RHSA-2009:1132: Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linuxoperating system.These updated packages fix the following security issues: a flaw was found in the Intel PRO/1000 network driver in the Linux kernel. Frames with sizes near the MTU of an interface may be split acrossmultiple hardware receive descriptors. Receipt of such a frame could leakthrough a validation check, leading to a corruption of the length check. Aremote attacker could use this flaw to send a specially-crafted packet thatwould cause a denial of service. (CVE-2009-1385, Important) the Linux kernel Network File System daemon (nfsd) implementation did not drop the CAPMKNOD capability when handling requests from local,unprivileged users. This flaw could possibly lead to an information leak orprivilege escalation. (CVE-2009-1072, Moderate) Frank Filz reported the NFSv4 client was missing a file permission check for the execute bit in some situations. This could allow local,unprivileged users to run non-executable files on NFSv4 mounted filesystems. (CVE-2009-1630, Moderate) a missing check was found in the hypervisorcallback() function in the Linux kernel provided by the kernel-xen package. This could cause a denialof service of a 32-bit guest if an application running in that guestaccesses a certain memory location in the kernel. (CVE-2009-1758, Moderate) a flaw was found in the AGPGART driver. The agpgenericallocpage() and agpgenericallocpages() functions did not zero out the memory pages theyallocate, which may later be available to user-space processes. This flawcould possibly lead to an information leak. (CVE-2009-1192, Low)These updated packages also fix the following bugs: "/proc/[pid]/maps" and "/proc/[pid]/smaps" can only be read by processes able to use the ptrace() call on a given process; however, certaininformation from "/proc/[pid]/stat" and "/proc/[pid]/wchan" could be usedto reconstruct memory maps, making it possible to bypass the Address SpaceLayout Randomization (ASLR) security feature. This update addresses thisissue. (BZ#499549) in some situations, the link count was not decreased when renaming unused files on NFS mounted file systems. This may have resulted in poorperformance. With this update, the link count is decreased in thesesituations, the same as is done for other file operations, such as unlinkand rmdir. (BZ#501802) tcpack() cleared the probesout variable even if there were outstanding packets. When low TCP keepalive intervals were used, this bug may havecaused problems, such as connections terminating, when using remote toolssuch as rsh and rlogin. (BZ#501754) off-by-one errors in the time normalization code could have caused clockgettime() to return one billion nanoseconds, rather than adding anextra second. This bug could have caused the name service cache daemon(nscd) to consume excessive CPU resources. (BZ#501800) a system panic could occur when one thread read "/proc/bus/input/devices" while another was removing a device. With this update, a mutex has beenadded to protect the inputdevlist and inputhandlerlist variables, whichresolves this issue. (BZ#501804) using netdump may have caused a kernel deadlock on some systems. (BZ#504565) the file system mask, which lists capabilities for users with a file system user ID (fsuid) of 0, was missing the CAPMKNOD andCAPLINUXIMMUTABLE capabilities. This could, potentially, allow users withan fsuid other than 0 to perform actions on some file system types thatwould otherwise be prevented. This update adds these capabilities. (BZ#497269)All Red Hat Enterprise Linux 4 users should upgrade to these updatedpackages, which contain backported patches to resolve these issues. Note:The system must be rebooted for this update to take effect.