net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):An issue was discovered in     the Linux kernel before 4.20. There is a race condition     in smp_task_timedout() and smp_task_done() in     drivers/scsi/libsas/sas_expander.c, leading to a     use-after-free.(CVE-2018-20836)The Linux kernel before     4.8 allows local users to bypass ASLR on setuid     programs (such as /bin/su) because install_exec_creds()     is called too late in load_elf_binary() in     fs/binfmt_elf.c, and thus the ptrace_may_access() check     has a race condition when reading     /proc/pid/stat.(CVE-2019-11190)The Siemens R3964 line     discipline driver in drivers/tty_r3964.c in the Linux     kernel before 5.0.8 has multiple race     conditions.(CVE-2019-11486)The Linux kernel before     5.1-rc5 allows page-i1/4z_refcount reference count     overflow, with resultant use-after-free issues, if     about 140 GiB of RAM exists. This is related to     fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h,     kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It     can occur with FUSE requests.(CVE-2019-11487)The     coredump implementation in the Linux kernel before     5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs,     which allows local users to obtain sensitive     information, cause a denial of service, or possibly     have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls.
    This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and     drivers/infiniband/core/uverbs_main.c.(CVE-2019-11599)A     n issue was discovered in the Linux kernel before     5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in     megasas_alloc_cmds() in     drivers/scsi/megaraid/megaraid_sas_base.c. This causes     a Denial of Service, related to a     use-after-free.(CVE-2019-11810)In the tun subsystem in     the Linux kernel before 4.13.14, dev_get_valid_name is     not called before register_netdevice. This allows local     users to cause a denial of service (NULL pointer     dereference and panic) via an ioctl(TUNSETIFF) call     with a dev name containing a / character. This is     similar to     CVE-2013-4343.(CVE-2018-7191)net/ipv6etfilterf_conntrac     k_reasm.c in the Linux kernel before 2.6.34, when the     nf_conntrack_ipv6 module is enabled, allows remote     attackers to cause a denial of service (NULL pointer     dereference and system crash) via certain types of     fragmented IPv6 packets.(CVE-2012-2744)Heap-based     buffer overflow in the udf_load_logicalvol function in     fs/udf/super.c in the Linux kernel before 3.4.5 allows     remote attackers to cause a denial of service (system     crash) or possibly have unspecified other impact via a     crafted UDF filesystem.(CVE-2012-3400)The     mmc_ioctl_cdrom_read_data function in     drivers/cdrom/cdrom.c in the Linux kernel through 3.10     allows local users to obtain sensitive information from     kernel memory via a read operation on a malfunctioning     CD-ROM drive.(CVE-2013-2164)The (1) get_user and (2)     put_user API functions in the Linux kernel before 3.5.5     on the v6k and v7 ARM platforms do not validate certain     addresses, which allows attackers to read or modify the     contents of arbitrary kernel memory locations via a     crafted application, as exploited in the wild against     Android devices in October and November     2013.(CVE-2013-6282)The sctp_sf_do_5_2_4_dupcook     function in net/sctp/sm_statefuns.c in the SCTP     implementation in the Linux kernel before 3.8.5 does     not properly handle associations during the processing     of a duplicate COOKIE ECHO chunk, which allows remote     attackers to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via crafted SCTP     traffic.(CVE-2013-2206)A elevation of privilege     vulnerability in the Broadcom wi-fi driver. Product:
    Android. Versions: Android kernel. Android ID:
    A-37351060. References: B-V2017060101.(CVE-2017-0786)An     issue was discovered in the Linux kernel before 5.0.4.
    There is a use-after-free upon attempted read access to     /proc/ioports after the ipmi_si module is removed,     related to drivers/char/ipmi/ipmi_si_intf.c,     drivers/char/ipmi/ipmi_si_mem_io.c, and     drivers/char/ipmi/ipmi_si_port_io.c.(CVE-2019-11811)Not     e1: kernel-4.19.36-vhulk1907.1.0.h529 and earlier     versions in EulerOS Virtualization for ARM 64 3.0.2.0     return incorrect time information when executing the     uname -a command.Note2: The kernel version number     naming format has been changed after     4.19.36-1.2.184.aarch64, the new version format is     4.19.36-vhulk1907.1.0.hxxx.aarch64, which may lead to     false positives of this security advisory.

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel.

The following security issues have been fixed :

CVE-2011-2494: kernel/taskstats.c in the Linux kernel allowed local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another users password (a side channel attack).

CVE-2012-2744: net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel, when the nf_conntrack_ipv6 module is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.

