Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount symlinks, which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW. (CVE-2010-1088)

The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. (CVE-2009-3228)

The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel node set. (CVE-2010-0415)

The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls. (CVE-2009-3620)

The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space. (CVE-2010-0622)

The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
(CVE-2009-2287)

The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level (CPL) before accessing a debug register, which allows guest OS users to cause a denial of service (trap) on the host OS via a crafted application. (CVE-2009-3722)

The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal. (CVE-2009-4308)

The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.
(CVE-2009-2846)

Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.
(CVE-2010-2521)

mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643. (CVE-2008-7256)

The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.
(CVE-2010-1162)

mm/shmem.c in the Linux kernel before 2.6.28-rc3, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. (CVE-2010-1643)

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. (CVE-2010-1173)

The Transparent Inter-Process Communication (TIPC) functionality in Linux kernel 2.6.16-rc1 through 2.6.33, and possibly other versions, allows local users to cause a denial of service (kernel OOPS) by sending datagrams through AF_TIPC before entering network mode, which triggers a NULL pointer dereference. (CVE-2010-1187)

The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. (CVE-2010-1173)

fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions. (CVE-2010-2248)

Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
(CVE-2010-2492)

The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.
(CVE-2010-2226)

The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c. (CVE-2010-2798)

The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server. (CVE-2010-2240)

The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount. (CVE-2010-2803)

Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic. (CVE-2010-2959)

Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device. (CVE-2010-3080)

A vulnerability in Linux kernel caused by insecure allocation of user space memory when translating system call inputs to 64-bit. A stack pointer underflow can occur when using the compat_alloc_user_space method with an arbitrary length input. (CVE-2010-3081)

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression. (CVE-2010-3301)

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

a. Service Console OS update for COS kernel

   This patch updates the service console kernel to fix multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0415, CVE-2010-0307,    CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1437, and    CVE-2010-1088 to these issues.

b. Likewise package updates

   Updates to the likewisekrb5, likewiseopenldap, likewiseopen,    and pamkrb5 packages address several security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-0844, CVE-2009-0845,    CVE-2009-0846, CVE-2009-4212, and CVE-2010-1321 to these issues.

NOTE: This kernel update marks the final planned kernel security update for the 2.6.24 kernel in the Debian release 'etch'. Although security support for 'etch' officially ended on Feburary 15th, 2010, this update was already in preparation before that date.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2691     Steve Beattie and Kees Cook reported an information leak     in the maps and smaps files available under /proc. Local     users may be able to read this data for setuid processes     while the ELF binary is being loaded.

  - CVE-2009-2695     Eric Paris provided several fixes to increase the     protection provided by the mmap_min_addr tunable against     NULL pointer dereference vulnerabilities.

  - CVE-2009-3080     Dave Jones reported an issue in the gdth SCSI driver. A     missing check for negative offsets in an ioctl call     could be exploited by local users to create a denial of     service or potentially gain elevated privileges.

  - CVE-2009-3726     Trond Myklebust reported an issue where a malicious NFS     server could cause a denial of service condition on its     clients by returning incorrect attributes during an open     call.

  - CVE-2009-3889     Joe Malicki discovered an issue in the megaraid_sas     driver. Insufficient permissions on the sysfs dbg_lvl     interface allow local users to modify the debug logging     behavior.

  - CVE-2009-4005     Roel Kluin discovered an issue in the hfc_usb driver, an     ISDN driver for Colognechip HFC-S USB chip. A potential     read overflow exists which may allow remote users to     cause a denial of service condition (oops).

  - CVE-2009-4020     Amerigo Wang discovered an issue in the HFS filesystem     that would allow a denial of service by a local user who     has sufficient privileges to mount a specially crafted     filesystem.

  - CVE-2009-4021     Anana V. Avati discovered an issue in the fuse     subsystem. If the system is sufficiently low on memory,     a local user can cause the kernel to dereference an     invalid pointer resulting in a denial of service (oops)     and potentially an escalation of privileges.

  - CVE-2009-4138     Jay Fenlason discovered an issue in the firewire stack     that allows local users to cause a denial of service     (oops or crash) by making a specially crafted ioctl     call.

  - CVE-2009-4308     Ted Ts'o discovered an issue in the ext4 filesystem that     allows local users to cause a denial of service (NULL     pointer dereference). For this to be exploitable, the     local user must have sufficient privileges to mount a     filesystem.

  - CVE-2009-4536 CVE-2009-4538     Fabian Yamaguchi reported issues in the e1000 and e1000e     drivers for Intel gigabit network adapters which allow     remote users to bypass packet filters using specially     crafted Ethernet frames.

  - CVE-2010-0003     Andi Kleen reported a defect which allows local users to     gain read access to memory reachable by the kernel when     the print-fatal-signals option is enabled. This option     is disabled by default.

