The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A flaw in the dccp_rcv_state_process() function could     allow a remote attacker to cause a denial of service,     even when the socket was already closed. (CVE-2011-1093,     Important)

  - Multiple buffer overflow flaws were found in the Linux     kernel's Management Module Support for Message Passing     Technology (MPT) based controllers. A local,     unprivileged user could use these flaws to cause a     denial of service, an information leak, or escalate     their privileges. (CVE-2011-1494, CVE-2011-1495,     Important)

  - A missing validation of a null-terminated string data     structure element in the bnep_sock_ioctl() function     could allow a local user to cause an information leak or     a denial of service. (CVE-2011-1079, Moderate)

  - Missing error checking in the way page tables were     handled in the Xen hypervisor implementation could allow     a privileged guest user to cause the host, and the     guests, to lock up. (CVE-2011-1166, Moderate)

  - A flaw was found in the way the Xen hypervisor     implementation checked for the upper boundary when     getting a new event channel port. A privileged guest     user could use this flaw to cause a denial of service or     escalate their privileges. (CVE-2011-1763, Moderate)

  - The start_code and end_code values in '/proc/[pid]/stat'     were not protected. In certain scenarios, this flaw     could be used to defeat Address Space Layout     Randomization (ASLR). (CVE-2011-0726, Low)

  - A missing initialization flaw in the     sco_sock_getsockopt() function could allow a local,     unprivileged user to cause an information leak.
    (CVE-2011-1078, Low)

  - A missing validation of a null-terminated string data     structure element in the do_replace() function could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1080, Low)

  - A buffer overflow flaw in the DEC Alpha OSF partition     implementation in the Linux kernel could allow a local     attacker to cause an information leak by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1163, Low)

  - Missing validations of null-terminated string data     structure elements in the do_replace(),     compat_do_replace(), do_ipt_get_ctl(),     do_ip6t_get_ctl(), and do_arpt_get_ctl() functions could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1170,     CVE-2011-1171, CVE-2011-1172, Low)

  - A heap overflow flaw in the Linux kernel's EFI GUID     Partition Table (GPT) implementation could allow a local     attacker to cause a denial of service by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1577, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-264:04 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2011-0726     The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an     expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by     reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE     binary.
    CVE-2011-1093     The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP)     implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint,     which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending     a DCCP-Close packet followed by a DCCP-Reset packet.
    CVE-2011-1170     net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not     place the expected '0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1171     net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place     the expected '0' character at the end of string data in the values of certain structure members, which     allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1172     net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not     place the expected '0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1163     The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly     handle an invalid number of partitions, which might allow local users to obtain potentially sensitive     information from kernel heap memory via vectors related to partition-table parsing.
    CVE-2011-1494     Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux     kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory     corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
    CVE-2011-1495     drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and     (2) offset values before performing memory copy operations, which might allow local users to gain     privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel     memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
    CVE-2011-1577     Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    CVE-2011-1078     CVE-2011-1079     CVE-2011-1080     CVE-2011-1166     CVE-2011-1763     No descriptions at the time of writing, please use the CVE links below.
    Fixed bugs:
    For an exhasive list of other fixes, please refer to the changelog

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This collective June/2011 Update for Xen provides the following fixes :

  - Xen does not properly check the upper boundary of     user-supplied data in the get_free_port() function when     getting a new event channel port. A local user on the     guest operating system can exploit this flaw to cause     denial of service conditions or potentially gain     elevated privileges. (CVE-2011-1166)

  - 654798: Fix race between hotplug scripts writing to     xenstore and xend registering a watch for the write.

  - 684297: HVM taking too long to dump vmcore

  - 688757: Fix kernel panic on fully virtualized setup

  - 658413: Fix root drive search on SLES 10-SP3 HVM guest

  - 675363: Random lockups with kernel-xen related to     graphics

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0833 advisory.

