The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.

The Linux kernel was updated to fix various bugs and security issues :

CVE-2013-0871: Race condition in the ptrace functionality in the Linux kernel allowed local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.

CVE-2013-0160: Avoid a side channel attack on /dev/ptmx (keyboard input timing).

CVE-2012-5374: Fixed a local denial of service in the BTRFS hashing code.

CVE-2013-0309: arch/x86/include/asm/pgtable.h in the Linux kernel, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.

CVE-2013-0268: The msr_open function in arch/x86/kernel/msr.c in the Linux kernel allowed local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.

CVE-2012-0957: The override_release function in kernel/sys.c in the Linux kernel allowed local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.

CVE-2013-0216: The Xen netback functionality in the Linux kernel allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.

CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages.
NOTE: some of these details are obtained from third-party information.

CVE-2012-4530: The load_script function in fs/binfmt_script.c in the Linux kernel did not properly handle recursion, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application.

CVE-2012-4508: Race condition in fs/ext4/extents.c in the Linux kernel allowed local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.

CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver in the Linux kernel allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.

CVE-2012-2745: The copy_creds function in kernel/cred.c in the Linux kernel provided an invalid replacement session keyring to a child process, which allowed local users to cause a denial of service (panic) via a crafted application that uses the fork system call.

CVE-2012-3375: The epoll_ctl system call in fs/eventpoll.c in the Linux kernel did not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allowed local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency.

CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2026 advisory.

  - The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of     epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a     crafted application that makes epoll_create and epoll_ctl system calls. (CVE-2011-1083)

  - The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement     session keyring to a child process, which allows local users to cause a denial of service (panic) via a     crafted application that uses the fork system call. (CVE-2012-2745)

  - The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle     ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-     descriptor consumption and system crash) via a crafted application that attempts to create a circular     epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.
    (CVE-2012-3375)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

* CVE-2012-2745: Denial-of-service in kernel key management.

A potential double-free of the replacement session keyring on fork() could result in a denial-of-service by a local, unprivileged user.


* CVE-2011-1083: Algorithmic denial of service in epoll.

A flaw was found in the way the Linux kernel's Event Poll (epoll) subsystem handled large, nested epoll structures. A local, unprivileged user could use this flaw to cause a denial of service.



[2.6.39-200.29.2.el5uek]
- epoll: clear the tfile_check_list on -ELOOP (Joe Jin) {CVE-2012-3375}
- Don't limit non-nested epoll paths (Jason Baron)
- epoll: kabi fixups for epoll limit wakeup paths (Joe Jin) {CVE-2011-1083}
- epoll: limit paths (Jason Baron)  {CVE-2011-1083}
- cred: copy_process() should clear child->replacement_session_keyring (Oleg    Nesterov)  {CVE-2012-2745}

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1064 advisory.

  - net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6     module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and     system crash) via certain types of fragmented IPv6 packets. (CVE-2012-2744)

  - The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement     session keyring to a child process, which allows local users to cause a denial of service (panic) via a     crafted application that uses the fork system call. (CVE-2012-2745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP2 kernel was updated to 3.0.42 which fixes various bugs and security issues.

The following security issues have been fixed :

  - A denial of service in key management was fixed. (This     was fixed in 3.0.28 already, but is listed here.) Some     more security and bug fixes might already be part of the     3.0.42 stable kernel release which is included here.
    (CVE-2012-2745)

The following non security issues have been fixed :

BTRFS :

  - btrfs: allow setting NOCOW for a zero sized file via     ioctl

  - btrfs: fix a bug of per-file nocow

  - btrfs: fix the missing error information in     create_pending_snapshot()

  - btrfs: fix off-by-one in file clone

  - btrfs: move transaction aborts to the point of failure

  - btrfs: fix unnecessary warning when the fragments make     the space alloc fail

  - btrfs: return EPERM upon rmdir on a subvolume

  - btrfs: cleanup for duplicated code in find_free_extent

  - btrfs: cleanup fs_info->hashers

  - btrfs: use vfree instead of kfree

  - btrfs: fix error path in create_pending_snapshot()

  - btrfs: fix file extent discount problem in the, snapshot

  - btrfs: fix full backref problem when inserting shared     block reference

  - btrfs: fix wrong size for the reservation of the,     snapshot creation

  - btrfs: fix error handling in delete_block_group_cache()

