Andy Adamson discovered a flaw in the Linux kernel's NFSv4 implementation. A remote NFS server (attacker) could exploit this flaw to cause a denial of service. (CVE-2011-4131)

A flaw was discovered in the Linux kernel's KVM (kernel virtual machine). An administrative user in the guest OS could leverage this flaw to cause a denial of service in the host OS. (CVE-2012-2121)

Schacher Raindel discovered a flaw in the Linux kernel's memory handling when hugetlb is enabled. An unprivileged local attacker could exploit this flaw to cause a denial of service and potentially gain higher privileges. (CVE-2012-2133)

Stephan Mueller reported a flaw in the Linux kernel's dl2k network driver's handling of ioctls. An unprivileged local user could leverage this flaw to cause a denial of service. (CVE-2012-2313)

Timo Warns reported multiple flaws in the Linux kernel's hfsplus filesystem. An unprivileged local user could exploit these flaws to gain root system priviliges. (CVE-2012-2319)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of cliprect on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2383)

Xi Wang discovered a flaw in the Linux kernel's i915 graphics driver handling of buffer_count on 32 bit systems. An unprivileged local attacker could leverage this flaw to cause a denial of service or potentially gain root privileges. (CVE-2012-2384)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1304 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * An integer overflow flaw was found in the i915_gem_do_execbuffer()     function in the Intel i915 driver in the Linux kernel. A local,     unprivileged user could use this flaw to cause a denial of service. This     issue only affected 32-bit systems. (CVE-2012-2384, Moderate)

    * A memory leak flaw was found in the way the Linux kernel's memory     subsystem handled resource clean up in the mmap() failure path when the     MAP_HUGETLB flag was set. A local, unprivileged user could use this flaw to     cause a denial of service. (CVE-2012-2390, Moderate)

    * A race condition was found in the way access to inet->opt ip_options was     synchronized in the Linux kernel's TCP/IP protocol suite implementation.
    Depending on the network facing applications running on the system, a     remote attacker could possibly trigger this flaw to cause a denial of     service. A local, unprivileged user could use this flaw to cause a denial     of service regardless of the applications the system runs. (CVE-2012-3552,     Moderate)

    * A flaw was found in the way the Linux kernel's dl2k driver, used by     certain D-Link Gigabit Ethernet adapters, restricted IOCTLs. A local,     unprivileged user could use this flaw to issue potentially harmful IOCTLs,     which could cause Ethernet adapters using the dl2k driver to malfunction     (for example, losing network connectivity). (CVE-2012-2313, Low)

    * A flaw was found in the way the msg_namelen variable in the rds_recvmsg()     function of the Linux kernel's Reliable Datagram Sockets (RDS) protocol     implementation was initialized. A local, unprivileged user could use this     flaw to leak kernel stack memory to user-space. (CVE-2012-3430, Low)

    Red Hat would like to thank Hafid Lin for reporting CVE-2012-3552, and     Stephan Mueller for reporting CVE-2012-2313. The CVE-2012-3430 issue was     discovered by the Red Hat InfiniBand team.

    This update also fixes several bugs. Documentation for these changes will     be available shortly from the Technical Notes document linked to in the     References section.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues, and fix the bugs noted in the Technical     Notes. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - An integer overflow flaw was found in the     i915_gem_do_execbuffer() function in the Intel i915     driver in the Linux kernel. A local, unprivileged user     could use this flaw to cause a denial of service. This     issue only affected 32-bit systems. (CVE-2012-2384,     Moderate)

  - A memory leak flaw was found in the way the Linux     kernel's memory subsystem handled resource clean up in     the mmap() failure path when the MAP_HUGETLB flag was     set. A local, unprivileged user could use this flaw to     cause a denial of service. (CVE-2012-2390, Moderate)

  - A race condition was found in the way access to     inet->opt ip_options was synchronized in the Linux     kernel's TCP/IP protocol suite implementation. Depending     on the network facing applications running on the     system, a remote attacker could possibly trigger this     flaw to cause a denial of service. A local, unprivileged     user could use this flaw to cause a denial of service     regardless of the applications the system runs.
    (CVE-2012-3552, Moderate)