    - [scsi] mpt2sas: prevent heap overflows and unchecked access (Tomas Henzl) [694526 694527] {CVE-2011-1495     CVE-2011-1494}
    - [net] bridge/netfilter: fix ebtables information leak (Don Howard) [681325 681326] {CVE-2011-1080}
    - [net] bluetooth: fix sco information leak to userspace (Don Howard) [681310 681311] {CVE-2011-1078}
    - [fs] fix corrupted GUID partition table kernel oops (Jerome Marchand) [695979 695980] {CVE-2011-1577}
    - [xen] x86/domain: fix error checks in arch_set_info_guest (Laszlo Ersek) [688581 688582] {CVE-2011-1166}
    - [fs] partitions: Fix corrupted OSF partition table parsing (Danny Feng) [688022 688023] {CVE-2011-1163}
    - [net] netfilter: ip6_tables: fix infoleak to userspace (Jiri Pirko) [689348 689349] {CVE-2011-1172}
    - [net] netfilter/ip_tables: fix infoleak to userspace (Jiri Pirko) [689331 689332] {CVE-2011-1171}
    - [net] netfilter/arp_tables: fix infoleak to userspace (Jiri Pirko) [689322 689323] {CVE-2011-1170}
    - [fs] proc: protect mm start_/end_code in /proc/pid/stat (Eugene Teo) [684570 684571] {CVE-2011-0726}
    - [net] dccp: fix oops in dccp_rcv_state_process (Eugene Teo) [682955 682956] {CVE-2011-1093}
    - [net] bluetooth: fix bnep buffer overflow (Don Howard) [681318 681319] {CVE-2011-1079}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0833 advisory.

  - kernel: proc: protect mm start_code/end_code in /proc/pid/stat (CVE-2011-0726)

  - kernel: bt sco_conninfo infoleak (CVE-2011-1078)

  - kernel: bnep device field missing NULL terminator (CVE-2011-1079)

  - kernel: ebtables stack infoleak (CVE-2011-1080)

  - kernel: dccp: fix oops on Reset after close (CVE-2011-1093)

  - kernel: fs/partitions: Corrupted OSF partition table infoleak (CVE-2011-1163)

  - kernel: xen: x86_64: fix error checking in arch_set_info_guest() (CVE-2011-1166)

  - kernel: ipv4: netfilter: arp_tables: fix infoleak to userspace (CVE-2011-1170)

  - kernel: ipv4: netfilter: ip_tables: fix infoleak to userspace (CVE-2011-1171)

  - kernel: ipv6: netfilter: ip6_tables: fix infoleak to userspace (CVE-2011-1172)

  - kernel: drivers/scsi/mpt2sas: prevent heap overflows (CVE-2011-1494, CVE-2011-1495)

  - kernel: corrupted GUID partition tables can cause kernel oops (CVE-2011-1577)

