RHSA-2009:1438: Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linuxoperating system.This update fixes the following security issues: the ADDRCOMPATLAYOUT and MMAPPAGEZERO flags were not cleared when a setuid or setgid program was executed. A local, unprivileged user could usethis flaw to bypass the mmapminaddr protection mechanism and perform aNULL pointer dereference attack, or bypass the Address Space LayoutRandomization (ASLR) security feature. (CVE-2009-1895, Important) it was discovered that, when executing a new process, the clearchildtid pointer in the Linux kernel is not cleared. If this pointer points to awritable portion of the memory of the new program, the kernel could corruptfour bytes of memory, possibly leading to a local denial of service orprivilege escalation. (CVE-2009-2848, Important) Solar Designer reported a missing capability check in the z90crypt driver in the Linux kernel. This missing check could allow a local user with aneffective user ID (euid) of 0 to bypass intended capability restrictions.(CVE-2009-1883, Moderate) a flaw was found in the way the dosigaltstack() function in the Linux kernel copies the stackt structure to user-space. On 64-bit machines, thisflaw could lead to a four-byte information leak. (CVE-2009-2847, Moderate)This update also fixes the following bugs: the gcc flag "-fno-delete-null-pointer-checks" was added to the kernel build options. This prevents gcc from optimizing out NULL pointer checksafter the first use of a pointer. NULL pointer bugs are often exploited byattackers. Keeping these checks is a safety measure. (BZ#517964) the Emulex LPFC driver has been updated to version 8.0.16.47, which fixes a memory leak that caused memory allocation failures and systemhangs. (BZ#513192) an error in the MPT Fusion driver makefile caused CSMI ioctls to not work with Serial Attached SCSI devices. (BZ#516184) this update adds the mmapminaddr tunable and restriction checks to help prevent unprivileged users from creating new memory mappings below theminimum address. This can help prevent the exploitation of NULL pointerdeference bugs. Note that mmapminaddr is set to zero (disabled) bydefault for backwards compatibility. (BZ#517904) time-outs resulted in I/O errors being logged to "/var/log/messages" when running "mt erase" on tape drives using certain LSI MegaRAID SAS adapters,preventing the command from completing. The megaraidsas driver's timeoutvalue is now set to the OS layer value. (BZ#517965) a locking issue caused the qla2xxx ioctl module to hang after encountering errors. This locking issue has been corrected. This ioctlmodule is used by the QLogic SAN management tools, such as SANsurfer andscli. (BZ#519428) when a RAID 1 array that uses the mptscsi driver and the LSI 1030 controller became degraded, the whole array was detected as being offline,which could cause kernel panics at boot or data loss. (BZ#517295) on 32-bit architectures, if a file was held open and frequently written for more than 25 days, it was possible that the kernel would stop flushingthose writes to storage. (BZ#515255) a memory allocation bug in ibmthca prevented the driver from loading if it was loaded with large values for the "nummpt=" and "nummtt=" options.(BZ#518707) with this update, getrandomint() is more random and no longer uses a common seed value, reducing the possibility of predicting the valuesreturned. (BZ#519692) a bug in ptraceunlink() caused it to create deadlocked and unkillable processes. (BZ#519446) previously, multiple threads using the fcntl() FSETLK command to synchronize file access caused a deadlock in posixlocksdeadlock(). Thiscould cause a system hang. (BZ#519429)Users should upgrade to these updated packages, which contain backportedpatches to correct these issues. The system must be rebooted for thisupdate to take effect.