  - CVE-2010-0007     Florian Westphal reported a lack of capability checking     in the ebtables netfilter subsystem. If the ebtables     module is loaded, local users can add and modify     ebtables rules.

  - CVE-2010-0291     Al Viro reported several issues with the mmap/mremap     system calls that allow local users to cause a denial of     service (system panic) or obtain elevated privileges.

  - CVE-2010-0410     Sebastian Krahmer discovered an issue in the netlink     connector subsystem that permits local users to allocate     large amounts of system memory resulting in a denial of     service (out of memory).

  - CVE-2010-0415     Ramon de Carvalho Valle discovered an issue in the     sys_move_pages interface, limited to amd64, ia64 and     powerpc64 flavors in Debian. Local users can exploit     this issue to cause a denial of service (system crash)     or gain access to sensitive kernel memory.

  - CVE-2010-0622     Jerome Marchand reported an issue in the futex subsystem     that allows a local user to force an invalid futex state     which results in a denial of service (oops).

Security fixes :

  - a NULL pointer dereference flaw was found in the     sctp_rcv_ootb() function in the Linux kernel Stream     Control Transmission Protocol (SCTP) implementation. A     remote attacker could send a specially crafted SCTP     packet to a target system, resulting in a denial of     service. (CVE-2010-0008, Important)

  - a missing boundary check was found in the     do_move_pages() function in the memory migration     functionality in the Linux kernel. A local user could     use this flaw to cause a local denial of service or an     information leak. (CVE-2010-0415, Important)

  - a NULL pointer dereference flaw was found in the     ip6_dst_lookup_tail() function in the Linux kernel. An     attacker on the local network could trigger this flaw by     sending IPv6 traffic to a target system, leading to a     system crash (kernel OOPS) if dst->neighbour is NULL on     the target system when receiving an IPv6 packet.
    (CVE-2010-0437, Important)

  - a NULL pointer dereference flaw was found in the ext4     file system code in the Linux kernel. A local attacker     could use this flaw to trigger a local denial of service     by mounting a specially crafted, journal-less ext4 file     system, if that file system forced an EROFS error.
    (CVE-2009-4308, Moderate)

  - an information leak was found in the     print_fatal_signal() implementation in the Linux kernel.
    When '/proc/sys/kernel/print-fatal-signals' is set to 1     (the default value is 0), memory that is reachable by     the kernel could be leaked to user-space. This issue     could also result in a system crash. Note that this flaw     only affected the i386 architecture. (CVE-2010-0003,     Moderate)

  - missing capability checks were found in the ebtables     implementation, used for creating an Ethernet bridge     firewall. This could allow a local, unprivileged user to     bypass intended capability restrictions and modify     ebtables rules. (CVE-2010-0007, Low)

Bug fixes :

  - a bug prevented Wake on LAN (WoL) being enabled on     certain Intel hardware. (BZ#543449)

  - a race issue in the Journaling Block Device. (BZ#553132)

  - programs compiled on x86, and that also call     sched_rr_get_interval(), were silently corrupted when     run on 64-bit systems. (BZ#557684)

  - the RHSA-2010:0019 update introduced a regression,     preventing WoL from working for network devices using     the e1000e driver. (BZ#559335)

  - adding a bonding interface in mode balance-alb to a     bridge was not functional. (BZ#560588)

  - some KVM (Kernel-based Virtual Machine) guests     experienced slow performance (and possibly a crash)     after suspend/resume. (BZ#560640)

  - on some systems, VF cannot be enabled in dom0.
    (BZ#560665)

  - on systems with certain network cards, a system crash     occurred after enabling GRO. (BZ#561417)

  - for x86 KVM guests with pvclock enabled, the boot clocks     were registered twice, possibly causing KVM to write     data to a random memory area during the guest's life.
    (BZ#561454)

  - serious performance degradation for 32-bit applications,     that map (mmap) thousands of small files, when run on a     64-bit system. (BZ#562746)

  - improved kexec/kdump handling. Previously, on some     systems under heavy load, kexec/kdump was not     functional. (BZ#562772)

  - dom0 was unable to boot when using the Xen hypervisor on     a system with a large number of logical CPUs.
    (BZ#562777)

  - a fix for a bug that could potentially cause file system     corruption. (BZ#564281)

  - a bug caused infrequent cluster issues for users of     GFS2. (BZ#564288)

  - gfs2_delete_inode failed on read-only file systems.
    (BZ#564290)

The system must be rebooted for this update to take effect.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel :

The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions. (CVE-2010-0727)

The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set. (CVE-2010-0415)

drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537. (CVE-2009-4538)

The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function. (CVE-2010-0307)

Aditionally, it was added support for some backlight models used in Samsung laptops and fixes to detect Saitek X52 joysticks.