  - kernel: xen: improper upper boundary check in get_free_port() function (CVE-2011-1763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-282:05 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel     handles the basic functions of the operating system: memory allocation, process allocation, device input     and output, etc.
    Security issues fixed with this release:
    CVE-2011-0726     The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an     expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by     reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE     binary.
    CVE-2011-1093     The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP)     implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint,     which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending     a DCCP-Close packet followed by a DCCP-Reset packet.
    CVE-2011-1170     net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not     place the expected '' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1171     net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place     the expected '' character at the end of string data in the values of certain structure members, which     allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1172     net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not     place the expected '' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1163     The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly     handle an invalid number of partitions, which might allow local users to obtain potentially sensitive     information from kernel heap memory via vectors related to partition-table parsing.
    CVE-2011-1494     Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux     kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory     corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
    CVE-2011-1495     drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and     (2) offset values before performing memory copy operations, which might allow local users to gain     privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel     memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
    CVE-2011-1577     Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    CVE-2010-4346     The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an     expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr     restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language     application.
    CVE-2011-0521     The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2     does not check the sign of a certain integer field, which allows local users to cause a denial of service     (memory corruption) or possibly have unspecified other impact via a negative value.
    CVE-2011-0710     The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before     2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of     an arbitrary process by reading a status file under /proc/.
    CVE-2011-1010     Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2     allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a     malformed Mac OS partition table.
    CVE-2011-1090     The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL     data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a     denial of service (panic) via a crafted attempt to set an ACL.
    CVE-2010-4249     The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125     does not properly select times for garbage collection of inflight sockets, which allows local users to     cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for     SOCK_SEQPACKET sockets.
    CVE-2010-4251     The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a     backlog of received packets, which allows remote attackers to cause a denial of service (memory     consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
    CVE-2010-4655     net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which     allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the     CAP_NET_ADMIN capability for an ethtool ioctl call.
    CVE-2010-4526     Race condition in the Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of     service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes     the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function.
    CVE-2010-3296     The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5     does not properly initialize a certain structure member, which allows local users to obtain potentially     sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.
    CVE-2010-3877     The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a     certain structure, which allows local users to obtain potentially sensitive information from kernel stack     memory by reading a copy of this structure.
    CVE-2010-4072     The copy_shmid_to_user function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a     certain structure, which allows local users to obtain potentially sensitive information from kernel stack     memory via vectors related to the shmctl system call and the old shm interface.
    CVE-2010-4073     The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures, which     allows local users to obtain potentially sensitive information from kernel stack memory via vectors     related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in     ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in     ipc/compat_mq.c.
    CVE-2010-4075     The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel before 2.6.37-rc1 does not     properly initialize a certain structure member, which allows local users to obtain potentially sensitive     information from kernel stack memory via a TIOCGICOUNT ioctl call.
    CVE-2010-4080     The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does     not initialize a certain structure, which allows local users to obtain potentially sensitive information     from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.
    CVE-2010-4081     The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does     not initialize a certain structure, which allows local users to obtain potentially sensitive information     from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
    CVE-2010-4158     The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether     a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM     instruction, which allows local users to obtain potentially sensitive information from kernel stack memory     via a crafted socket filter.
    CVE-2010-4238     The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is     used, allows guest OS users to cause a denial of service (host OS panic) via an attempted access to a     virtual CD-ROM device through the blkback driver. NOTE: some of these details are obtained from third     party information.
    CVE-2010-4243     fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory     by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial     of service (memory consumption) via a crafted exec system call, aka an OOM dodging issue, a related issue     to CVE-2010-3858.
    CVE-2010-4255     The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when     paravirtualization is enabled, does not verify that kernel mode is used to call the     handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS     BUG_ON) via a crafted memory access.
    CVE-2010-4263     The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb)     subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous     mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL     pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.
    CVE-2010-4343     drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data     structure, which allows local users to cause a denial of service (system crash) via read operations on an     fc_host statistics file.
    CVE-2011-1078     CVE-2011-1079     CVE-2011-1080     CVE-2011-1166     CVE-2011-1763     CVE-2011-1478     No description available at the time of writing, please refer to the CVE links below.
    Fixed bugs:
    Too many to list here but here are some of the main ones:
    - Changed the value of debug parameter from 0 to 1 to provide kernel-debug-devel.
    - Merged patches from 2.6.18-194.11.AXS3
    - Modified all i686, x86_64 and ia64 kernel config files
    - Modified config-rhel-generic to enable ocfs2

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
61059	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
284281	MiracleLinux 3 : kernel-2.6.18-194.13.AXS3 (AXSA:2011-264:04)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/19/2026	high
57265	SuSE 10 Security Update : Xen (ZYPP Patch Number 7547)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	medium
68276	Oracle Linux 5 : kernel (ELSA-2011-0833)	Nessus	Oracle Linux Local Security Checks	7/12/2013	2/9/2026	high
54925	RHEL 5 : kernel (RHSA-2011:0833)	Nessus	Red Hat Local Security Checks	6/1/2011	4/21/2024	high
284391	MiracleLinux 3 : kernel-2.6.18-238.2.AXS3 (AXSA:2011-282:05)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/19/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

high

high

medium