RHSA-2011:0330: Important: kernel-rt security and bug fix update

The kernel-rt packages contain the Linux kernel, the core of any Linuxoperating system.Security fixes: Missing boundary checks in the PPP over L2TP sockets implementation could allow a local, unprivileged user to cause a denial of service or escalatetheir privileges. (CVE-2010-4160, Important) Integer overflow in ibuverbspollcq() could allow a local, unprivileged user to cause a denial of service or escalate their privileges.(CVE-2010-4649, Important) Missing boundary check in dvbcaioctl() in the av7110 module. On systems using old DVB cards requiring the av7110 module, a local, unprivileged usercould use this flaw to cause a denial of service or escalate theirprivileges. (CVE-2011-0521, Important) Flaw in tcfactpolicedump() in the network traffic policing implementation could allow a local, unprivileged user to cause aninformation leak. (CVE-2010-3477, Moderate) Missing boundary checks in the block layer implementation could allow a local, unprivileged user to cause a denial of service. (CVE-2010-4162,CVE-2010-4163, CVE-2010-4668, Moderate) Divide-by-zero flaw in tcpselectinitialwindow() in the Linux kernel's TCP/IP protocol suite implementation could allow a local, unprivileged userto cause a denial of service. (CVE-2010-4165, Moderate) NULL pointer dereference flaw in the Bluetooth HCI UART driver could allow a local, unprivileged user to cause a denial of service.(CVE-2010-4242, Moderate) Flaw in the CPU time clocks implementation for the POSIX clock interface could allow a local, unprivileged user to cause a denial of service.(CVE-2010-4248, Moderate) Flaw in the garbage collector for AFUNIX sockets could allow a local, unprivileged user to trigger a denial of service (out-of-memory condition).(CVE-2010-4249, Moderate) Memory leak in the inotifyinit() system call. In some cases, it could leak a group, which could allow a local, unprivileged user to eventuallycause a denial of service. (CVE-2010-4250, Moderate) /sys/kernel/debug/acpi/custommethod had world-writable permissions, which could allow a local, unprivileged user to escalate their privileges.Note: The debugfs file system must be mounted locally to exploit thisissue. It is not mounted by default. (CVE-2010-4347, Moderate) Heap overflow in iowarriorwrite() could allow a user with access to an IO-Warrior USB device to cause a denial of service or escalate theirprivileges. (CVE-2010-4656, Moderate) Missing security check in the Linux kernel's implementation of the installspecialmapping routine could allow a local, unprivileged user tobypass the mmapminaddr protection mechanism. (CVE-2010-4346, Low) Information leak in bcmconnect() in the Controller Area Network (CAN) Broadcast Manager implementation could allow a local, unprivileged user toleak kernel mode addresses in /proc/net/can-bcm. (CVE-2010-4565, Low) A logic error in orinocoioctlsetauth() in the Linux kernel's ORiNOCO wireless extensions support implementation could render TKIPcountermeasures ineffective when it is enabled, as it enabled the cardinstead of shutting it down. (CVE-2010-4648, Low) Missing initialization flaw in ethtoolgetregs() could allow a local user who has the CAPNETADMIN capability to cause an information leak.(CVE-2010-4655, Low) Flaw in ibuverbspollcq() could allow a local, unprivileged user to cause an information leak. (CVE-2011-1044, Low)Red Hat would like to thank Dan Rosenberg for reporting CVE-2010-4160,CVE-2010-4162, CVE-2010-4163, CVE-2010-4668, and CVE-2010-4565; Steve Chenfor reporting CVE-2010-4165; Alan Cox for reporting CVE-2010-4242; VegardNossum for reporting CVE-2010-4249 and CVE-2010-4250; Kees Cook forreporting CVE-2010-4656 and CVE-2010-4655; and Tavis Ormandy for reportingCVE-2010-4346.This update also fixes three bugs. Documentation for these bug fixes willbe available shortly from the Technical Notes document linked to in theReferences section.