RHSA-2009:1540: Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages contain the Linux kernel, the core of any Linuxoperating system.Security fixes: the ADDRCOMPATLAYOUT and MMAPPAGEZERO flags were not cleared when a setuid or setgid program was executed. A local, unprivileged user could usethis flaw to bypass the mmapminaddr protection mechanism and perform aNULL pointer dereference attack, or bypass the Address Space LayoutRandomization (ASLR) security feature. (CVE-2009-1895, Important) a system with SELinux enforced was more permissive in allowing local users in the unconfinedt domain to map low memory areas even if themmapminaddr restriction was enabled. This could aid in the localexploitation of NULL pointer dereference bugs. (CVE-2009-2695, Important) missing initialization flaws were found in getname() implementations in numerous network protocol implementations in the Linux kernel. Certaindata structures in these getname() implementations were not initializedproperly before being copied to user-space. These flaws could lead to aninformation leak. (CVE-2009-3002, Important) a NULL pointer dereference flaw was found in each of the following functions in the Linux kernel: pipereadopen(), pipewriteopen(), andpiperdwropen(). When the mutex lock is not held, the ipipe pointer couldbe released by other processes before it is used to update the pipe'sreader and writer counters. This could lead to a local denial of service orprivilege escalation. (CVE-2009-3547, Important) a flaw was found in the Realtek r8169 Ethernet driver in the Linux kernel. pciunmapsingle() presented a memory leak that could lead to IOMMUspace exhaustion and a system crash. An attacker on the local network couldabuse this flaw by using jumbo frames for large amounts of network traffic.(CVE-2009-3613, Important) NULL pointer dereference flaws were found in the r128 driver in the Linux kernel. Checks to test if the Concurrent Command Engine state wasinitialized were missing in private IOCTL functions. An attacker could usethese flaws to cause a local denial of service or escalate theirprivileges. (CVE-2009-3620, Important) Kees Cook and Steve Beattie discovered a race condition in the /proc code in the Linux kernel. This could lead to information in the"/proc/[pid]/maps" and "/proc/[pid]/smaps" files being leaked to users (whowould otherwise not have access to this information) during ELF loading.This could help a local attacker bypass the ASLR security feature.(CVE-2009-2691, Moderate) a NULL pointer dereference flaw was found in the md driver in the Linux kernel. If the suspendlo or suspendhi file in "/sys/" is modified whenthe disk array is inactive, it could lead to a local denial of service orprivilege escalation. By default, only root can write to these two files.(CVE-2009-2849, Moderate) an information leak was found in the Linux kernel. On AMD64 systems, 32-bit processes could access and read certain 64-bit registers bytemporarily switching themselves to 64-bit mode. (CVE-2009-2910, Moderate) padding data in several core network structures was not initialized properly before being sent to user-space, possibly leading to informationleaks. (CVE-2009-3228, CVE-2009-3612, Moderate) the unixstreamconnect() function in the Linux kernel did not check if a UNIX domain socket was in the shutdown state. This could lead to adeadlock. A local, unprivileged user could use this flaw to cause a denialof service. (CVE-2009-3621, Moderate)These updated packages also include bug fixes and enhancements. Users aredirected to the Realtime Security Update Release Notes for version 1.1 forinformation on these changes, which will be available shortly from: http://www.redhat.com/docs/en-US/RedHatEnterpriseMRG/ Users should upgrade to these updated packages, which contain backportedpatches to correct these issues and add enhancements. The system must berebooted for this update to take effect.