CVE-2012-3510: Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel allowed local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.

CVE-2011-4110: The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allowed local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and updating a negative key into a fully instantiated key.

CVE-2011-1044: The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel did not initialize a certain response buffer, which allowed local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649.

CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.

CVE-2012-2136: The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel did not properly validate a certain length value, which allowed local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.

CVE-2012-2663: A small denial of service leak in dropping syn+fin messages was fixed.

The following non-security issues have been fixed :

Packaging :

  - kbuild: Fix gcc -x syntax (bnc#773831).

NFS :

  - knfsd: An assortment of little fixes to the sunrpc cache     code (bnc#767766).

  - knfsd: Unexport cache_fresh and fix a small race     (bnc#767766).

  - knfsd: nfsd: do not drop silently on upcall deferral     (bnc#767766).

  - knfsd: svcrpc: remove another silent drop from deferral     code (bnc#767766).

  - sunrpc/cache: simplify cache_fresh_locked and     cache_fresh_unlocked (bnc#767766).

  - sunrpc/cache: recheck cache validity after     cache_defer_req (bnc#767766).

  - sunrpc/cache: use list_del_init for the list_head     entries in cache_deferred_req (bnc#767766).

  - sunrpc/cache: avoid variable over-loading in     cache_defer_req (bnc#767766).

  - sunrpc/cache: allow thread to block while waiting for     cache update (bnc#767766).

  - sunrpc/cache: Fix race in sunrpc/cache introduced by     patch to allow thread to block while waiting for cache     update (bnc#767766).

  - sunrpc/cache: Another fix for race problem with sunrpc     cache deferal (bnc#767766).

  - knfsd: nfsd: make all exp_finding functions return

-errnos on err (bnc#767766).

  - Fix kabi breakage in previous nfsd patch series     (bnc#767766).

  - nfsd: Work around incorrect return type for     wait_for_completion_interruptible_timeout (bnc#767766).

  - nfs: Fix a potential file corruption issue when writing     (bnc#773272).

  - nfs: Allow sync writes to be multiple pages     (bnc#763526).

  - nfs: fix reference counting for NFSv4 callback thread     (bnc#767504).

  - nfs: flush signals before taking down callback thread     (bnc#767504).

  - nfsv4: Ensure nfs_callback_down() calls svc_destroy()     (bnc#767504).

SCSI :

  - SCSI/ch: Check NULL for kmalloc() return (bnc#783058).
    drivers/scsi/aic94xx/aic94xx_init.c: correct the size     argument to kmalloc (bnc#783058).

    block: fail SCSI passthrough ioctls on partition devices     (bnc#738400).

    dm: do not forward ioctls from logical volumes to the     underlying device (bnc#738400).

    vmware: Fix VMware hypervisor detection (bnc#777575,     bnc#770507).

S/390 :

  - lgr: Make lgr_page static (bnc#772409,LTC#83520).

  - zfcp: Fix oops in _blk_add_trace()     (bnc#772409,LTC#83510). kernel: Add z/VM LGR detection     (bnc#767277,LTC#RAS1203).

    be2net: Fix EEH error reset before a flash dump     completes (bnc#755546).

  - mptfusion: fix msgContext in mptctl_hp_hostinfo     (bnc#767939).

  - PCI: Fix bus resource assignment on 32 bits with 64b     resources. (bnc#762581)

  - PCI: fix up setup-bus.c #ifdef. (bnc#762581) x86:
    powernow-k8: Fix indexing issue (bnc#758985).

    net: Fix race condition about network device name     allocation (bnc#747576).

XEN :

  - smpboot: adjust ordering of operations.

  - xen/x86-64: provide a memset() that can deal with 4Gb or     above at a time (bnc#738528).

  - xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53     (bnc#760974).

  - xen/gntdev: fix multi-page slot allocation (bnc#760974).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1064 advisory.

  - net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6     module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and     system crash) via certain types of fragmented IPv6 packets. (CVE-2012-2744)

  - The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement     session keyring to a child process, which allows local users to cause a denial of service (panic) via a     crafted application that uses the fork system call. (CVE-2012-2745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 6.1 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm() function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the nf_conntrack_ipv6 kernel module loaded, causing it to crash. (CVE-2012-2744, Important)

Red Hat would like to thank an anonymous contributor working with the Beyond Security SecuriTeam Secure Disclosure program for reporting this issue.

