disks.patch     replace our version of this patch with upstream variant:
    ata_piix: defer disks to the Hyper-V drivers by default     libata: add a host flag to ignore detected ATA devices.

Btrfs :

  - btrfs: more module message prefixes.

  - vfs: re-implement writeback_inodes_sb(_nr)_if_idle() and     rename them

  - btrfs: flush all the dirty pages if     try_to_writeback_inodes_sb_nr() fails

  - vfs: re-implement writeback_inodes_sb(_nr)_if_idle() and     rename them

  - btrfs: fix locking in btrfs_destroy_delayed_refs

  - btrfs: wake up transaction waiters when aborting a     transaction

  - btrfs: abort the transaction if the commit fails

  - btrfs: fix btrfs_destroy_marked_extents

  - btrfs: unlock everything properly in the error case for     nocow

  - btrfs: fix return code in drop_objectid_items

  - btrfs: check to see if the inode is in the log before     fsyncing

  - btrfs: pass locked_page into     extent_clear_unlock_delalloc if theres an error

  - btrfs: check the return code of btrfs_save_ino_cache

  - btrfs: do not update atime for RO snapshots     (FATE#306586).

  - btrfs: convert the inode bit field to use the actual bit     operations

  - btrfs: fix deadlock when the process of delayed refs     fails

  - btrfs: stop defrag the files automatically when doin     readonly remount or umount

  - btrfs: avoid memory leak of extent state in error     handling routine

  - btrfs: make sure that we have made everything in pinned     tree clean

  - btrfs: destroy the items of the delayed inodes in error     handling routine

  - btrfs: ulist realloc bugfix

  - btrfs: bugfix in btrfs_find_parent_nodes

  - btrfs: bugfix: ignore the wrong key for indirect tree     block backrefs

  - btrfs: avoid buffer overrun in btrfs_printk

  - btrfs: fall back to non-inline if we do not have enough     space

  - btrfs: NUL-terminate path buffer in DEV_INFO ioctl     result

  - btrfs: avoid buffer overrun in mount option handling

  - btrfs: do not do balance in readonly mode

  - btrfs: fix the same inode id problem when doing auto     defragment

  - btrfs: fix wrong error returned by adding a device

  - btrfs: use fastpath in extent state ops as much as     possible Misc :

  - tcp: drop SYN+FIN messages. (bnc#765102)

  - mm: avoid swapping out with swappiness==0 (swappiness).

  - thp: avoid atomic64_read in pmd_read_atomic for 32bit     PAE. (bnc#762991)

  - paravirt: Split paravirt MMU ops (bnc#556135,     bnc#754690, FATE#306453).

  - paravirt: Only export pv_mmu_ops symbol if PARAVIRT_MMU

  - parvirt: Stub support KABI for KVM_MMU (bnc#556135,     bnc#754690, FATE#306453).

  - tmpfs: implement NUMA node interleaving. (bnc#764209)

  - synaptics-hp-clickpad: Fix the detection of LED on the     recent HP laptops. (bnc#765524)

  - supported.conf: mark xt_AUDIT as supported. (bnc#765253)

  - mm: pmd_read_atomic: fix 32bit PAE pmd walk vs     pmd_populate SMP race condition. (bnc#762991 /     CVE-2012-2373)

  - xhci: Do not free endpoints in xhci_mem_cleanup().
    (bnc#763307)

  - xhci: Fix invalid loop check in xhci_free_tt_info().
    (bnc#763307)

  - drm: Skip too big EDID extensions. (bnc#764900)

  - drm/i915: Add HP EliteBook to LVDS-temporary-disable     list. (bnc#763717)

  - hwmon: (fam15h_power) Increase output resolution.
    (bnc#759336)

  - hwmon: (k10temp) Add support for AMD Trinity CPUs.
    (bnc#759336)

  - rpm/kernel-binary.spec.in: Own the right -kdump initrd.
    (bnc#764500)

  - memcg: prevent from OOM with too many dirty pages.

  - dasd: re-prioritize partition detection message     (bnc#764091,LTC#81617).

  - kernel: pfault task state race (bnc#764091,LTC#81724).

  - kernel: clear page table for sw large page emulation     (bnc#764091,LTC#81933).

  - USB: fix bug of device descriptor got from superspeed     device. (bnc#761087)

  - xfrm: take net hdr len into account for esp payload size     calculation. (bnc#759545)

  - st: clean up dev cleanup in st_probe. (bnc#760806)

  - st: clean up device file creation and removal.
    (bnc#760806)

  - st: get rid of scsi_tapes array. (bnc#760806)

  - st: raise device limit. (bnc#760806)

  - st: Use static class attributes. (bnc#760806)

  - mm: Optimize put_mems_allowed() usage (VM performance).

