RHSA-2012:0116: Moderate: kernel security and bug fix update

First published: Tue Feb 14 2012(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br>This update fixes the following security issues:<br><li> The proc file system could allow a local, unprivileged user to obtain</li> sensitive information or possibly cause integrity issues. (CVE-2011-1020,<br>Moderate)<br><li> Non-member VLAN (virtual LAN) packet handling for interfaces in</li> promiscuous mode and also using the be2net driver could allow an attacker<br>on the local network to cause a denial of service. (CVE-2011-3347,<br>Moderate)<br><li> A missing validation flaw was found in the Linux kernel's m_stop()</li> implementation. A local, unprivileged user could use this flaw to trigger<br>a denial of service. (CVE-2011-3637, Moderate)<br><li> A flaw was found in the Linux kernel in the way splitting two extents in</li> ext4_ext_convert_to_initialized() worked. A local, unprivileged user with<br>the ability to mount and unmount ext4 file systems could use this flaw to<br>cause a denial of service. (CVE-2011-3638, Moderate)<br><li> A NULL pointer dereference flaw was found in the way the Linux kernel's</li> key management facility handled user-defined key types. A local,<br>unprivileged user could use the keyctl utility to cause a denial of<br>service. (CVE-2011-4110, Moderate)<br>Red Hat would like to thank Kees Cook for reporting CVE-2011-1020; Somnath<br>Kotur for reporting CVE-2011-3347; and Zheng Liu for reporting<br>CVE-2011-3638.<br>This update also fixes several bugs. Documentation for these changes will<br>be available shortly from the Technical Notes document linked to in the<br>References section.<br>Users should upgrade to these updated packages, which contain backported<br>patches to correct these issues, and fix the bugs noted in the Technical<br>Notes. The system must be rebooted for this update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• anchor-id/RHSA-2012:0116
• package-manager/redhat