RHSA-2009:1193: Important: kernel security and bug fix update

First published: Tue Aug 04 2009(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br>Security fixes:<br><li> the possibility of a timeout value overflow was found in the Linux kernel</li> high-resolution timers functionality, hrtimers. This could allow a local,<br>unprivileged user to execute arbitrary code, or cause a denial of service<br>(kernel panic). (CVE-2007-5966, Important)<br><li> a flaw was found in the Intel PRO/1000 network driver in the Linux</li> kernel. Frames with sizes near the MTU of an interface may be split across<br>multiple hardware receive descriptors. Receipt of such a frame could leak<br>through a validation check, leading to a corruption of the length check. A<br>remote attacker could use this flaw to send a specially-crafted packet that<br>would cause a denial of service or code execution. (CVE-2009-1385,<br>Important)<br><li> Michael Tokarev reported a flaw in the Realtek r8169 Ethernet driver in</li> the Linux kernel. This driver allowed interfaces using this driver to<br>receive frames larger than could be handled, which could lead to a remote<br>denial of service or code execution. (CVE-2009-1389, Important)<br><li> the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a</li> setuid or setgid program was executed. A local, unprivileged user could use<br>this flaw to bypass the mmap_min_addr protection mechanism and perform a<br>NULL pointer dereference attack, or bypass the Address Space Layout<br>Randomization (ASLR) security feature. (CVE-2009-1895, Important)<br><li> Ramon de Carvalho Valle reported two flaws in the Linux kernel eCryptfs</li> implementation. A local attacker with permissions to perform an eCryptfs<br>mount could modify the metadata of the files in that eCrypfts mount to<br>cause a buffer overflow, leading to a denial of service or privilege<br>escalation. (CVE-2009-2406, CVE-2009-2407, Important)<br><li> Konstantin Khlebnikov discovered a race condition in the ptrace</li> implementation in the Linux kernel. This race condition can occur when the<br>process tracing and the process being traced participate in a core dump. A<br>local, unprivileged user could use this flaw to trigger a deadlock,<br>resulting in a partial denial of service. (CVE-2009-1388, Moderate)<br>Bug fixes (see References below for a link to more detailed notes):<br><li> possible dom0 crash when a Xen para-virtualized guest was installed while</li> another para-virtualized guest was rebooting. (BZ#497812)<br><li> no directory removal audit record if the directory and its subtree were</li> recursively watched by an audit rule. (BZ#507561)<br><li> running "echo 1 &gt; /proc/sys/vm/drop_caches" under high memory load could</li> cause a kernel panic. (BZ#503692)<br><li> on 32-bit systems, core dumps for some multithreaded applications did not</li> include all thread information. (BZ#505322)<br><li> a stack buffer used by get_event_name() was too small for nul terminator</li> sprintf() writes. This could lead to an invalid pointer or kernel panic.<br>(BZ#506906)<br><li> when using the aic94xx driver, systems with SATA drives may not boot due</li> to a libsas bug. (BZ#506029)<br><li> Wacom Cintiq 21UX and Intuos stylus buttons were handled incorrectly when</li> moved away from and back to these tablets. (BZ#508275)<br><li> CPU "soft lockup" messages and possibe system hangs on systems with</li> certain Broadcom network devices and running the Linux kernel from the<br>kernel-xen package. (BZ#503689)<br><li> on 64-bit PowerPC, getitimer() failed for programs using the ITIMER_REAL</li> timer that were also compiled for 64-bit systems. This caused such programs<br>to abort. (BZ#510018)<br><li> write operations could be blocked even when using O_NONBLOCK. (BZ#510239)</li> <li> the "pci=nomsi" option was required for installing and booting Red Hat</li> Enterprise Linux 5.2 on systems with VIA VT3364 chipsets. (BZ#507529)<br><li> shutting down, destroying, or migrating Xen guests with large amounts of</li> memory could cause other guests to be temporarily unresponsive. (BZ#512311)<br>Users should upgrade to these updated packages, which contain backported<br>patches to correct these issues. Systems must be rebooted for this update<br>to take effect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2009:1193
• agent/software-canonical-lookup
• package-manager/redhat