  - btrfs: polish names of kmem caches

  - btrfs: update last trans if we do not update the inode

  - btrfs: fix possible corruption when fsyncing written     prealloced extents

  - btrfs: set journal_info in async trans commit worker

  - btrfs: fix a bug in parsing return value in logical     resolve

  - btrfs: use helper for logical resolve

  - btrfs: use larger limit for translation of logical to     inode

  - btrfs: use a slab for ordered extents allocation

  - btrfs: fix unprotected ->log_batch

  - btrfs: output more information when aborting a unused     transaction handle

  - btrfs: fix wrong size for the reservation when doing,     file pre-allocation

  - btrfs: cleanup for unused ref cache stuff

  - btrfs: fix a misplaced address operator in a condition

  - btrfs: fix that error value is changed by mistake

  - btrfs: fix second lock in btrfs_delete_delayed_items()

  - btrfs: increase the size of the free space cache

  - btrfs: fix enospc problems when deleting a subvol

  - btrfs: fix wrong mtime and ctime when creating snapshots

  - btrfs: fix race in run_clustered_refs S/390 :

  - zfcp: remove invalid reference to list iterator     variable. (bnc#779461)

  - zfcp: Make trace record tags unique     (bnc#780012,LTC#84941).

  - zfcp: Do not wakeup while suspended     (bnc#780012,LTC#84816).

  - zfcp: restore refcount check on port_remove     (bnc#780012,LTC#84942).

  - zfcp: No automatic port_rescan on events     (bnc#780012,LTC#84817).

  - dasd: System hang after all channel were lost     (bnc#780012,LTC#85025).

  - Added patches.arch/s390-54-01-hypfs-missing-files.patch     to series.conf. (bnc#769407)

  - dasd: set and unset TIMEOUT flag automatically.
    (bnc#768084)

  - kernel: incorrect task size after fork of a 31 bit     process (bnc#772407,LTC#83674).

  - patches.arch/s390-55-03-crst-table-downgrade.patch:
    Deleted due to 31bit compile error. ALSA :

  - ALSA: hda - Add mic-mute LED control for HP laptop.
    (bnc#779330)

  - ALSA: hda - Add 3stack-automute model to AD1882 codec     (bnc#775373). Wireless :

  - rt2x00: Remove incorrect led blink. (bnc#774902)

  - Revert 'rt2x00: handle spurious pci interrupts'.
    (bnc#774902)

  - rt2x00: Mark active channels survey data as 'in use'.
    (bnc#774902)

  - rt2x00: Convert big if-statements to switch-statements.
    (bnc#774902)

  - rt2800: zero MAC_SYS_CTRL bits during BBP and MAC reset.
    (bnc#774902)

  - rt2800lib: fix wrong -128dBm when signal is stronger     than -12dBm. (bnc#774902)

  - rt2800: document RF_R03 register bits [7:4].
    (bnc#774902)

  - rt2x00: Introduce concept of driver data in struct     rt2x00_dev. (bnc#774902)

  - rt2x00: Use struct rt2x00_dev driver data in     rt2800{pci,usb}. (bnc#774902)

  - rt2x00: fix a possible NULL pointer dereference.
    (bnc#774902)

  - rt2x00:Add VCO recalibration. (bnc#774902)

  - rt2x00:Add RT5372 chipset support. (bnc#774902)

  - rt2x00: Set IEEE80211_HW_REPORTS_TX_ACK_STATUS in     rt2800. (bnc#774902)

  - rt2800: introduce wpdma_disable function. (bnc#774902)

  - rt2800: initialize queues before giving up due to DMA     error. (bnc#774902)

  - rt2800: zero registers of unused TX rings. (bnc#774902)

  - wireless: rt2x00: rt2800pci add more RT539x ids.
    (bnc#774902)

  - rt2x00:Add RT5392 chipset support. (bnc#774902)

  -     patches.fixes/0012-rt2x00-Add-RT5372-chipset-support.pat     ch: Fix typo.

  - rt2800: Add documentation on MCU requests. (bnc#744198)

  - rt2800pci: Fix 'Error - MCU request failed' during     initialization. (bnc#744198) Packaging :

  - rpm/kernel-binary.spec.in: Temporarily disable icecream     builds until miscompilation is resolved. (bnc#763954 /     bnc#773831)

  - rpm/kernel-binary.spec.in: add Conflicts for older     hyper-v hv_kvp_daemon (bnc#770763) the kernel-user     interface changed, old binaries will busyloop with newer     kernel

  - rpm/kernel-binary.spec.in: Do not run debugedit -i, use     eu-unstrip to retrieve the build-id instead.
    (bnc#768504)

  - rpm/kernel-binary.spec.in: Fix Obsoletes: tag for the     SLE11-SP1 realtek-r8192ce_pci-kmp package. Misc

  - patches.suse/no-partition-scan: Implement     'no_partition_scan' commandline option (FATE#303697).

