RHSA-2011:0833: Important: kernel security and bug fix update

First published: Tue May 31 2011(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br>This update fixes the following security issues:<br><li> A flaw in the dccp_rcv_state_process() function could allow a remote</li> attacker to cause a denial of service, even when the socket was already<br>closed. (CVE-2011-1093, Important)<br><li> Multiple buffer overflow flaws were found in the Linux kernel's</li> Management Module Support for Message Passing Technology (MPT) based<br>controllers. A local, unprivileged user could use these flaws to cause a<br>denial of service, an information leak, or escalate their privileges.<br>(CVE-2011-1494, CVE-2011-1495, Important)<br><li> A missing validation of a null-terminated string data structure element</li> in the bnep_sock_ioctl() function could allow a local user to cause an<br>information leak or a denial of service. (CVE-2011-1079, Moderate)<br><li> Missing error checking in the way page tables were handled in the Xen</li> hypervisor implementation could allow a privileged guest user to cause the<br>host, and the guests, to lock up. (CVE-2011-1166, Moderate)<br><li> A flaw was found in the way the Xen hypervisor implementation checked for</li> the upper boundary when getting a new event channel port. A privileged<br>guest user could use this flaw to cause a denial of service or escalate<br>their privileges. (CVE-2011-1763, Moderate)<br><li> The start_code and end_code values in "/proc/[pid]/stat" were not</li> protected. In certain scenarios, this flaw could be used to defeat Address<br>Space Layout Randomization (ASLR). (CVE-2011-0726, Low)<br><li> A missing initialization flaw in the sco_sock_getsockopt() function could</li> allow a local, unprivileged user to cause an information leak.<br>(CVE-2011-1078, Low)<br><li> A missing validation of a null-terminated string data structure element</li> in the do_replace() function could allow a local user who has the<br>CAP_NET_ADMIN capability to cause an information leak. (CVE-2011-1080, Low)<br><li> A buffer overflow flaw in the DEC Alpha OSF partition implementation in</li> the Linux kernel could allow a local attacker to cause an information leak<br>by mounting a disk that contains specially-crafted partition tables.<br>(CVE-2011-1163, Low)<br><li> Missing validations of null-terminated string data structure elements in</li> the do_replace(), compat_do_replace(), do_ipt_get_ctl(), do_ip6t_get_ctl(),<br>and do_arpt_get_ctl() functions could allow a local user who has the<br>CAP_NET_ADMIN capability to cause an information leak. (CVE-2011-1170,<br>CVE-2011-1171, CVE-2011-1172, Low)<br><li> A heap overflow flaw in the Linux kernel's EFI GUID Partition Table (GPT)</li> implementation could allow a local attacker to cause a denial of service<br>by mounting a disk that contains specially-crafted partition tables.<br>(CVE-2011-1577, Low)<br>Red Hat would like to thank Dan Rosenberg for reporting CVE-2011-1494 and<br>CVE-2011-1495; Vasiliy Kulikov for reporting CVE-2011-1079, CVE-2011-1078,<br>CVE-2011-1080, CVE-2011-1170, CVE-2011-1171, and CVE-2011-1172; Kees Cook<br>for reporting CVE-2011-0726; and Timo Warns for reporting CVE-2011-1163<br>and CVE-2011-1577.<br>This update also fixes several bugs. Documentation for these bug fixes will<br>be available shortly from the Technical Notes document linked to in the<br>References section.<br>Users should upgrade to these updated packages, which contain backported<br>patches to correct these issues, and fix the bugs noted in the Technical<br>Notes. The system must be rebooted for this update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• anchor-id/RHSA-2011:0833
• package-manager/redhat