Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. (CVE-2011-1927)

Vegard Nossum discovered a leak in the kernel's inotify_init() system call. A local, unprivileged user could exploit this to cause a denial of service. (CVE-2010-4250)

An error was discovered in the kernel's handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)

A flaw was found in the kernel's Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006)

A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. (CVE-2011-0716)

Dan Rosenberg reported errors in the OSS (Open Sound System) MIDI interface. A local attacker on non-x86 systems might be able to cause a denial of service. (CVE-2011-1476)

Dan Rosenberg reported errors in the kernel's OSS (Open Sound System) driver for Yamaha FM synthesizer chips. A local user can exploit this to cause memory corruption, causing a denial of service or privilege escalation. (CVE-2011-1477)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

It was discovered that some import kernel threads can be blocked by a user level process. An unprivileged local user could exploit this flaw to cause a denial of service. (CVE-2011-4621)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0421 advisory.

  - The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5     does not properly initialize a certain structure member, which allows local users to obtain potentially     sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call. (CVE-2010-3296)

  - The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an     expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr     restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language     application. (CVE-2010-4346)

  - Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2     through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable     message to a socket that is already locked by a user, which causes the socket to be freed and triggers     list corruption, related to the sctp_wait_for_connect function. (CVE-2010-4526)

  - The orinoco_ioctl_set_auth function in drivers/net/wireless/orinoco/wext.c in the Linux kernel before     2.6.37 does not properly implement a TKIP protection mechanism, which makes it easier for remote attackers     to obtain access to a Wi-Fi network by reading Wi-Fi frames. (CVE-2010-4648)

  - net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which     allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the     CAP_NET_ADMIN capability for an ethtool ioctl call. (CVE-2010-4655)

  - The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before 2.6.37 does not     properly allocate memory, which might allow local users to trigger a heap-based buffer overflow, and     consequently cause a denial of service or gain privileges, via a long report. (CVE-2010-4656)

  - The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2     does not check the sign of a certain integer field, which allows local users to cause a denial of service     (memory corruption) or possibly have unspecified other impact via a negative value. (CVE-2011-0521)

  - Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in     Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand     request while other request handlers are still running, which triggers an invalid pointer dereference.
    (CVE-2011-0695)

  - The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before     2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of     an arbitrary process by reading a status file under /proc/. (CVE-2011-0710)

  - The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a     certain Ethernet bridge configuration is used, allows local users to cause a denial of service (memory     corruption and system crash) by sending IGMP packets to a local interface. (CVE-2011-0716)

  - The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the     Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow     remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame.
    (CVE-2011-1478)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - A flaw was found in the sctp_icmp_proto_unreachable()     function in the Linux kernel's Stream Control     Transmission Protocol (SCTP) implementation. A remote     attacker could use this flaw to cause a denial of     service. (CVE-2010-4526, Important)

  - A missing boundary check was found in the dvb_ca_ioctl()     function in the Linux kernel's av7110 module. On systems     that use old DVB cards that require the av7110 module, a     local, unprivileged user could use this flaw to cause a     denial of service or escalate their privileges.
    (CVE-2011-0521, Important)

  - A race condition was found in the way the Linux kernel's     InfiniBand implementation set up new connections. This     could allow a remote user to cause a denial of service.
    (CVE-2011-0695, Important)

  - A heap overflow flaw in the iowarrior_write() function     could allow a user with access to an IO-Warrior USB     device, that supports more than 8 bytes per report, to     cause a denial of service or escalate their privileges.
    (CVE-2010-4656, Moderate)

  - A flaw was found in the way the Linux Ethernet bridge     implementation handled certain IGMP (Internet Group     Management Protocol) packets. A local, unprivileged user     on a system that has a network interface in an Ethernet     bridge could use this flaw to crash that system     (CVE-2011-0716, Moderate)

  - A NULL pointer dereference flaw was found in the Generic     Receive Offload (GRO) functionality in the Linux     kernel's networking implementation. If both GRO and     promiscuous mode were enabled on an interface in a     virtual LAN (VLAN), it could result in a denial of     service when a malformed VLAN frame is received on that     interface. (CVE-2011-1478, Moderate)

  - A missing initialization flaw in the Linux kernel could     lead to an information leak. (CVE-2010-3296, Low)

  - A missing security check in the Linux kernel's     implementation of the install_special_mapping() function     could allow a local, unprivileged user to bypass the     mmap_min_addr protection mechanism. (CVE-2010-4346, Low)