  - vfs: dcache: use DCACHE_DENTRY_KILLED instead of     DCACHE_DISCONNECTED in d_kill(). (bnc#779699)

  - igb: convert to ndo_fix_features. (bnc#777269)

  - igb: do vlan cleanup. (bnc#777269)

  - tcp: flush DMA queue before sk_wait_data if rcv_wnd is     zero. (bnc#777024)

  - drm: Export drm_probe_ddc(). (bnc#780461)

  - drm/dp: Update DPCD defines. (bnc#780461)

  - drm/i915/dp: Be smarter about connection sense for     branch devices. (bnc#780461)

  - drm/i915/dp: Fetch downstream port info if needed during     DPCD fetch. (bnc#780461)

  - md: fix so that GET_ARRAY_INFO and GET_DISK_INFO fail     correctly when array has not 'raid_disks' count yet.

  - sched: Fix ancient race in do_exit(). (bnc#781018)

  - sched: fix divide by zero in thread_group/task_times().
    (bnc#761774)

  - sched: fix migration thread runtime bogosity.
    (bnc#773688, bnc#769251)

  - megaraid_sas: boot hangs up while LD is offline issue.
    (bnc#698102)

  - memcg: warn on deeper hierarchies with use_hierarchy==0.
    (bnc#781134)

  - scsi_dh_alua: Retry the check-condition in case Mode     Parameters Changed. (bnc#772473)

  - scsi: update scsi.h with SYNCHRONIZE_CACHE_16     (FATE#313550,bnc#769195).

  - sd: Reshuffle init_sd to avoid crash. (bnc#776787)

  - st: remove st_mutex. (bnc#773007)

  - cifs: Assume passwords are encoded according to     iocharset (try #2). (bnc#731035)

  - drm/fb-helper: delay hotplug handling when partially     bound. (bnc#778822)

  - drm/fb helper: do not call drm_crtc_helper_set_config.
    (bnc#778822)

  - patches.drivers/drm-Skip-too-big-EDID-extensions:
    Delete. Fixed in firmware, so no longer needed.
    (bnc#764900)

  - drm/i915: Fix backlight control for systems which have     bl polarity reversed. (bnc#766156)

  - patches.kernel.org/patch-3.0.27-28: Update references.
    (bnc#770695 / CVE-2012-2745)

  - xen/x86-64: fix hypercall page unwind info.

  - patches.xen/xen3-patch-3.0.40-41: Linux 3.0.41.

  - Refresh other Xen patches. (bnc#776019)

  - e1000e: clear REQ and GNT in EECD (82571 &amp;&amp;
    82572). (bnc#762099)

  - bonding: add some slack to arp monitoring time limits.
    (bnc#776095)

  - patches.arch/x2apic_opt_out.patch: Refresh. (bnc#778082)

  - x86, mce: Do not call del_timer_sync() in IRQ context.
    (bnc#776896)

  - cpufreq / ACPI: Fix not loading acpi-cpufreq driver     regression. (bnc#766654)

  - ida: Update references. (bnc#740291)

  - audit: do not free_chunk() after fsnotify_add_mark().
    (bnc#762214)

  - audit: fix refcounting in audit-tree. (bnc#762214)

  - mlx4_en: map entire pages to increase throughput.

  - usb: Add support for root hub port status CAS.
    (bnc#774289)

  - fs,reiserfs: unlock superblock before calling     reiserfs_quota_on_mount(). (bnc#772786)

  - reiserfs: fix deadlock with nfs racing on create/lookup.
    (bnc#762693)

  - NFS: Slow down state manager after an unhandled error.
    (bnc#774973)

  - nfs: increase number of permitted callback connections.
    (bnc#771706)

  - Freezer / sunrpc / NFS: do not allow TASK_KILLABLE     sleeps to block the freezer. (bnc#775182)

  - powerpc/pseries: Support lower minimum entitlement for     virtual processors. (bnc#775984)

  - powerpc: Disable /dev/port interface on systems without     an ISA bridge. (bnc#754670)

  - ocfs2: Add a missing journal credit in     ocfs2_link_credits() -v2. (bnc#773320)

  - block: do not artificially constrain max_sectors for     stacking drivers. (bnc#774073)

  - bnx2x: Clear MDC/MDIO warning message. (bnc#769035)

  - bnx2x: Fix BCM57810-KR AN speed transition. (bnc#769035)

  - bnx2x: Fix BCM57810-KR FC. (bnc#769035)

  - bnx2x: Fix BCM578x0-SFI pre-emphasis settings.
    (bnc#769035)

  - bnx2x: Fix link issue for BCM8727 boards. (bnc#769035)