  - A flaw was found in the way the Linux kernel's dl2k     driver, used by certain D-Link Gigabit Ethernet     adapters, restricted IOCTLs. A local, unprivileged user     could use this flaw to issue potentially harmful IOCTLs,     which could cause Ethernet adapters using the dl2k     driver to malfunction (for example, losing network     connectivity). (CVE-2012-2313, Low)

  - A flaw was found in the way the msg_namelen variable in     the rds_recvmsg() function of the Linux kernel's     Reliable Datagram Sockets (RDS) protocol implementation     was initialized. A local, unprivileged user could use     this flaw to leak kernel stack memory to user-space.
    (CVE-2012-3430, Low)

This update also fixes several bugs.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs noted.
The system must be rebooted for this update to take effect.

An integer overflow flaw was found in the i915_gem_do_execbuffer() function in the Intel i915 driver in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service.
This issue only affected 32-bit systems. (CVE-2012-2384 , Moderate)

A memory leak flaw was found in the way the Linux kernel's memory subsystem handled resource clean up in the mmap() failure path when the MAP_HUGETLB flag was set. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2012-2390 , Moderate)

A race condition was found in the way access to inet->opt ip_options was synchronized in the Linux kernel's TCP/IP protocol suite implementation. Depending on the network facing applications running on the system, a remote attacker could possibly trigger this flaw to cause a denial of service. A local, unprivileged user could use this flaw to cause a denial of service regardless of the applications the system runs. (CVE-2012-3552 , Moderate)

A flaw was found in the way the Linux kernel's dl2k driver, used by certain D-Link Gigabit Ethernet adapters, restricted IOCTLs. A local, unprivileged user could use this flaw to issue potentially harmful IOCTLs, which could cause Ethernet adapters using the dl2k driver to malfunction (for example, losing network connectivity). (CVE-2012-2313 , Low)

A flaw was found in the way the msg_namelen variable in the rds_recvmsg() function of the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation was initialized. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space.
(CVE-2012-3430 , Low)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix bug number for commit 'cciss: Update HPSA_BOUNDARY'     (Joe Jin) [Orabug: 14681166]

  - cciss: Update HPSA_BOUNDARY. (Joe Jin) [Orabug:
    14319765]

  - KVM: introduce kvm_for_each_memslot macro (Maxim Uvarov)     [Bugdb: 13966]

  - dl2k: Clean up rio_ioctl (Jeff Mahoney) [Orabug:
    14126896] (CVE-2012-2313)

  - NFSv4: include bitmap in nfsv4 get acl data (Andy     Adamson) (CVE-2011-4131)

  - KVM: Fix buffer overflow in kvm_set_irq (Avi Kivity)     [Bugdb: 13966] (CVE-2012-2137)

  - net: sock: validate data_len before allocating skb in     sock_alloc_send_pskb (Jason Wang) [Bugdb: 13966]     (CVE-2012-2136)

  - mm: pmd_read_atomic: fix 32bit PAE pmd walk vs     pmd_populate SMP race condition (Andrea Arcangeli)     [Bugdb: 13966] (CVE-2012-2373)

  - KVM: lock slots_lock around device assignment (Alex     Williamson) [Bugdb: 13966] (CVE-2012-2121)

  - KVM: unmap pages from the iommu when slots are removed     (Maxim Uvarov) [Bugdb: 13966] (CVE-2012-2121)

  - fcaps: clear the same personality flags as suid when     fcaps are used (Eric Paris) [Bugdb: 13966]     (CVE-2012-2123)

  - tilegx: enable SYSCALL_WRAPPERS support (Chris Metcalf)     (CVE-2009-0029)

  - drm/i915: fix integer overflow in i915_gem_do_execbuffer     (Xi Wang) [Orabug: 14107456] (CVE-2012-2384)

  - drm/i915: fix integer overflow in i915_gem_execbuffer2     (Xi Wang) [Orabug: 14107445] (CVE-2012-2383)

  - [dm] do not forward ioctls from logical volumes to the     underlying device (Joe Jin) (CVE-2011-4127)

  - [block] fail SCSI passthrough ioctls on partition     devices (Joe Jin) (CVE-2011-4127)

  - [block] add and use scsi_blk_cmd_ioctl (Joe Jin)     [Orabug: 14056755] (CVE-2011-4127)