To update your kernel, please follow the directions located at :

http://www.mandriva.com/en/security/kernelupdate

The openSUSE 11.1 Kernel was updated to 2.6.27.42 fixing various bugs and security issues.

CVE-2010-0622: The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space.

CVE-2010-0307: The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function.

CVE-2010-0410: Users could send/allocate arbitrary amounts of NETLINK_CONNECTOR messages to the kernel, causing OOM condition, killing selected processes or halting the system.

CVE-2010-0415: The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set.

CVE-2010-0007: net/bridge/netfilter/ebtables.c in the ebtables module in the netfilter framework in the Linux kernel before 2.6.33-rc4 does not require the CAP_NET_ADMIN capability for setting or modifying rules, which allows local users to bypass intended access restrictions and configure arbitrary network-traffic filtering via a modified ebtables application.

CVE-2009-4536: drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload.

CVE-2009-4538: drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets.

CVE-2010-0003: The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address.

CVE-2009-3939: The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

The openSUSE 11.0 kernel was updated to fix following security issues :

CVE-2009-4020: Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to have an unspecified impact via a crafted Hierarchical File System (HFS) filesystem, related to the hfs_readdir function in fs/hfs/dir.c.

CVE-2010-0307: The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function.

CVE-2010-0622: The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space.

CVE-2010-0410: drivers/connector/connector.c in the Linux kernel before 2.6.32.8 allows local users to cause a denial of service (memory consumption and system crash) by sending the kernel many NETLINK_CONNECTOR messages.

CVE-2010-0415: The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-166:02 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2009-4308     The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32     allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and     possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.
    CVE-2010-0003     The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386     platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary     memory locations by jumping to an address and then reading a log file, and might allow local users to     cause a denial of service (system slowdown or crash) by jumping to an address.
    CVE-2010-0007     net/bridge/netfilter/ebtables.c in the ebtables module in the netfilter framework in the Linux kernel     before 2.6.33-rc4 does not require the CAP_NET_ADMIN capability for setting or modifying rules, which     allows local users to bypass intended access restrictions and configure arbitrary network-traffic     filtering via a modified ebtables application.
    CVE-2010-0008     The SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of     service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.
    CVE-2010-0415     The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node     values, which allows local users to read arbitrary kernel memory locations, cause a denial of service     (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's     node set.
    CVE-2010-0437     The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not     properly handle certain circumstances involving an IPv6 TUN network interface and a large number of     neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or     possibly have unspecified other impact via unknown vectors.
    CVE-2009-4536     drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles     Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete     frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload.
    NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
    CVE-2009-4537     drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check     the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of     service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets     containing A characters and certain packets containing E characters; or (2) cause a denial of service     (system crash) via a packet with a crafted size, in conjunction with certain packets containing '0'     characters, related to the value of the status register and erroneous behavior associated with the     RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security bugs: CVE-2010-0410 CVE-2010-0415 #563091 Also fixes: xfs:
xfs_swap_extents needs to handle dynamic fork offsets (F12#510823) Possible system lockups caused by the fix for bug #559100 in the previous updates.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
49795	Mandriva Linux Security Advisory : kernel (MDVSA-2010:198)	Nessus	Mandriva Local Security Checks	10/8/2010	1/6/2021	critical
50611	VMSA-2010-0016 : VMware ESXi and ESX third-party updates for Service Console and Likewise components	Nessus	VMware ESX Local Security Checks	11/16/2010	1/6/2021	critical
44951	Debian DSA-2005-1 : linux-2.6.24 - privilege escalation/denial of service/sensitive memory leak	Nessus	Debian Local Security Checks	3/2/2010	1/4/2021	critical
60749	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	2/14/2011	5/25/2022	high
48176	Mandriva Linux Security Advisory : kernel (MDVSA-2010:066)	Nessus	Mandriva Local Security Checks	7/30/2010	1/6/2021	critical
44964	openSUSE Security Update : kernel (kernel-2050)	Nessus	SuSE Local Security Checks	3/3/2010	1/14/2021	critical
45010	openSUSE Security Update : kernel (kernel-2089)	Nessus	SuSE Local Security Checks	3/9/2010	1/14/2021	high
291397	MiracleLinux 3 : kernel-2.6.18-128.15.AXS3 (AXSA:2010-166:02)	Nessus	Miracle Linux Local Security Checks	1/19/2026	2/5/2026	high
47271	Fedora 11 : kernel-2.6.30.10-105.2.23.fc11 (2010-1804)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	medium

Detections

Analytics

Plugins Search

critical

critical

critical

high

high

critical

critical

high

high

medium