RHSA-2010:0631: Important: kernel-rt security and bug fix update

First published: Tue Aug 17 2010(Updated: )

These packages contain the Linux kernel, the core of any Linux operating system. Security fixes: <li> unsafe sprintf() use in the Bluetooth implementation. Creating a large</li> number of Bluetooth L2CAP, SCO, or RFCOMM sockets could result in arbitrary memory pages being overwritten, allowing a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2010-1084, Important) <li> a flaw in the Unidirectional Lightweight Encapsulation implementation,</li> allowing a remote attacker to send a specially-crafted ISO MPEG-2 Transport Stream frame to a target system, resulting in a denial of service. (CVE-2010-1086, Important) <li> NULL pointer dereference in nfs_wb_page_cancel(), allowing a local user</li> on a system that has an NFS-mounted file system to cause a denial of service or escalate their privileges on that system. (CVE-2010-1087, Important) <li> flaw in sctp_process_unk_param(), allowing a remote attacker to send a</li> specially-crafted SCTP packet to an SCTP listening port on a target system, causing a denial of service. (CVE-2010-1173, Important) <li> race condition between finding a keyring by name and destroying a freed</li> keyring in the key management facility, allowing a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2010-1437, Important) <li> systems using the kernel NFS server to export a shared memory file system</li> and that have the sysctl overcommit_memory variable set to never overcommit (a value of 2; by default, it is set to 0), may experience a NULL pointer dereference, allowing a local, unprivileged user to cause a denial of service or escalate their privileges. (CVE-2008-7256, CVE-2010-1643, Important) <li> when an application has a stack overflow, the stack could silently</li> overwrite another memory mapped area instead of a segmentation fault occurring, which could cause an application to execute arbitrary code. (CVE-2010-2240, Important) <li> flaw in CIFSSMBWrite() could allow a remote attacker to send a</li> specially-crafted SMB response packet to a target CIFS client, resulting in a denial of service. (CVE-2010-2248, Important) <li> buffer overflow flaws in the kernel's implementation of the server-side</li> XDR for NFSv4 could allow an attacker on the local network to send a specially-crafted large compound request to the NFSv4 server, possibly resulting in a denial of service or code execution. (CVE-2010-2521, Important) <li> NULL pointer dereference in the firewire-ohci driver used for OHCI</li> compliant IEEE 1394 controllers could allow a local, unprivileged user with access to /dev/fw* files to issue certain IOCTL calls, causing a denial of service or privilege escalation. The FireWire modules are blacklisted by default. If enabled, only root has access to the files noted above by default. (CVE-2009-4138, Moderate) <li> flaw in the link_path_walk() function. Using the file descriptor</li> returned by open() with the O_NOFOLLOW flag on a subordinate NFS-mounted file system, could result in a NULL pointer dereference, causing a denial of service or privilege escalation. (CVE-2010-1088, Moderate) <li> memory leak in release_one_tty() could allow a local, unprivileged user</li> to cause a denial of service. (CVE-2010-1162, Moderate) <li> information leak in the USB implementation. Certain USB errors could</li> result in an uninitialized kernel buffer being sent to user-space. An attacker with physical access to a target system could use this flaw to cause an information leak. (CVE-2010-1083, Low) Red Hat would like to thank Neil Brown for reporting CVE-2010-1084; Ang Way Chuang for reporting CVE-2010-1086; Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; the X.Org security team for reporting CVE-2010-2240, with upstream acknowledging Rafal Wojtczuk as the original reporter; and Marcus Meissner for reporting CVE-2010-1083.

Affected Software	Affected Version	How to fix

RHSA-2010:0631: Important: kernel-rt security and bug fix update

Never miss a vulnerability like this again

Reference Links

Company

Resources

Contact