  - cifs: fix oops while traversing open file list (try #4).
    (bnc#756050)

  - scsi: Fix dm-multipath starvation when scsi host is     busy. (bnc#763485)

  - dasd: process all requests in the device tasklet.
    (bnc#763267)

  - rt2x00:Add RT539b chipset support. (bnc#760237)

  - kabi/severities: Ignore changes in     drivers/net/wireless/rt2x00, these are just exports used     among the rt2x00 modules.

  - rt2800: radio 3xxx: reprogram only lower bits of RF_R3.
    (bnc#759805)

  - rt2800: radio 3xxx: program RF_R1 during channel switch.
    (bnc#759805)

  - rt2800: radio 3xxxx: channel switch RX/TX calibration     fixes. (bnc#759805)

  - rt2x00: Avoid unnecessary uncached. (bnc#759805)

  - rt2x00: Introduce sta_add/remove callbacks. (bnc#759805)

  - rt2x00: Add WCID to crypto struct. (bnc#759805)

  - rt2x00: Add WCID to HT TX descriptor. (bnc#759805)

  - rt2x00: Move bssidx calculation into its own function.
    (bnc#759805)

  - rt2x00: Make use of sta_add/remove callbacks in rt2800.
    (bnc#759805)

  - rt2x00: Forbid aggregation for STAs not programmed into     the hw. (bnc#759805)

  - rt2x00: handle spurious pci interrupts. (bnc#759805)

  - rt2800: disable DMA after firmware load.

  - rt2800: radio 3xxx: add channel switch calibration     routines. (bnc#759805)

  - rpm/kernel-binary.spec.in: Obsolete ath3k, as it is now     in the tree.

  - floppy: remove floppy-specific O_EXCL handling.
    (bnc#757315)

  - floppy: convert to delayed work and single-thread wq.
    (bnc#761245)

This update fixes the following security issues :

  - It was found that a previous update did not correctly     fix the CVE-2011-4131 issue. A malicious Network File     System version 4 (NFSv4) server could return a crafted     reply to a GETACL request, causing a denial of service     on the client. (CVE-2012-2375, Moderate)

  - A divide-by-zero flaw was found in the TCP Illinois     congestion control algorithm implementation in the Linux     kernel. If the TCP Illinois congestion control algorithm     were in use (the sysctl net.ipv4.tcp_congestion_control     variable set to 'illinois'), a local, unprivileged user     could trigger this flaw and cause a denial of service.
    (CVE-2012-4565, Moderate)

  - A NULL pointer dereference flaw was found in the way a     new node's hot added memory was propagated to other     nodes' zonelists. By utilizing this newly added memory     from one of the remaining nodes, a local, unprivileged     user could use this flaw to cause a denial of service.
    (CVE-2012-5517, Moderate)

  - It was found that the initial release of Scientific     Linux 6 did not correctly fix the CVE-2009-4307 issue, a     divide-by-zero flaw in the ext4 file system code. A     local, unprivileged user with the ability to mount an     ext4 file system could use this flaw to cause a denial     of service. (CVE-2012-2100, Low)

  - A flaw was found in the way the Linux kernel's IPv6     implementation handled overlapping, fragmented IPv6     packets. A remote attacker could potentially use this     flaw to bypass protection mechanisms (such as a firewall     or intrusion detection system (IDS)) when sending     network packets to a target system. (CVE-2012-4444, Low)

The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues, numerous bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* It was found that the RHSA-2012:0862 update did not correctly fix the CVE-2011-4131 issue. A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on the client. (CVE-2012-2375, Moderate)

* A divide-by-zero flaw was found in the TCP Illinois congestion control algorithm implementation in the Linux kernel. If the TCP Illinois congestion control algorithm were in use (the sysctl net.ipv4.tcp_congestion_control variable set to 'illinois'), a local, unprivileged user could trigger this flaw and cause a denial of service. (CVE-2012-4565, Moderate)

* A NULL pointer dereference flaw was found in the way a new node's hot added memory was propagated to other nodes' zonelists. By utilizing this newly added memory from one of the remaining nodes, a local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-5517, Moderate)

* It was found that the initial release of Red Hat Enterprise Linux 6 did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service. (CVE-2012-2100, Low)

* A flaw was found in the way the Linux kernel's IPv6 implementation handled overlapping, fragmented IPv6 packets. A remote attacker could potentially use this flaw to bypass protection mechanisms (such as a firewall or intrusion detection system (IDS)) when sending network packets to a target system. (CVE-2012-4444, Low)

Red Hat would like to thank Antonios Atlasis working with Beyond Security's SecuriTeam Secure Disclosure program and Loganaden Velvindron of AFRINIC for reporting CVE-2012-4444. The CVE-2012-2375 issue was discovered by Jian Li of Red Hat, and CVE-2012-4565 was discovered by Rodrigo Freire of Red Hat.

This update also fixes numerous bugs and adds one enhancement. Space precludes documenting all of these changes in this advisory.
Documentation for these changes will be available shortly from the Red Hat Enterprise Linux 6.3 Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, fix these bugs and add the enhancement noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1580 advisory.

