This update fixes the following reports for OFED :

  - 704914: Fixed NFS client over TCP hangs due to packet     loss.

  - 693243: Fixed issue with building lustre against     ofed-devel.

  - 706175: Fix crash on accessing /proc/net/sdpstats

  - 722030: Cannot load ib_ipath

  - 703752: Prevent BUG_ON triggering on congestion

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - Multiple buffer overflow flaws were found in the Linux     kernel's Management Module Support for Message Passing     Technology (MPT) based controllers. A local,     unprivileged user could use these flaws to cause a     denial of service, an information leak, or escalate     their privileges. (CVE-2011-1494, CVE-2011-1495,     Important)

  - A flaw was found in the Linux kernel's Ethernet bonding     driver implementation. Packets coming in from network     devices that have more than 16 receive queues to a     bonding interface could cause a denial of service.
    (CVE-2011-1581, Important)

  - A flaw was found in the Linux kernel's networking     subsystem. If the number of packets received exceeded     the receiver's buffer limit, they were queued in a     backlog, consuming memory, instead of being discarded. A     remote attacker could abuse this flaw to cause a denial     of service (out-of-memory condition). (CVE-2010-4251,     Moderate)

  - A flaw was found in the Linux kernel's Transparent Huge     Pages (THP) implementation. A local, unprivileged user     could abuse this flaw to allow the user stack (when it     is using huge pages) to grow and cause a denial of     service. (CVE-2011-0999, Moderate)

  - A flaw was found in the transmit methods (xmit) for the     loopback and InfiniBand transports in the Linux kernel's     Reliable Datagram Sockets (RDS) implementation. A local,     unprivileged user could use this flaw to cause a denial     of service. (CVE-2011-1023, Moderate)

  - A flaw in the Linux kernel's Event Poll (epoll)     implementation could allow a local, unprivileged user to     cause a denial of service. (CVE-2011-1082, Moderate)

  - An inconsistency was found in the interaction between     the Linux kernel's method for allocating NFSv4 (Network     File System version 4) ACL data and the method by which     it was freed. This inconsistency led to a kernel panic     which could be triggered by a local, unprivileged user     with files owned by said user on an NFSv4 share.
    (CVE-2011-1090, Moderate)

  - A missing validation check was found in the Linux     kernel's mac_partition() implementation, used for     supporting file systems created on Mac OS operating     systems. A local attacker could use this flaw to cause a     denial of service by mounting a disk that contains     specially crafted partitions. (CVE-2011-1010, Low)

  - A buffer overflow flaw in the DEC Alpha OSF partition     implementation in the Linux kernel could allow a local     attacker to cause an information leak by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1163, Low)

  - Missing validations of null-terminated string data     structure elements in the do_replace(),     compat_do_replace(), do_ipt_get_ctl(),     do_ip6t_get_ctl(), and do_arpt_get_ctl() functions could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1170,     CVE-2011-1171, CVE-2011-1172, Low)

This update also fixes several hundred bugs and adds enhancements.

The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0542 advisory.

  - kvm: arch/x86/kvm/x86.c: reading uninitialized stack memory (CVE-2010-3881)

  - kernel: unlimited socket backlog DoS (CVE-2010-4251, CVE-2010-4805)

  - kernel: thp: prevent hugepages during args/env copying into the user stack (CVE-2011-0999)

  - kernel: fs/partitions: Validate map_count in Mac partition tables (CVE-2011-1010)

  - kernel: BUG_ON() in rds_send_xmit() (CVE-2011-1023)

  - kernel: potential kernel deadlock when creating circular epoll file structures (CVE-2011-1082)

  - kernel: nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (CVE-2011-1090)

  - kernel: fs/partitions: Corrupted OSF partition table infoleak (CVE-2011-1163)

  - kernel: ipv4: netfilter: arp_tables: fix infoleak to userspace (CVE-2011-1170)

  - kernel: ipv4: netfilter: ip_tables: fix infoleak to userspace (CVE-2011-1171)

  - kernel: ipv6: netfilter: ip6_tables: fix infoleak to userspace (CVE-2011-1172)

  - kernel: drivers/scsi/mpt2sas: prevent heap overflows (CVE-2011-1494, CVE-2011-1495)

  - kernel: bonding: Incorrect TX queue offset (CVE-2011-1581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0542 advisory.

  - arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members,     which allows local users to obtain potentially sensitive information from kernel stack memory via read     operations on the /dev/kvm device. (CVE-2010-3881)

  - The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a     backlog of received packets, which allows remote attackers to cause a denial of service (memory     consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
    (CVE-2010-4251)

  - The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a     backlog of received packets, which allows remote attackers to cause a denial of service by sending a large     amount of network traffic, related to the sk_add_backlog function and the sk_rmem_alloc socket field.
    NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4251. (CVE-2010-4805)

  - mm/huge_memory.c in the Linux kernel before 2.6.38-rc5 does not prevent creation of a transparent huge     page (THP) during the existence of a temporary stack for an exec system call, which allows local users to     cause a denial of service (memory consumption) or possibly have unspecified other impact via a crafted     application. (CVE-2011-0999)

  - Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2     allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a     malformed Mac OS partition table. (CVE-2011-1010)

  - The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle     congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash)     via vectors involving (1) a loopback (aka loop) transmit operation or (2) an InfiniBand (aka ib) transmit     operation. (CVE-2011-1023)

  - fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data     structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to     cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes     epoll_create and epoll_ctl system calls. (CVE-2011-1082)

  - The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL     data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a     denial of service (panic) via a crafted attempt to set an ACL. (CVE-2011-1090)

  - The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly     handle an invalid number of partitions, which might allow local users to obtain potentially sensitive     information from kernel heap memory via vectors related to partition-table parsing. (CVE-2011-1163)

  - net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not     place the expected '\0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process. (CVE-2011-1170)

  - net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place     the expected '\0' character at the end of string data in the values of certain structure members, which     allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process. (CVE-2011-1171)

  - net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not     place the expected '\0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process. (CVE-2011-1172)

  - Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux     kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory     corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
    (CVE-2011-1494)

  - drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and     (2) offset values before performing memory copy operations, which might allow local users to gain     privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel     memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
    (CVE-2011-1495)

  - The bond_select_queue function in drivers/net/bonding/bond_main.c in the Linux kernel before 2.6.39, when     a network device with a large number of receive queues is installed but the default tx_queues setting is     used, does not properly restrict queue indexes, which allows remote attackers to cause a denial of service     (BUG and system crash) or possibly have unspecified other impact by sending network traffic.
    (CVE-2011-1581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2016 advisory.

  - The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a     backlog of received packets, which allows remote attackers to cause a denial of service (memory     consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
    (CVE-2010-4251)

  - The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle     congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash)     via vectors involving (1) a loopback (aka loop) transmit operation or (2) an InfiniBand (aka ib) transmit     operation. (CVE-2011-1023)

  - fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data     structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to     cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes     epoll_create and epoll_ctl system calls. (CVE-2011-1082)

  - The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly     handle an invalid number of partitions, which might allow local users to obtain potentially sensitive     information from kernel heap memory via vectors related to partition-table parsing. (CVE-2011-1163)

  - net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not     place the expected '\0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process. (CVE-2011-1170)

  - net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place     the expected '\0' character at the end of string data in the values of certain structure members, which     allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process. (CVE-2011-1171)

  - net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not     place the expected '\0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process. (CVE-2011-1172)

  - Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux     kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory     corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
    (CVE-2011-1494)

  - drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and     (2) offset values before performing memory copy operations, which might allow local users to gain     privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel     memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
    (CVE-2011-1495)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
57123	SuSE 11.1 Security Update : OFED (SAT Patch Number 5384)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	medium
61041	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
54590	RHEL 6 : Red Hat Enterprise Linux 6.1 kernel (RHSA-2011:0542)	Nessus	Red Hat Local Security Checks	5/20/2011	4/21/2024	high
181049	Oracle Linux 6 : Oracle / Linux / 6.1 / kernel (ELSA-2011-0542)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/7/2023	high
68417	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2016)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/26/2022	high

Detections

Analytics

Plugins Search

medium

medium

high

high

high