RHSA-2012:0010: Important: kernel-rt security and bug fix update

First published: Tue Jan 10 2012(Updated: )

The kernel-rt packages contain the Linux kernel, the core of any Linux<br>operating system.<br>This update fixes the following security issues:<br><li> A malicious CIFS (Common Internet File System) server could send a</li> specially-crafted response to a directory read request that would result in<br>a denial of service or privilege escalation on a system that has a CIFS<br>share mounted. (CVE-2011-3191, Important)<br><li> The way fragmented IPv6 UDP datagrams over the bridge with UDP</li> Fragmentation Offload (UFO) functionality on were handled could allow a<br>remote attacker to cause a denial of service. (CVE-2011-4326, Important)<br><li> GRO (Generic Receive Offload) fields could be left in an inconsistent</li> state. An attacker on the local network could use this flaw to cause a<br>denial of service. GRO is enabled by default in all network drivers that<br>support it. (CVE-2011-2723, Moderate)<br><li> IPv4 and IPv6 protocol sequence number and fragment ID generation could</li> allow a man-in-the-middle attacker to inject packets and possibly hijack<br>connections. Protocol sequence numbers and fragment IDs are now more<br>random. (CVE-2011-3188, Moderate)<br><li> A flaw in the FUSE (Filesystem in Userspace) implementation could allow</li> a local user in the fuse group who has access to mount a FUSE file system<br>to cause a denial of service. (CVE-2011-3353, Moderate)<br><li> A flaw in the b43 driver. If a system had an active wireless interface</li> that uses the b43 driver, an attacker able to send a specially-crafted<br>frame to that interface could cause a denial of service. (CVE-2011-3359,<br>Moderate)<br><li> A flaw in the way CIFS shares with DFS referrals at their root were</li> handled could allow an attacker on the local network, who is able to deploy<br>a malicious CIFS server, to create a CIFS network share that, when mounted,<br>would cause the client system to crash. (CVE-2011-3363, Moderate)<br><li> A flaw in the m_stop() implementation could allow a local, unprivileged</li> user to trigger a denial of service. (CVE-2011-3637, Moderate)<br><li> Flaws in ghash_update() and ghash_final() could allow a local,</li> unprivileged user to cause a denial of service. (CVE-2011-4081, Moderate)<br><li> A flaw in the key management facility could allow a local, unprivileged</li> user to cause a denial of service via the keyctl utility. (CVE-2011-4110,<br>Moderate)<br><li> A flaw in the Journaling Block Device (JBD) could allow a local attacker</li> to crash the system by mounting a specially-crafted ext3 or ext4 disk.<br>(CVE-2011-4132, Moderate)<br><li> A flaw in the way memory containing security-related data was handled in</li> tpm_read() could allow a local, unprivileged user to read the results of a<br>previously run TPM command. (CVE-2011-1162, Low)<br><li> I/O statistics from the taskstats subsystem could be read without any</li> restrictions, which could allow a local, unprivileged user to gather<br>confidential information, such as the length of a password used in a<br>process. (CVE-2011-2494, Low)<br><li> Flaws in tpacket_rcv() and packet_recvmsg() could allow a local,</li> unprivileged user to leak information to user-space. (CVE-2011-2898, Low)<br>Red Hat would like to thank Darren Lavender for reporting CVE-2011-3191;<br>Brent Meshier for reporting CVE-2011-2723; Dan Kaminsky for reporting<br>CVE-2011-3188; Yogesh Sharma for reporting CVE-2011-3363; Nick Bowler for<br>reporting CVE-2011-4081; Peter Huewe for reporting CVE-2011-1162; and<br>Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.<br>This update also fixes the following bugs:<br><li> Previously, a mismatch in the build-id of the kernel-rt and the one in</li> the related debuginfo package caused failures in SystemTap and perf.<br>(BZ#768413)<br><li> IBM x3650m3 systems were not able to boot the MRG Realtime kernel because</li> they require a pmcraid driver that was not available. The pmcraid driver is<br>included in this update. (BZ#753992)<br>Users should upgrade to these updated packages, which correct these issues.<br>The system must be rebooted for this update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2012:0010
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• package-manager/redhat