  - KVM: Ensure all vcpus are consistent with in-kernel     irqchip settings (Avi Kivity) [Bugdb: 13871]     (CVE-2012-1601)

  - regset: Return -EFAULT, not -EIO, on host-side memory     fault (H. Peter Anvin) (CVE-2012-1097)

  - regset: Prevent null pointer reference on readonly     regsets (H. Peter Anvin) (CVE-2012-1097)

  - cifs: fix dentry refcount leak when opening a FIFO on     lookup (Jeff Layton) (CVE-2012-1090)

  - mm: thp: fix pmd_bad triggering in code paths holding     mmap_sem read mode (Andrea Arcangeli) (CVE-2012-1179)

  - ext4: fix undefined behavior in ext4_fill_flex_info (Xi     Wang) (CVE-2009-4307)

  - ocfs2: clear unaligned io flag when dio fails (Junxiao     Bi) [Orabug: 14063941]

  - aio: make kiocb->private NUll in init_sync_kiocb     (Junxiao Bi) [Orabug: 14063941]

  - igb: Fix for Alt MAC Address feature on 82580 and later     devices (Carolyn Wyborny) [Orabug: 14258706]

  - igb: Alternate MAC Address Updates for Func2&3 (Akeem G.
    Abodunrin) [Orabug: 14258706]

  - igb: Alternate MAC Address EEPROM Updates (Akeem G.
    Abodunrin) [Orabug: 14258706]

  - cciss: only enable cciss_allow_hpsa when for ol5 (Joe     Jin) [Orabug: 14106006]

  - Revert 'cciss: remove controllers supported by hpsa'     (Joe Jin) [Orabug: 14106006]

  - [scsi] hpsa: add all support devices for ol5 (Joe Jin)     [Orabug: 14106006]

  - Disable VLAN 0 tagging for none VLAN traffic (Adnan     Misherfi) [Orabug: 14406424]

  - x86: Add Xen kexec control code size check to linker     script (Daniel Kiper)

  - drivers/xen: Export vmcoreinfo through sysfs (Daniel     Kiper)

  - x86/xen/enlighten: Add init and crash kexec/kdump hooks     (Maxim Uvarov)

  - x86/xen: Add kexec/kdump makefile rules (Daniel Kiper)

  - x86/xen: Add x86_64 kexec/kdump implementation (Daniel     Kiper)

  - x86/xen: Add placeholder for i386 kexec/kdump     implementation (Daniel Kiper)

  - x86/xen: Register resources required by kexec-tools     (Daniel Kiper)

  - x86/xen: Introduce architecture dependent data for     kexec/kdump (Daniel Kiper)

  - xen: Introduce architecture independent data for     kexec/kdump (Daniel Kiper)

  - x86/kexec: Add extra pointers to transition page table     PGD, PUD, PMD and PTE (Daniel Kiper)

  - kexec: introduce kexec_ops struct (Daniel Kiper)

  - SPEC: replace DEFAULTKERNEL from kernel-ovs to     kernel-uek

The SUSE Linux Enterprise 11 SP1 kernel have been updated to fix various bugs and security issues.

The following security issues have been fixed :

  - Several buffer overread and overwrite errors in the UDF     logical volume descriptor code were fixed that might     have allowed local attackers able to mount UDF volumes     to crash the kernel or potentially gain privileges.
    (CVE-2012-3400)

  - A local denial of service in the last epoll fix was     fixed. (CVE-2012-3375)

  - A integer overflow in i915_gem_do_execbuffer() was fixed     that might be used by local attackers to crash the     kernel or potentially execute code. (CVE-2012-2384)

  - A integer overflow in i915_gem_execbuffer2() was fixed     that might be used by local attackers to crash the     kernel or potentially execute code. (CVE-2012-2383)

  - Memiory leaks in the hugetlbfs map reservation code were     fixed that could be used by local attackers to exhaust     machine memory. (CVE-2012-2390)

  - The filesystem capability handling was not fully     correct, allowing local users to bypass fscaps related     restrictions to disable e.g. address space     randomization. (CVE-2012-2123)

  - Validation of data_len before allocating fragments of     skbs was fixed that might have allowed a heap overflow.
    (CVE-2012-2136)

  - Fixed potential buffer overflows in the hfsplus     filesystem, which might be exploited by local attackers     able to mount such filesystems. (CVE-2012-2319)