Users should upgrade to these updated packages, which contain a backported patch to resolve this issue. The system must be rebooted for this update to take effect.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.2 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm() function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the nf_conntrack_ipv6 kernel module loaded, causing it to crash. (CVE-2012-2744, Important)

* A flaw was found in the way the Linux kernel's Event Poll (epoll) subsystem handled large, nested epoll structures. A local, unprivileged user could use this flaw to cause a denial of service.
(CVE-2011-1083, Moderate)

Red Hat would like to thank an anonymous contributor working with the Beyond Security SecuriTeam Secure Disclosure program for reporting CVE-2012-2744, and Nelson Elhage for reporting CVE-2011-1083.

This update also fixes the following bugs :

* Attempting to turn on Data Center Bridging (DCB) on a port connected to a non-DCB switch port caused the system to become unresponsive or even terminate. This was because napi_poll routines in the ixgbe driver did not end the NAPI when data processing was complete. With this update, the ixgbe napi_poll routines have been fixed so that they now call the napi_complete() function when data processing has finished. This ensures that the NAPI is correctly disabled, and thus prevents possible hangs and crashes in this scenario. (BZ#814454)

* If a new file was created on a Network File System version 4 (NFSv4) share, the ownership was set to nfsnobody (-2) until it was possible to upcall to the idmapper. As a consequence, subsequent file system operations could incorrectly use '-2' for the user and group IDs for the given file, causing certain operations to fail. In reported cases, this issue also caused 'Viminfo file is not writable' errors for users running Vim with files on an NFSv4 share. (BZ#820962)

* Previously, the size of the multicast IGMP (Internet Group Management Protocol) snooping hash table for a bridge was limited to 256 entries even though the maximum is 512. This was due to the hash table size being incorrectly compared to the maximum hash table size, hash_max, and the following message could have been produced by the kernel :

Multicast hash table maximum reached, disabling snooping: vnet1, 512

With this update, the hash table value is correctly compared to the hash_max value, and the error message no longer occurs under these circumstances. (BZ#840021)

Users should upgrade to these updated packages, which contain backported patches to resolve these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 6.0 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm() function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the nf_conntrack_ipv6 kernel module loaded, causing it to crash. (CVE-2012-2744, Important)

Red Hat would like to thank an anonymous contributor working with the Beyond Security SecuriTeam Secure Disclosure program for reporting this issue.

Users should upgrade to these updated packages, which contain a backported patch to resolve this issue. The system must be rebooted for this update to take effect.

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel.

The following security issues have been fixed :

  - kernel/taskstats.c in the Linux kernel allowed local     users to obtain sensitive I/O statistics by sending     taskstats commands to a netlink socket, as demonstrated     by discovering the length of another users password (a     side channel attack). (CVE-2011-2494)

  - net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux     kernel, when the nf_conntrack_ipv6 module is enabled,     allowed remote attackers to cause a denial of service     (NULL pointer dereference and system crash) via certain     types of fragmented IPv6 packets. (CVE-2012-2744)

  - Use-after-free vulnerability in the xacct_add_tsk     function in kernel/tsacct.c in the Linux kernel allowed     local users to obtain potentially sensitive information     from kernel memory or cause a denial of service (system     crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.
    (CVE-2012-3510)

  - The user_update function in security/keys/user_defined.c     in the Linux kernel 2.6 allowed local users to cause a     denial of service (NULL pointer dereference and kernel     oops) via vectors related to a user-defined key and     updating a negative key into a fully instantiated key.
    (CVE-2011-4110)

  - The ib_uverbs_poll_cq function in     drivers/infiniband/core/uverbs_cmd.c in the Linux kernel     did not initialize a certain response buffer, which     allowed local users to obtain potentially sensitive     information from kernel memory via vectors that cause     this buffer to be only partially filled, a different     vulnerability than CVE-2010-4649. (CVE-2011-1044)

  - Heap-based buffer overflow in the udf_load_logicalvol     function in fs/udf/super.c in the Linux kernel allowed     remote attackers to cause a denial of service (system     crash) or possibly have unspecified other impact via a     crafted UDF filesystem. (CVE-2012-3400)

  - The sock_alloc_send_pskb function in net/core/sock.c in     the Linux kernel did not properly validate a certain     length value, which allowed local users to cause a     denial of service (heap-based buffer overflow and system     crash) or possibly gain privileges by leveraging access     to a TUN/TAP device. (CVE-2012-2136)

  - A small denial of service leak in dropping syn+fin     messages was fixed. (CVE-2012-2663)

The following non-security issues have been fixed :

Packaging :

  - kbuild: Fix gcc -x syntax (bnc#773831). NFS :