  - A logic error in the orinoco_ioctl_set_auth() function     in the Linux kernel's ORiNOCO wireless extensions     support implementation could render TKIP countermeasures     ineffective when it is enabled, as it enabled the card     instead of shutting it down. (CVE-2010-4648, Low)

  - A missing initialization flaw was found in the     ethtool_get_regs() function in the Linux kernel's     ethtool IOCTL handler. A local user who has the     CAP_NET_ADMIN capability could use this flaw to cause an     information leak. (CVE-2010-4655, Low)

  - An information leak was found in the Linux kernel's     task_show_regs() implementation. On IBM S/390 systems, a     local, unprivileged user could use this flaw to read     /proc/[PID]/status files, allowing them to discover the     CPU register values of processes. (CVE-2011-0710, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. (CVE-2011-1927)

A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. (CVE-2011-0716)

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service.
(CVE-2011-3353)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. (CVE-2011-1927)

A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. (CVE-2011-0716)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the sctp_icmp_proto_unreachable() function in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could use this flaw to cause a denial of service. (CVE-2010-4526, Important)

* A missing boundary check was found in the dvb_ca_ioctl() function in the Linux kernel's av7110 module. On systems that use old DVB cards that require the av7110 module, a local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges.
(CVE-2011-0521, Important)

* A race condition was found in the way the Linux kernel's InfiniBand implementation set up new connections. This could allow a remote user to cause a denial of service. (CVE-2011-0695, Important)

* A heap overflow flaw in the iowarrior_write() function could allow a user with access to an IO-Warrior USB device, that supports more than 8 bytes per report, to cause a denial of service or escalate their privileges. (CVE-2010-4656, Moderate)

* A flaw was found in the way the Linux Ethernet bridge implementation handled certain IGMP (Internet Group Management Protocol) packets. A local, unprivileged user on a system that has a network interface in an Ethernet bridge could use this flaw to crash that system.
(CVE-2011-0716, Moderate)

* A NULL pointer dereference flaw was found in the Generic Receive Offload (GRO) functionality in the Linux kernel's networking implementation. If both GRO and promiscuous mode were enabled on an interface in a virtual LAN (VLAN), it could result in a denial of service when a malformed VLAN frame is received on that interface.
(CVE-2011-1478, Moderate)

* A missing initialization flaw in the Linux kernel could lead to an information leak. (CVE-2010-3296, Low)

* A missing security check in the Linux kernel's implementation of the install_special_mapping() function could allow a local, unprivileged user to bypass the mmap_min_addr protection mechanism. (CVE-2010-4346, Low)

* A logic error in the orinoco_ioctl_set_auth() function in the Linux kernel's ORiNOCO wireless extensions support implementation could render TKIP countermeasures ineffective when it is enabled, as it enabled the card instead of shutting it down. (CVE-2010-4648, Low)

* A missing initialization flaw was found in the ethtool_get_regs() function in the Linux kernel's ethtool IOCTL handler. A local user who has the CAP_NET_ADMIN capability could use this flaw to cause an information leak. (CVE-2010-4655, Low)

* An information leak was found in the Linux kernel's task_show_regs() implementation. On IBM S/390 systems, a local, unprivileged user could use this flaw to read /proc/[PID]/status files, allowing them to discover the CPU register values of processes. (CVE-2011-0710, Low)

Red Hat would like to thank Jens Kuehnel for reporting CVE-2011-0695;
Kees Cook for reporting CVE-2010-4656 and CVE-2010-4655; Dan Rosenberg for reporting CVE-2010-3296; and Tavis Ormandy for reporting CVE-2010-4346.

This update also fixes several bugs. Documentation for these bug fixes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

ID	Name	Product	Family	Published	Updated	Severity
58289	USN-1394-1 : Linux kernel (OMAP4) vulnerabilities	Nessus	Ubuntu Local Security Checks	3/8/2012	12/1/2016	high
68247	Oracle Linux 6 : kernel (ELSA-2011-0421)	Nessus	Oracle Linux Local Security Checks	7/12/2013	9/8/2021	high
61012	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
58268	Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1387-1)	Nessus	Ubuntu Local Security Checks	3/7/2012	9/19/2019	high
58169	Ubuntu 10.10 : linux vulnerabilities (USN-1379-1)	Nessus	Ubuntu Local Security Checks	2/29/2012	9/19/2019	medium
53328	RHEL 6 : kernel (RHSA-2011:0421)	Nessus	Red Hat Local Security Checks	4/8/2011	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

medium

high