Security Fix(es) :

  - An integer overflow vulnerability in     ip6_find_1stfragopt() function was found. A local     attacker that has privileges (of CAP_NET_RAW) to open     raw socket can cause an infinite loop inside the     ip6_find_1stfragopt() function. (CVE-2017-7542,     Moderate)

  - The IPv6 fragmentation implementation in the Linux     kernel does not consider that the nexthdr field may be     associated with an invalid option, which allows local     users to cause a denial of service (out-of-bounds read     and BUG) or possibly have unspecified other impact via     crafted socket and send system calls. Due to the nature     of the flaw, privilege escalation cannot be fully ruled     out, although we believe it is unlikely. (CVE-2017-9074,     Moderate)

  - A use-after-free flaw was found in the Netlink     functionality of the Linux kernel networking subsystem.
    Due to the insufficient cleanup in the mq_notify     function, a local attacker could potentially use this     flaw to escalate their privileges on the system.
    (CVE-2017-11176, Moderate)

Bug Fix(es) :

  - Previously, the default timeout and retry settings in     the VMBus driver were insufficient in some cases, for     example when a Hyper-V host was under a significant     load. Consequently, in Windows Server 2016, Hyper-V     Server 2016, and Windows Azure Platform, when running a     Scientific Linux Guest on the Hyper-V hypervisor, the     guest failed to boot or booted with certain Hyper-V     devices missing. This update alters the timeout and     retry settings in VMBus, and Scientific Linux guests now     boot as expected under the described conditions.

  - Previously, an incorrect external declaration in the     be2iscsi driver caused a kernel panic when using the     systool utility. With this update, the external     declaration in be2iscsi has been fixed, and the kernel     no longer panics when using systool.

  - Under high usage of the NFSD file system and memory     pressure, if many tasks in the Linux kernel attempted to     obtain the global spinlock to clean the Duplicate Reply     Cache (DRC), these tasks stayed in an active wait in the     nfsd_reply_cache_shrink() function for up to 99% of     time. Consequently, a high load average occurred. This     update fixes the bug by separating the DRC in several     parts, each with an independent spinlock. As a result,     the load and CPU utilization is no longer excessive     under the described circumstances.

  - When attempting to attach multiple SCSI devices     simultaneously, Scientific Linux 6.9 on IBM z Systems     sometimes became unresponsive. This update fixes the     zfcp device driver, and attaching multiple SCSI devices     simultaneously now works as expected in the described     scenario.

  - On IBM z Systems, the tiqdio_call_inq_handlers()     function in the Linux kernel incorrectly cleared the     device state change indicator (DSCI) for the af_iucv     devices using the HiperSockets transport with multiple     input queues. Consequently, queue stalls on such devices     occasionally occurred. With this update,     tiqdio_call_inq_handlers() has been fixed to clear the     DSCI only once, prior to scanning the queues. As a     result, queue stalls for af_iucv devices using the     HiperSockets transport no longer occur under the     described circumstances.

  - Previously, small data chunks caused the Stream Control     Transmission Protocol (SCTP) to account the     receiver_window (rwnd) values incorrectly when     recovering from a 'zero-window situation'. As a     consequence, window updates were not sent to the peer,     and an artificial growth of rwnd could lead to packet     drops. This update properly accounts such small data     chunks and ignores the rwnd pressure values when     reopening a window. As a result, window updates are now     sent, and the announced rwnd reflects better the real     state of the receive buffer.

Detections

Analytics

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180125)

high Nessus Plugin ID 106369

Version 3.8