  - knfsd: An assortment of little fixes to the sunrpc cache     code. (bnc#767766)

  - knfsd: Unexport cache_fresh and fix a small race.
    (bnc#767766)

  - knfsd: nfsd: do not drop silently on upcall deferral.
    (bnc#767766)

  - knfsd: svcrpc: remove another silent drop from deferral     code. (bnc#767766)

  - sunrpc/cache: simplify cache_fresh_locked and     cache_fresh_unlocked. (bnc#767766)

  - sunrpc/cache: recheck cache validity after     cache_defer_req. (bnc#767766)

  - sunrpc/cache: use list_del_init for the list_head     entries in cache_deferred_req. (bnc#767766)

  - sunrpc/cache: avoid variable over-loading in     cache_defer_req. (bnc#767766)

  - sunrpc/cache: allow thread to block while waiting for     cache update. (bnc#767766)

  - sunrpc/cache: Fix race in sunrpc/cache introduced by     patch to allow thread to block while waiting for cache     update. (bnc#767766)

  - sunrpc/cache: Another fix for race problem with sunrpc     cache deferal. (bnc#767766)

  - knfsd: nfsd: make all exp_finding functions return
    -errnos on err. (bnc#767766)

  - Fix kabi breakage in previous nfsd patch series.
    (bnc#767766)

  - nfsd: Work around incorrect return type for     wait_for_completion_interruptible_timeout. (bnc#767766)

  - nfs: Fix a potential file corruption issue when writing.
    (bnc#773272)

  - nfs: Allow sync writes to be multiple pages.
    (bnc#763526)

  - nfs: fix reference counting for NFSv4 callback thread.
    (bnc#767504)

  - nfs: flush signals before taking down callback thread.
    (bnc#767504)

  - nfsv4: Ensure nfs_callback_down() calls svc_destroy()     (bnc#767504). SCSI :

  - SCSI/ch: Check NULL for kmalloc() return. (bnc#783058)

  - drivers/scsi/aic94xx/aic94xx_init.c: correct the size     argument to kmalloc. (bnc#783058)

  - block: fail SCSI passthrough ioctls on partition     devices. (bnc#738400)

  - dm: do not forward ioctls from logical volumes to the     underlying device. (bnc#738400)

  - vmware: Fix VMware hypervisor detection (bnc#777575,     bnc#770507). S/390 :

  - lgr: Make lgr_page static (bnc#772409,LTC#83520).

  - zfcp: Fix oops in _blk_add_trace()     (bnc#772409,LTC#83510).

  - kernel: Add z/VM LGR detection (bnc#767277,LTC#RAS1203).

  - be2net: Fix EEH error reset before a flash dump     completes. (bnc#755546)

  - mptfusion: fix msgContext in mptctl_hp_hostinfo.
    (bnc#767939)

  - PCI: Fix bus resource assignment on 32 bits with 64b     resources. . (bnc#762581)

  - PCI: fix up setup-bus.c #ifdef. (bnc#762581)

  - x86: powernow-k8: Fix indexing issue. (bnc#758985)

  - net: Fix race condition about network device name     allocation. (bnc#747576)

XEN :

  - smpboot: adjust ordering of operations.

  - xen/x86-64: provide a memset() that can deal with 4Gb or     above at a time. (bnc#738528)

  - xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53.
    (bnc#760974)

  - xen/gntdev: fix multi-page slot allocation. (bnc#760974)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A NULL pointer dereference flaw was found in the     nf_ct_frag6_reasm() function in the Linux kernel's     netfilter IPv6 connection tracking implementation. A     remote attacker could use this flaw to send specially     crafted packets to a target system that is using IPv6     and also has the nf_conntrack_ipv6 kernel module loaded,     causing it to crash. (CVE-2012-2744, Important)

  - A flaw was found in the way the Linux kernel's key     management facility handled replacement session keyrings     on process forks. A local, unprivileged user could use     this flaw to cause a denial of service. (CVE-2012-2745,     Moderate)

This update also fixes the following bugs :

  - Previously introduced firmware files required for new     Realtek chipsets contained an invalid prefix     ('rtl_nic_') in the file names, for example     '/lib/firmware/rtl_nic/rtl_nic_rtl8168d-1.fw'. This     update corrects these file names. For example, the     aforementioned file is now correctly named     '/lib/firmware/rtl_nic/rtl8168d-1.fw'.

  - This update blacklists the ADMA428M revision of the 2GB     ATA Flash Disk device. This is due to data corruption     occurring on the said device when the Ultra-DMA 66     transfer mode is used. When the     'libata.force=5:pio0,6:pio0' kernel parameter is set,     the aforementioned device works as expected.

