RHSA-2011:0498: Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linuxoperating system.Security fixes: An integer overflow flaw in ibuverbspollcq() could allow a local, unprivileged user to cause a denial of service or escalate theirprivileges. (CVE-2010-4649, Important) An integer signedness flaw in drmmodesetctl() could allow a local, unprivileged user to cause a denial of service or escalate theirprivileges. (CVE-2011-1013, Important) The Radeon GPU drivers in the Linux kernel were missing sanity checks for the Anti Aliasing (AA) resolve register values which could allow a local,unprivileged user to cause a denial of service or escalate their privilegeson systems using a graphics card from the ATI Radeon R300, R400, or R500family of cards. (CVE-2011-1016, Important) A flaw in dccprcvstateprocess() could allow a remote attacker to cause a denial of service, even when the socket was already closed.(CVE-2011-1093, Important) A flaw in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation could allow a remote attacker to cause a denial of serviceif the sysctl "net.sctp.addipenable" and "authenable" variables wereturned on (they are off by default). (CVE-2011-1573, Important) A memory leak in the inotifyinit() system call. In some cases, it could leak a group, which could allow a local, unprivileged user to eventuallycause a denial of service. (CVE-2010-4250, Moderate) A missing validation of a null-terminated string data structure element in bnepsockioctl() could allow a local user to cause an information leakor a denial of service. (CVE-2011-1079, Moderate) An information leak in bcmconnect() in the Controller Area Network (CAN) Broadcast Manager implementation could allow a local, unprivileged user toleak kernel mode addresses in "/proc/net/can-bcm". (CVE-2010-4565, Low) A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA) implementation. When SELinux was disabled, adding an IMA rule whichwas supposed to be processed by SELinux would cause imamatchrules() toalways succeed, ignoring any remaining rules. (CVE-2011-0006, Low) A missing initialization flaw in the XFS file system implementation could lead to an information leak. (CVE-2011-0711, Low) Buffer overflow flaws in sndusbcaiaqaudioinit() and sndusbcaiaqmidiinit() could allow a local, unprivileged user withaccess to a Native Instruments USB audio device to cause a denial ofservice or escalate their privileges. (CVE-2011-0712, Low) The startcode and endcode values in "/proc/[pid]/stat" were not protected. In certain scenarios, this flaw could be used to defeat AddressSpace Layout Randomization (ASLR). (CVE-2011-0726, Low) A flaw in devload() could allow a local user who has the CAPNETADMIN capability to load arbitrary modules from "/lib/modules/", instead of onlynetdev modules. (CVE-2011-1019, Low) A flaw in ibuverbspollcq() could allow a local, unprivileged user to cause an information leak. (CVE-2011-1044, Low) A missing validation of a null-terminated string data structure element in doreplace() could allow a local user who has the CAPNETADMINcapability to cause an information leak. (CVE-2011-1080, Low)Red Hat would like to thank Vegard Nossum for reporting CVE-2010-4250;Vasiliy Kulikov for reporting CVE-2011-1079, CVE-2011-1019, andCVE-2011-1080; Dan Rosenberg for reporting CVE-2010-4565 and CVE-2011-0711;Rafael Dominguez Vega for reporting CVE-2011-0712; and Kees Cook forreporting CVE-2011-0726.This update also fixes various bugs and adds an enhancement. Documentationfor these changes will be available shortly from the Technical Notesdocument linked to in the References section.Users should upgrade to these updated packages, which contain backportedpatches to resolve these issues, and fix the bugs and add the enhancementnoted in the Technical Notes. The system must be rebooted for this updateto take effect.