RHSA-2011:1465: Important: kernel security and bug fix update

First published: Tue Nov 22 2011(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br>This update fixes the following security issues:<br><li> IPv6 fragment identification value generation could allow a remote</li> attacker to disrupt a target system's networking, preventing legitimate<br>users from accessing its services. (CVE-2011-2699, Important)<br><li> A signedness issue was found in the Linux kernel's CIFS (Common Internet</li> File System) implementation. A malicious CIFS server could send a<br>specially-crafted response to a directory read request that would result in<br>a denial of service or privilege escalation on a system that has a CIFS<br>share mounted. (CVE-2011-3191, Important)<br><li> A flaw was found in the way the Linux kernel handled fragmented IPv6 UDP</li> datagrams over the bridge with UDP Fragmentation Offload (UFO)<br>functionality on. A remote attacker could use this flaw to cause a denial<br>of service. (CVE-2011-4326, Important)<br><li> The way IPv4 and IPv6 protocol sequence numbers and fragment IDs were</li> generated could allow a man-in-the-middle attacker to inject packets and<br>possibly hijack connections. Protocol sequence numbers and fragment IDs are<br>now more random. (CVE-2011-3188, Moderate)<br><li> A buffer overflow flaw was found in the Linux kernel's FUSE (Filesystem</li> in Userspace) implementation. A local user in the fuse group who has access<br>to mount a FUSE file system could use this flaw to cause a denial of<br>service. (CVE-2011-3353, Moderate)<br><li> A flaw was found in the b43 driver in the Linux kernel. If a system had</li> an active wireless interface that uses the b43 driver, an attacker able to<br>send a specially-crafted frame to that interface could cause a denial of<br>service. (CVE-2011-3359, Moderate)<br><li> A flaw was found in the way CIFS shares with DFS referrals at their root</li> were handled. An attacker on the local network who is able to deploy a<br>malicious CIFS server could create a CIFS network share that, when mounted,<br>would cause the client system to crash. (CVE-2011-3363, Moderate)<br><li> A flaw was found in the way the Linux kernel handled VLAN 0 frames with</li> the priority tag set. When using certain network drivers, an attacker on<br>the local network could use this flaw to cause a denial of service.<br>(CVE-2011-3593, Moderate)<br><li> A flaw in the way memory containing security-related data was handled in</li> tpm_read() could allow a local, unprivileged user to read the results of a<br>previously run TPM command. (CVE-2011-1162, Low)<br><li> A heap overflow flaw was found in the Linux kernel's EFI GUID Partition</li> Table (GPT) implementation. A local attacker could use this flaw to cause<br>a denial of service by mounting a disk that contains specially-crafted<br>partition tables. (CVE-2011-1577, Low)<br><li> The I/O statistics from the taskstats subsystem could be read without</li> any restrictions. A local, unprivileged user could use this flaw to gather<br>confidential information, such as the length of a password used in a<br>process. (CVE-2011-2494, Low)<br><li> It was found that the perf tool, a part of the Linux kernel's Performance</li> Events implementation, could load its configuration file from the current<br>working directory. If a local user with access to the perf tool were<br>tricked into running perf in a directory that contains a specially-crafted<br>configuration file, it could cause perf to overwrite arbitrary files and<br>directories accessible to that user. (CVE-2011-2905, Low)<br>Red Hat would like to thank Fernando Gont for reporting CVE-2011-2699;<br>Darren Lavender for reporting CVE-2011-3191; Dan Kaminsky for reporting<br>CVE-2011-3188; Yogesh Sharma for reporting CVE-2011-3363; Gideon Naim for<br>reporting CVE-2011-3593; Peter Huewe for reporting CVE-2011-1162; Timo<br>Warns for reporting CVE-2011-1577; and Vasiliy Kulikov of Openwall for<br>reporting CVE-2011-2494.<br>This update also fixes various bugs. Documentation for these changes will<br>be available shortly from the Technical Notes document linked to in the<br>References section.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• anchor-id/RHSA-2011:1465
• package-manager/redhat