Scientific Linux Security Update : kernel on SL6.x i386/x86_64

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

- It was found that the fix for CVE-2015-1805 incorrectly
kept buffer offset and buffer length in sync on a failed
atomic read, potentially resulting in a pipe buffer
state corruption. A local, unprivileged user could use
this flaw to crash the system or leak kernel memory to
user space. (CVE-2016-0774, Moderate)

This update also fixes the following bugs :

- In the anon_vma structure, the degree counts number of
child anon_vmas and of VMAs which points to this
anon_vma. Failure to decrement the parent's degree in
the unlink_anon_vma() function, when its list was empty,
previously triggered a BUG_ON() assertion. The provided
patch makes sure the anon_vma degree is always
decremented when the VMA list is empty, thus fixing this
bug.

- When running Internet Protocol Security (IPSEC) on
external storage encrypted with LUKS under a substantial
load on the system, data corruptions could previously
occur. A set of upstream patches has been provided, and
data corruption is no longer reported in this situation.

- Due to prematurely decremented calc_load_task, the
calculated load average was off by up to the number of
CPUs in the machine. As a consequence, job scheduling
worked improperly causing a drop in the system
performance. This update keeps the delta of the CPU
going into NO_HZ idle separately, and folds the pending
idle delta into the global active count while correctly
aging the averages for the idle-duration when leaving
NO_HZ mode. Now, job scheduling works correctly,
ensuring balanced CPU load.

- Due to a regression in the Scientific Linux 6.7 kernel,
the cgroup OOM notifier accessed a cgroup-specific
internal data structure without a proper locking
protection, which led to a kernel panic. This update
adjusts the cgroup OOM notifier to lock internal data
properly, thus fixing the bug.

- GFS2 had a rare timing window that sometimes caused it
to reference an uninitialized variable. Consequently, a
kernel panic occurred. The code has been changed to
reference the correct value during this timing window,
and the kernel no longer panics.

- Due to a race condition whereby a cache operation could
be submitted after a cache object was killed, the kernel
occasionally crashed on systems running the cachefilesd
service. The provided patch prevents the race condition
by adding serialization in the code that makes the
object unavailable. As a result, all subsequent
operations targetted on the object are rejected and the
kernel no longer crashes in this scenario.

This update also adds this enhancement :

- The lpfc driver has been updated to version 11.0.0.4.

The system must be rebooted for this update to take effect.

See also :

http://www.nessus.org/u?c5cd6910

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
Public Exploit Available : true

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 90144 ()

Bugtraq ID:

CVE ID: CVE-2015-1805
CVE-2016-0774

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now