  - On Scientific Linux 6, mounting an NFS export from a     server running Windows Server 2012 Release Candidate     returned the NFS4ERR_MINOR_VERS_MISMATCH error because     Windows Server 2012 Release Candidate supports NFSv4.1     only. Scientific Linux 6 did not properly handle the     returned error and did not fall back to using NFSv3,     which caused the mount operation to fail. With this     update, when the NFS4ERR_MINOR_VERS_MISMATCH error is     returned, the mount operation properly falls back to     using NFSv3 and no longer fails.

  - On ext4 file systems, when fallocate() failed to     allocate blocks due to the ENOSPC condition (no space     left on device) for a file larger than 4 GB, the size of     the file became corrupted and, consequently, caused file     system corruption. This was due to a missing cast     operator in the 'ext4_fallocate()' function. With this     update, the underlying source code has been modified to     address this issue, and file system corruption no longer     occurs.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1601)

An error was found in the Linux kernel's IPv6 netfilter when connection tracking is enabled. A remote attacker could exploit this flaw to crash a system if it is using IPv6 with the nf_contrack_ipv6 kernel module loaded. (CVE-2012-2744).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm() function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the nf_conntrack_ipv6 kernel module loaded, causing it to crash. (CVE-2012-2744, Important)

* A flaw was found in the way the Linux kernel's key management facility handled replacement session keyrings on process forks. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-2745, Moderate)

Red Hat would like to thank an anonymous contributor working with the Beyond Security SecuriTeam Secure Disclosure program for reporting CVE-2012-2744.

This update also fixes the following bugs :

* Previously introduced firmware files required for new Realtek chipsets contained an invalid prefix ('rtl_nic_') in the file names, for example '/lib/firmware/rtl_nic/rtl_nic_rtl8168d-1.fw'. This update corrects these file names. For example, the aforementioned file is now correctly named '/lib/firmware/rtl_nic/rtl8168d-1.fw'. (BZ#832359)

* This update blacklists the ADMA428M revision of the 2GB ATA Flash Disk device. This is due to data corruption occurring on the said device when the Ultra-DMA 66 transfer mode is used. When the 'libata.force=5:pio0,6:pio0' kernel parameter is set, the aforementioned device works as expected. (BZ#832363)

* On Red Hat Enterprise Linux 6, mounting an NFS export from a Windows 2012 server failed due to the fact that the Windows server contains support for the minor version 1 (v4.1) of the NFS version 4 protocol only, along with support for versions 2 and 3. The lack of the minor version 0 (v4.0) support caused Red Hat Enterprise Linux 6 clients to fail instead of rolling back to version 3 as expected. This update fixes this bug and mounting an NFS export works as expected.
(BZ#832365)

* On ext4 file systems, when fallocate() failed to allocate blocks due to the ENOSPC condition (no space left on device) for a file larger than 4 GB, the size of the file became corrupted and, consequently, caused file system corruption. This was due to a missing cast operator in the 'ext4_fallocate()' function. With this update, the underlying source code has been modified to address this issue, and file system corruption no longer occurs. (BZ#833034)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-1064.

ID	Name	Product	Family	Severity
125587	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1635)	Nessus	Huawei Local Security Checks	high
83563	SUSE SLED10 / SLES10 Security Update : kernel (SUSE-SU-2012:1391-1)	Nessus	SuSE Local Security Checks	high
68575	Oracle Linux 6 : kernel (ELSA-2012-1064)	Nessus	Oracle Linux Local Security Checks	high
64051	RHEL 6 : kernel (RHSA-2012:1148)	Nessus	Red Hat Local Security Checks	high
64050	RHEL 6 : kernel (RHSA-2012:1129)	Nessus	Red Hat Local Security Checks	high
64049	RHEL 6 : kernel (RHSA-2012:1114)	Nessus	Red Hat Local Security Checks	high
62676	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 8325)	Nessus	SuSE Local Security Checks	high
62675	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 8324)	Nessus	SuSE Local Security Checks	high
61361	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120710)	Nessus	Scientific Linux Local Security Checks	high
59985	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1507-1)	Nessus	Ubuntu Local Security Checks	high
59949	CentOS 6 : kernel (CESA-2012:1064)	Nessus	CentOS Local Security Checks	high
59947	RHEL 6 : kernel (RHSA-2012:1064)	Nessus	Red Hat Local Security Checks	high
801523	CentOS RHSA-2012-1064 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-2744

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high