RHSA-2010:0076: Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linuxoperating system.This update fixes the following security issues: an array index error was found in the gdth driver in the Linux kernel. A local user could send a specially-crafted IOCTL request that would cause adenial of service or, possibly, privilege escalation. (CVE-2009-3080,Important) a flaw was found in the collectrxframe() function in the HiSax ISDN driver (hfcusb) in the Linux kernel. An attacker could use this flaw tosend a specially-crafted HDLC packet that could trigger a buffer out ofbounds, possibly resulting in a denial of service. (CVE-2009-4005,Important) permission issues were found in the megaraidsas driver (for SAS based RAID controllers) in the Linux kernel. The "dbglvl" and "pollmodeio"files on the sysfs file system ("/sys/") had world-writable permissions.This could allow local, unprivileged users to change the behavior of thedriver. (CVE-2009-3889, CVE-2009-3939, Moderate) a buffer overflow flaw was found in the hfsbnoderead() function in the HFS file system implementation in the Linux kernel. This could lead to adenial of service if a user browsed a specially-crafted HFS file system,for example, by running "ls". (CVE-2009-4020, Low)This update also fixes the following bugs: if a process was using ptrace() to trace a multi-threaded process, and that multi-threaded process dumped its core, the process performing thetrace could hang in wait4(). This issue could be triggered by running"strace -f" on a multi-threaded process that was dumping its core,resulting in the strace command hanging. (BZ#555869) a bug in the ptrace() implementation could have, in some cases, caused ptracedetach() to create a zombie process if the process being tracedwas terminated with a SIGKILL signal. (BZ#555869) the RHSA-2010:0020 update resolved an issue (CVE-2009-4537) in the Realtek r8169 Ethernet driver. This update implements a better solution forthat issue. Note: This is not a security regression. The original fix wascomplete. This update is adding the official upstream fix. (BZ#556406)Users should upgrade to these updated packages, which contain backportedpatches to correct these issues. The system must be rebooted for thisupdate to take effect.