RHSA-2009:0009: Important: kernel security and bug fix update

First published: Thu Jan 22 2009(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br>These updated packages address the following security issues:<br><li> Tavis Ormandy discovered a deficiency in the Linux kernel 32-bit and</li> 64-bit emulation. This could allow a local, unprivileged user to prepare<br>and run a specially-crafted binary which would use this deficiency to leak<br>uninitialized and potentially sensitive data. (CVE-2008-0598, Important)<br><li> Olaf Kirch reported a flaw in the i915 kernel driver that only affects</li> the Intel G33 series and newer. This flaw could, potentially, lead to local<br>privilege escalation. (CVE-2008-3831, Important)<br><li> Miklos Szeredi reported a missing check for files opened with O_APPEND in</li> sys_splice(). This could allow a local, unprivileged user to bypass the<br>append-only file restrictions. (CVE-2008-4554, Important)<br><li> a deficiency was found in the Linux kernel Stream Control Transmission</li> Protocol (SCTP) implementation. This could lead to a possible denial of<br>service if one end of a SCTP connection did not support the AUTH extension.<br>(CVE-2008-4576, Important)<br><li> Wei Yongjun reported a flaw in the Linux kernel SCTP implementation. In</li> certain code paths, sctp_sf_violation_paramlen() could be called with a<br>wrong parameter data type. This could lead to a possible denial of service.<br>(CVE-2008-4618, Important)<br><li> when fput() was called to close a socket, the __scm_destroy() function in</li> the Linux kernel could make indirect recursive calls to itself. This could,<br>potentially, lead to a denial of service issue. (CVE-2008-5029, Important)<br><li> the ext2 and ext3 filesystem code failed to properly handle corrupted</li> data structures, leading to a possible local denial of service issue when<br>read or write operations were performed. (CVE-2008-3528, Low)<br>These updated packages also address numerous bugs, including the following:<br><li> several System on Chip (SoC) audio drivers allocated memory in the</li> platform device probe function but did not free this memory in the event of<br>an error. Instead, the memory was freed in the device probe function's<br>error path. This could result in a 'double free' error. With this update,<br>errors cause memory to be freed correctly.<br><li> when a check was made to see if the netlink attribute fitted into</li> available memory, the value returned, "remaining", could become negative<br>due to alignment in nla_next(). GCC set "remaining" to unsigned when<br>testing against the sizeof(*nla), however. As a consequence, the test would<br>always succeed and the function nla_for_each_attr() could, potentially,<br>access memory outside the received buffer. With this update, sizeof is cast<br>to an integer, ensuring sizeof(*nla) does a signed test and prevents an<br>illegal memory de-reference.<br><li> if a user-space process used a SIGIO notification and did not disable it</li> before closing the file descriptor, a stale pointer was left in the<br>async_queue of the real-time clock. When a different user-space process<br>subsequently used a SIGIO notification, the kernel de-referenced this<br>pointer and crashed. With this updated kernel, SIGIO notifications are<br>disabled when the file descriptor is closed, preventing this.<br><li> the real-time kernel included with Red Hat Enterprise Linux MRG did not</li> randomize exec, heap or libc addresses. This update corrects this omission:<br>exec, heap and libc addresses are now randomized.<br>Numerous other bug fixes included with this update are noted in the Red Hat<br>Enterprise MRG 1.0 Real Time Security Update Release Note, available at the<br>location noted in the References section below.<br>All Red Hat Enterprise MRG users should install this update which addresses<br>these vulnerabilities and fixes these bugs.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2009:0009
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness