RHSA-2011:0927: Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linuxoperating system.This update fixes the following security issues: An integer overflow flaw in ibuverbspollcq() could allow a local, unprivileged user to cause a denial of service or escalate theirprivileges. (CVE-2010-4649, Important) A race condition in the way new InfiniBand connections were set up could allow a remote user to cause a denial of service. (CVE-2011-0695,Important) A flaw in the Stream Control Transmission Protocol (SCTP) implementation could allow a remote attacker to cause a denial of service if the sysctl"net.sctp.addipenable" variable was turned on (it is off by default).(CVE-2011-1573, Important) Flaws in the AGPGART driver implementation when handling certain IOCTL commands could allow a local, unprivileged user to cause a denial ofservice or escalate their privileges. (CVE-2011-1745, CVE-2011-2022,Important) An integer overflow flaw in agpallocatememory() could allow a local, unprivileged user to cause a denial of service or escalate theirprivileges. (CVE-2011-1746, Important) A flaw allowed napireuseskb() to be called on VLAN (virtual LAN) packets. An attacker on the local network could trigger this flaw bysending specially-crafted packets to a target system, possibly causing adenial of service. (CVE-2011-1576, Moderate) An integer signedness error in nextpidmap() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-1593, Moderate) A flaw in the way the Xen hypervisor implementation handled CPUID instruction emulation during virtual machine exits could allow anunprivileged guest user to crash a guest. This only affects systems thathave an Intel x86 processor with the Intel VT-x extension enabled.(CVE-2011-1936, Moderate) A flaw in inetdiagbcaudit() could allow a local, unprivileged user to cause a denial of service (infinite loop). (CVE-2011-2213, Moderate) A missing initialization flaw in the XFS file system implementation could lead to an information leak. (CVE-2011-0711, Low) A flaw in ibuverbspollcq() could allow a local, unprivileged user to cause an information leak. (CVE-2011-1044, Low) A missing validation check was found in the signals implementation. A local, unprivileged user could use this flaw to send signals via thesigqueueinfo system call, with the sicode set to SITKILL and with spoofedprocess and user IDs, to other processes. Note: This flaw does not allowexisting permission checks to be bypassed; signals can only be sent if yourprivileges allow you to already do so. (CVE-2011-1182, Low) A heap overflow flaw in the EFI GUID Partition Table (GPT) implementation could allow a local attacker to cause a denial of service by mounting adisk containing specially-crafted partition tables. (CVE-2011-1776, Low) Structure padding in two structures in the Bluetooth implementation was not initialized properly before being copied to user-space, possiblyallowing local, unprivileged users to leak kernel stack memory touser-space. (CVE-2011-2492, Low)Red Hat would like to thank Jens Kuehnel for reporting CVE-2011-0695;Vasiliy Kulikov for reporting CVE-2011-1745, CVE-2011-2022, andCVE-2011-1746; Ryan Sweat for reporting CVE-2011-1576; Robert Swiecki forreporting CVE-2011-1593; Dan Rosenberg for reporting CVE-2011-2213 andCVE-2011-0711; Julien Tinnes of the Google Security Team for reportingCVE-2011-1182; Timo Warns for reporting CVE-2011-1776; and Marek Kroemekeand Filip Palian for reporting CVE-2011-2492.Bug fix documentation will be available shortly from the Technical Notesdocument linked to in the References.Users should upgrade to these updated packages, which contain backportedpatches to correct these issues, and fix the bugs noted in the TechnicalNotes. The system must be rebooted for this update to take effect.