  - bnx2x: PFC fix. (bnc#769035)

  - bnx2x: fix checksum validation. (bnc#769035)

  - bnx2x: fix panic when TX ring is full. (bnc#769035)

  - bnx2x: previous driver unload revised. (bnc#769035)

  - bnx2x: remove WARN_ON. (bnc#769035)

  - bnx2x: update driver version. (bnc#769035)

  - xhci: Fix a logical vs bitwise AND bug. (bnc#772427)

  - xhci: Switch PPT ports to EHCI on shutdown. (bnc#772427)

  - xhci: definitions of register definitions to preserve     kABI. (bnc#772427)

  - xhci: Introduce a private switchback method to preserve     kABI. (bnc#772427)

  - config.conf: Drop reference to a s390 vanilla config     that does not exist.

  - block: eliminate potential for infinite loop in     blkdev_issue_discard. (bnc#773319)

  - Fix cosmetic (but worrisome to users) stop class     accounting bug.

  - bluetooth: Another vendor specific ID for BCM20702A0     [0a5c:21f1]. (bnc#774612)

  - memcg: further prevent OOM with too many dirty pages.
    (bnc#763198)

  -     patches.fixes/mm-consider-PageReclaim-for-sync-reclaim.p     atch: Refresh to match the upstream version.

  - tmpfs: optimize clearing when writing (VM Performance).

  - tmpfs: distribute interleave better across nodes.
    (bnc#764209)

  -     patches.fixes/tmpfs-implement-NUMA-node-interleaving.pat     ch: dropped in favor of the upstream patch

A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem handled MSI (Message Signaled Interrupts). A local unprivileged user could exploit this flaw to cause a denial of service or potentially elevate privileges. (CVE-2012-2137)

A flaw was found in how the Linux kernel passed the replacement session keyring to a child process. An unprivileged local user could exploit this flaw to cause a denial of service (panic).
(CVE-2012-2745).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in how the Linux kernel passed the replacement session keyring to a child process. An unprivileged local user could exploit this flaw to cause a denial of service (panic).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in how the Linux kernel passed the replacement session keyring to a child process. An unprivileged local user could exploit this flaw to cause a denial of service (panic).
(CVE-2012-2745)

Ben Hutchings reported a flaw in the Linux kernel with some network drivers that support TSO (TCP segment offload). A local or peer user could exploit this flaw to to cause a denial of service.
(CVE-2012-3412)

Jay Fenlason and Doug Ledford discovered a bug in the Linux kernel implementation of RDS sockets. A local unprivileged user could potentially use this flaw to read privileged information from the kernel. (CVE-2012-3430)

A flaw was discovered in the madvise feature of the Linux kernel's memory subsystem. An unprivileged local use could exploit the flaw to cause a denial of service (crash the system). (CVE-2012-3511).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A NULL pointer dereference flaw was found in the     nf_ct_frag6_reasm() function in the Linux kernel's     netfilter IPv6 connection tracking implementation. A     remote attacker could use this flaw to send specially     crafted packets to a target system that is using IPv6     and also has the nf_conntrack_ipv6 kernel module loaded,     causing it to crash. (CVE-2012-2744, Important)

  - A flaw was found in the way the Linux kernel's key     management facility handled replacement session keyrings     on process forks. A local, unprivileged user could use     this flaw to cause a denial of service. (CVE-2012-2745,     Moderate)

This update also fixes the following bugs :

  - Previously introduced firmware files required for new     Realtek chipsets contained an invalid prefix     ('rtl_nic_') in the file names, for example     '/lib/firmware/rtl_nic/rtl_nic_rtl8168d-1.fw'. This     update corrects these file names. For example, the     aforementioned file is now correctly named     '/lib/firmware/rtl_nic/rtl8168d-1.fw'.

  - This update blacklists the ADMA428M revision of the 2GB     ATA Flash Disk device. This is due to data corruption     occurring on the said device when the Ultra-DMA 66     transfer mode is used. When the     'libata.force=5:pio0,6:pio0' kernel parameter is set,     the aforementioned device works as expected.

  - On Scientific Linux 6, mounting an NFS export from a     server running Windows Server 2012 Release Candidate     returned the NFS4ERR_MINOR_VERS_MISMATCH error because     Windows Server 2012 Release Candidate supports NFSv4.1     only. Scientific Linux 6 did not properly handle the     returned error and did not fall back to using NFSv3,     which caused the mount operation to fail. With this     update, when the NFS4ERR_MINOR_VERS_MISMATCH error is     returned, the mount operation properly falls back to     using NFSv3 and no longer fails.

