Scientific Linux Security Update : kernel on SL5.x i386/x86_64
medium Nessus Plugin ID 60886
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 4.4
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
This update fixes the following security issues :- A NULL pointer dereference flaw was found in the io_submit_one() function in the Linux kernel asynchronous I/O implementation. A local, unprivileged user could use this flaw to cause a denial of service.
(CVE-2010-3066, Moderate)
- A flaw was found in the xfs_ioc_fsgetxattr() function in the Linux kernel XFS file system implementation. A data structure in xfs_ioc_fsgetxattr() was not initialized properly before being copied to user-space. A local, unprivileged user could use this flaw to cause an information leak. (CVE-2010-3078, Moderate)
- The exception fixup code for the __futex_atomic_op1,
__futex_atomic_op2, and futex_atomic_cmpxchg_inatomic() macros replaced the LOCK prefix with a NOP instruction.
A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2010-3086, Moderate)
- A flaw was found in the tcf_act_police_dump() function in the Linux kernel network traffic policing implementation. A data structure in tcf_act_police_dump() was not initialized properly before being copied to user-space. A local, unprivileged user could use this flaw to cause an information leak.
(CVE-2010-3477, Moderate)
- A missing upper bound integer check was found in the sys_io_submit() function in the Linux kernel asynchronous I/O implementation. A local, unprivileged user could use this flaw to cause an information leak.
(CVE-2010-3067, Low)
This update also fixes several bugs.
The system must be rebooted for this update to take effect.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 60886
File Name: sl_20101109_kernel_on_SL5_x.nasl
Version: 1.5
Type: local
Agent: unix
Published: 8/1/2012
Updated: 1/14/2021
Dependencies: ssh_get_info.nasl
Risk Information
Risk Factor: Medium
VPR Score: 4.4
CVSS v2.0
Base Score: 4.9
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Vulnerability Information
CPE: x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 11/9/2010
Reference Information
CVE: CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3477