RHSA-2011:0498: Important: kernel security, bug fix, and enhancement update

First published: Tue May 10 2011(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br>Security fixes:<br><li> An integer overflow flaw in ib_uverbs_poll_cq() could allow a local,</li> unprivileged user to cause a denial of service or escalate their<br>privileges. (CVE-2010-4649, Important)<br><li> An integer signedness flaw in drm_modeset_ctl() could allow a local,</li> unprivileged user to cause a denial of service or escalate their<br>privileges. (CVE-2011-1013, Important)<br><li> The Radeon GPU drivers in the Linux kernel were missing sanity checks for</li> the Anti Aliasing (AA) resolve register values which could allow a local,<br>unprivileged user to cause a denial of service or escalate their privileges<br>on systems using a graphics card from the ATI Radeon R300, R400, or R500<br>family of cards. (CVE-2011-1016, Important)<br><li> A flaw in dccp_rcv_state_process() could allow a remote attacker to</li> cause a denial of service, even when the socket was already closed.<br>(CVE-2011-1093, Important)<br><li> A flaw in the Linux kernel's Stream Control Transmission Protocol (SCTP)</li> implementation could allow a remote attacker to cause a denial of service<br>if the sysctl "net.sctp.addip_enable" and "auth_enable" variables were<br>turned on (they are off by default). (CVE-2011-1573, Important)<br><li> A memory leak in the inotify_init() system call. In some cases, it could</li> leak a group, which could allow a local, unprivileged user to eventually<br>cause a denial of service. (CVE-2010-4250, Moderate)<br><li> A missing validation of a null-terminated string data structure element</li> in bnep_sock_ioctl() could allow a local user to cause an information leak<br>or a denial of service. (CVE-2011-1079, Moderate)<br><li> An information leak in bcm_connect() in the Controller Area Network (CAN)</li> Broadcast Manager implementation could allow a local, unprivileged user to<br>leak kernel mode addresses in "/proc/net/can-bcm". (CVE-2010-4565, Low)<br><li> A flaw was found in the Linux kernel's Integrity Measurement Architecture</li> (IMA) implementation. When SELinux was disabled, adding an IMA rule which<br>was supposed to be processed by SELinux would cause ima_match_rules() to<br>always succeed, ignoring any remaining rules. (CVE-2011-0006, Low)<br><li> A missing initialization flaw in the XFS file system implementation could</li> lead to an information leak. (CVE-2011-0711, Low)<br><li> Buffer overflow flaws in snd_usb_caiaq_audio_init() and</li> snd_usb_caiaq_midi_init() could allow a local, unprivileged user with<br>access to a Native Instruments USB audio device to cause a denial of<br>service or escalate their privileges. (CVE-2011-0712, Low)<br><li> The start_code and end_code values in "/proc/[pid]/stat" were not</li> protected. In certain scenarios, this flaw could be used to defeat Address<br>Space Layout Randomization (ASLR). (CVE-2011-0726, Low)<br><li> A flaw in dev_load() could allow a local user who has the CAP_NET_ADMIN</li> capability to load arbitrary modules from "/lib/modules/", instead of only<br>netdev modules. (CVE-2011-1019, Low)<br><li> A flaw in ib_uverbs_poll_cq() could allow a local, unprivileged user to</li> cause an information leak. (CVE-2011-1044, Low)<br><li> A missing validation of a null-terminated string data structure element</li> in do_replace() could allow a local user who has the CAP_NET_ADMIN<br>capability to cause an information leak. (CVE-2011-1080, Low)<br>Red Hat would like to thank Vegard Nossum for reporting CVE-2010-4250;<br>Vasiliy Kulikov for reporting CVE-2011-1079, CVE-2011-1019, and<br>CVE-2011-1080; Dan Rosenberg for reporting CVE-2010-4565 and CVE-2011-0711;<br>Rafael Dominguez Vega for reporting CVE-2011-0712; and Kees Cook for<br>reporting CVE-2011-0726.<br>This update also fixes various bugs and adds an enhancement. Documentation<br>for these changes will be available shortly from the Technical Notes<br>document linked to in the References section.<br>Users should upgrade to these updated packages, which contain backported<br>patches to resolve these issues, and fix the bugs and add the enhancement<br>noted in the Technical Notes. The system must be rebooted for this update<br>to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2011:0498
• agent/weakness
• agent/severity
• agent/title
• agent/references
• agent/tags
• agent/description
• agent/type
• agent/event
• agent/first-publish-date
• agent/softwarecombine
• agent/remedy
• agent/last-modified-date
• package-manager/redhat