  - kernel: ext4: fix inconsistency in ext4_fill_flex_info() (CVE-2012-2100)

  - kernel: incomplete fix for CVE-2011-4131 (CVE-2012-2375)

  - kernel: net: acceptation of overlapping ipv6 fragments (CVE-2012-4444)

  - kernel: net: divide by zero in tcp algorithm illinois (CVE-2012-4565)

  - kernel: mm/hotplug: failure in propagating hot-added memory to other nodes (CVE-2012-5517)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Andy Adamson discovered a flaw in the Linux kernel's NFSv4 implementation. A remote NFS server (attacker) could exploit this flaw to cause a denial of service. (CVE-2011-4131)

Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. (CVE-2012-2123)

An error was discovered in the Linux kernel's network TUN/TAP device implementation. A local user with access to the TUN/TAP interface (which is not available to unprivileged users until granted by a root user) could exploit this flaw to crash the system or potential gain administrative privileges. (CVE-2012-2136)

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-2372)

A flaw was discovered in the Linux kernel's NFSv4 (Network file system) handling of ACLs (access control lists). A remote NFS server (attacker) could cause a denial of service (OOPS). (CVE-2012-2375)

A flaw was discovered in the Linux kernel's NFSv4 (Network file system) handling of ACLs (access control lists). A remote NFS server (attacker) could cause a denial of service (OOPS).

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

A flaw was discovered in the Linux kernel's NFSv4 (Network file system) handling of ACLs (access control lists). A remote NFS server (attacker) could cause a denial of service (OOPS). (CVE-2012-2375).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in the Linux kernel's NFSv4 (Network file system) handling of ACLs (access control lists). A remote NFS server (attacker) could cause a denial of service (OOPS).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Linux 2.6.43.8 (3.3.8).

Disabled 32bit NX emulation. Suspected of being broken and it deviates from upstream.

Unless there are further security issues, this will likely be the last F15 kernel update before End-of-Life. The 3.3.7 stable kernel contains a number of important bug fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 3.3.7 stable kernel contains a number of important bug fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-1580.

ID	Name	Product	Family	Severity
79495	OracleVM 3.2 : kernel-uek (OVMSA-2013-0003)	Nessus	OracleVM Local Security Checks	medium
76658	RHEL 6 : MRG (RHSA-2013:0566)	Nessus	Red Hat Local Security Checks	medium
71490	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	medium
69707	Amazon Linux AMI : kernel / nvidia (ALAS-2013-148)	Nessus	Amazon Linux Local Security Checks	high
68847	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2013-2507)	Nessus	Oracle Linux Local Security Checks	high
68689	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2047)	Nessus	Oracle Linux Local Security Checks	medium
68666	Oracle Linux 6 : kernel (ELSA-2012-1580)	Nessus	Oracle Linux Local Security Checks	high
64176	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 6453 / 6457)	Nessus	SuSE Local Security Checks	high
64175	SuSE 11.2 Security Update : Linux kernel (SAT Patch Number 6463)	Nessus	SuSE Local Security Checks	high
63313	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20121218)	Nessus	Scientific Linux Local Security Checks	high
63305	CentOS 6 : kernel (CESA-2012:1580)	Nessus	CentOS Local Security Checks	high
63292	RHEL 6 : kernel (RHSA-2012:1580)	Nessus	Red Hat Local Security Checks	medium
61508	USN-1530-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	high
59891	USN-1499-1 : linux-ti-omap4 vulnerability	Nessus	Ubuntu Local Security Checks	medium
59831	USN-1494-1 : linux-ti-omap4 vulnerability	Nessus	Ubuntu Local Security Checks	medium
59813	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1490-1)	Nessus	Ubuntu Local Security Checks	high
59812	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerability (USN-1489-1)	Nessus	Ubuntu Local Security Checks	medium
59811	Ubuntu 11.04 : linux vulnerabilities (USN-1488-1)	Nessus	Ubuntu Local Security Checks	high
59810	Ubuntu 11.10 : linux vulnerability (USN-1487-1)	Nessus	Ubuntu Local Security Checks	medium
59809	Ubuntu 12.04 LTS : linux vulnerability (USN-1486-1)	Nessus	Ubuntu Local Security Checks	medium
59661	Fedora 15 : kernel-2.6.43.8-1.fc15 (2012-8931)	Nessus	Fedora Local Security Checks	medium
59280	Fedora 16 : kernel-3.3.7-1.fc16 (2012-8359)	Nessus	Fedora Local Security Checks	medium
59279	Fedora 17 : kernel-3.3.7-1.fc17 (2012-8314)	Nessus	Fedora Local Security Checks	medium
801532	CentOS RHSA-2012-1580 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-2375

high

Tenable Plugins

medium

medium

medium

high

high

medium

high

high

high

high

high

medium

high

medium

medium

high

medium

high

medium

medium

medium

medium

medium

high