Several leapsecond related bug fixes have been created :

  - hrtimer: provide clock_was_set_delayed(). (bnc#768632)

  - time: Fix leapsecond triggered hrtimer/futex load spike     issue. (bnc#768632)

  - ntp: fix leap second hrtimer deadlock. (bnc#768632)

  - ntp: avoid printk under xtime_lock (bnc#767684). The     following non-security issues have been fixed :

  - tcp: drop SYN+FIN messages to avoid memory leaks.
    (bnc#765102)

  - be2net: Fix EEH error reset before a flash dump     completes. (bnc#755546)

  - REVERT svcrpc: destroy server sockets all at once.
    (bnc#769210)

  - sched: Make sure to not re-read variables after     validation. (bnc#769685)

  - audit: Do not send uninitialized data for AUDIT_TTY_GET.
    (bnc#755513)

  - dlm: do not depend on sctp. (bnc#729247, bnc#763656)

  - RPC: killing RPC tasks races fixed. (bnc#765548)

  - vlan/core: Fix memory leak/corruption on VLAN GRO_DROP.
    (bnc#758058)

  - CPU hotplug, cpusets, suspend/resume: Do not modify     cpusets during suspend/resume. (bnc#752858)

  - ioat2: kill pending flag. (bnc#765022)

  - Fix massive driver induced spin_lock_bh() contention.

  - ipmi: Fix IPMI errors due to timing problems.
    (bnc#761988)

  - xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53.
    (bnc#760974)

  - xen: gntdev: fix multi-page slot allocation.
    (bnc#760974)

  - rpm/kernel-binary.spec.in: Own the right -kdump initrd.
    (bnc#764500)

  - kernel: pfault task state race (bnc#764098,LTC#81724).

  - xfrm: take net hdr len into account for esp payload size     calculation. (bnc#759545)

  - bonding: do not dereference NULL pointer to device of     VLAN 0. (bnc#763830)

  - cifs: fix oops while traversing open file list (try #4).
    (bnc#756050)

  - nfsd: fix BUG at fs/nfsd/nfsfh.h:199 on unlink.
    (bnc#769777)

  - nfs: Ensure we never try to mount an NFS auto-mount dir     (bnc748601).

  - patches.suse/cgroup-disable-memcg-when-low-lowmem.patch:
    fix typo: use if defined(CONFIG_) rather than if CONFIG_

  - patches.suse/pagecache-limit-fix-shmem-deadlock.patch:
    Fixed the GFP_NOWAIT is zero and not suitable for tests     bug. (bnc#755537)

  - sys_poll: fix incorrect type for timeout parameter.
    (bnc#754428)

  - scsi_transport_fc: fix blocked bsg request when fc     object deleted. (bnc#761414, bnc#734300)

  - ehea: fix allmulticast support. (bnc#758013)

  - scsi: Silence unnecessary warnings about ioctl to     partition. (bnc#758104)

  - sched/x86: Fix overflow in cyc2ns_offset. (bnc#630970,     bnc#661605)

  - sched/rt: Do not throttle when PI boosting. (bnc#754085)

  - sched/rt: Keep period timer ticking when rt throttling     is active. (bnc#754085)

  - sched,rt: fix isolated CPUs leaving root_task_group     indefinitely throttled. (bnc#754085)

ID	Name	Product	Family	Published	Updated	Severity
59553	USN-1476-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	6/18/2012	12/1/2016	high
62303	RHEL 6 : kernel (RHSA-2012:1304)	Nessus	Red Hat Local Security Checks	9/26/2012	4/15/2025	medium
62346	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120925)	Nessus	Scientific Linux Local Security Checks	9/27/2012	1/14/2021	medium
69623	Amazon Linux AMI : kernel (ALAS-2012-133)	Nessus	Amazon Linux Local Security Checks	9/4/2013	8/3/2020	medium
79484	OracleVM 3.1 : kernel-uek (OVMSA-2012-0042)	Nessus	OracleVM Local Security Checks	11/26/2014	1/4/2021	high
64177	SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 6547 / 6548 / 6550)	Nessus	SuSE Local Security Checks	1/25/2013	1/19/2021	high

Detections

Analytics

Plugins Search

high

medium

medium

medium

high

high