  - On ext4 file systems, when fallocate() failed to     allocate blocks due to the ENOSPC condition (no space     left on device) for a file larger than 4 GB, the size of     the file became corrupted and, consequently, caused file     system corruption. This was due to a missing cast     operator in the 'ext4_fallocate()' function. With this     update, the underlying source code has been modified to     address this issue, and file system corruption no longer     occurs.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm() function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote attacker could use this flaw to send specially crafted packets to a target system that is using IPv6 and also has the nf_conntrack_ipv6 kernel module loaded, causing it to crash. (CVE-2012-2744, Important)

* A flaw was found in the way the Linux kernel's key management facility handled replacement session keyrings on process forks. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-2745, Moderate)

Red Hat would like to thank an anonymous contributor working with the Beyond Security SecuriTeam Secure Disclosure program for reporting CVE-2012-2744.

This update also fixes the following bugs :

* Previously introduced firmware files required for new Realtek chipsets contained an invalid prefix ('rtl_nic_') in the file names, for example '/lib/firmware/rtl_nic/rtl_nic_rtl8168d-1.fw'. This update corrects these file names. For example, the aforementioned file is now correctly named '/lib/firmware/rtl_nic/rtl8168d-1.fw'. (BZ#832359)

* This update blacklists the ADMA428M revision of the 2GB ATA Flash Disk device. This is due to data corruption occurring on the said device when the Ultra-DMA 66 transfer mode is used. When the 'libata.force=5:pio0,6:pio0' kernel parameter is set, the aforementioned device works as expected. (BZ#832363)

* On Red Hat Enterprise Linux 6, mounting an NFS export from a Windows 2012 server failed due to the fact that the Windows server contains support for the minor version 1 (v4.1) of the NFS version 4 protocol only, along with support for versions 2 and 3. The lack of the minor version 0 (v4.0) support caused Red Hat Enterprise Linux 6 clients to fail instead of rolling back to version 3 as expected. This update fixes this bug and mounting an NFS export works as expected.
(BZ#832365)

* On ext4 file systems, when fallocate() failed to allocate blocks due to the ENOSPC condition (no space left on device) for a file larger than 4 GB, the size of the file became corrupted and, consequently, caused file system corruption. This was due to a missing cast operator in the 'ext4_fallocate()' function. With this update, the underlying source code has been modified to address this issue, and file system corruption no longer occurs. (BZ#833034)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. (CVE-2012-1601)

Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. (CVE-2012-2123)

A flaw was found in how the Linux kernel passed the replacement session keyring to a child process. An unprivileged local user could exploit this flaw to cause a denial of service (panic).
(CVE-2012-2745).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-1064.

ID	Name	Product	Family	Severity
83611	SUSE SLES11 Security Update : kernel (SUSE-SU-2014:0287-1)	Nessus	SuSE Local Security Checks	high
74914	openSUSE Security Update : kernel (openSUSE-SU-2013:0396-1)	Nessus	SuSE Local Security Checks	high
68679	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel Security (ELSA-2012-2026)	Nessus	Oracle Linux Local Security Checks	medium
68678	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2025)	Nessus	Oracle Linux Local Security Checks	medium
68575	Oracle Linux 6 : kernel (ELSA-2012-1064)	Nessus	Oracle Linux Local Security Checks	high
64179	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 6923 / 6926 / 6931)	Nessus	SuSE Local Security Checks	medium
62513	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1606-1)	Nessus	Ubuntu Local Security Checks	medium
62437	Ubuntu 10.04 LTS : linux-ec2 vulnerability (USN-1597-1)	Nessus	Ubuntu Local Security Checks	medium
62211	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1574-1)	Nessus	Ubuntu Local Security Checks	high
62111	Ubuntu 11.04 : linux vulnerabilities (USN-1567-1)	Nessus	Ubuntu Local Security Checks	high
61361	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120710)	Nessus	Scientific Linux Local Security Checks	high
59949	CentOS 6 : kernel (CESA-2012:1064)	Nessus	CentOS Local Security Checks	high
59947	RHEL 6 : kernel (RHSA-2012:1064)	Nessus	Red Hat Local Security Checks	high
59309	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1455-1)	Nessus	Ubuntu Local Security Checks	high
59290	Ubuntu 11.10 : linux vulnerabilities (USN-1452-1)	Nessus	Ubuntu Local Security Checks	high
59226	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1448-1)	Nessus	Ubuntu Local Security Checks	high
801523	CentOS RHSA-2012-1064 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-2745

medium

Tenable Plugins

high

high

medium

medium

high

medium

medium

medium

high

high

high

high

high

high

high

high

high