RHSA-2012:0333: Important: kernel-rt security and bug fix update

These packages contain the Linux kernel.Security fixes: SGIO ioctl SCSI requests on partitions or LVM volumes could be passed to the underlying block device, allowing a privileged user to bypassrestrictions and gain read and write access (and be able to issue otherSCSI commands) to the entire block device. (CVE-2011-4127, Important) A local, unprivileged user could use an integer overflow flaw in drmmodedirtyfbioctl() to cause a denial of service or escalate theirprivileges. (CVE-2012-0044, Important) A local, unprivileged user could use a flaw in the Performance Events implementation to cause a denial of service. (CVE-2011-2918, Moderate) A local, unprivileged user could use flaws in the XFS file system implementation to cause a denial of service or escalate their privileges bymounting a specially-crafted disk. (CVE-2011-4077, CVE-2012-0038, Moderate) A local, unprivileged user could use a flaw in the Out of Memory (OOM) killer to monopolize memory, have their process skipped by the OOM killer,or cause other tasks to be terminated. (CVE-2011-4097, Moderate) A local, unprivileged user could use a flaw in the key management facility to cause a denial of service. (CVE-2011-4110, Moderate) A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on theclient. (CVE-2011-4131, Moderate) A local attacker could use a flaw in the Journaling Block Device (JBD) to crash the system by mounting a specially-crafted ext3 or ext4 disk.(CVE-2011-4132, Moderate) A flaw in igmpheardquery() could allow an attacker, who is able to send certain IGMP (Internet Group Management Protocol) packets to a targetsystem, to cause a denial of service. (CVE-2012-0207, Moderate) If lock contention during signal sending occurred when in a software interrupt handler that is using the per-CPU debug stack, the task could bescheduled out on the realtime kernel, possibly leading to debug stackcorruption. A local, unprivileged user could use this flaw to cause adenial of service. (CVE-2012-0810, Moderate)Red Hat would like to thank Chen Haogang for reporting CVE-2012-0044;Wang Xi for reporting CVE-2012-0038; Shubham Goyal for reportingCVE-2011-4097; Andy Adamson for reporting CVE-2011-4131; and Simon McVittiefor reporting CVE-2012-0207.Bug fixes: When a sleeping task, waiting on a futex (fast userspace mutex), tried to get the spinlock(hb->lock) RT-mutex, if the owner of the futex releasedthe lock, the sleeping task was put on a futex proxy lock. Consequently,the sleeping task was blocked on two locks and eventually terminated in theBUGON() function. With this update, the WAKEUPINPROGRESS pseudo-lock hasbeen added to be used as a proxy lock. This pseudo-lock tells the sleepingtask that it is being woken up so that the task no longer tries to get thesecond lock. Now, the futex code works as expected and sleeping tasks nolonger crash in the described scenario. (BZ#784733) When the CONFIGCRYPTOFIPS configuration option was disabled, some services such as sshd and ipsec, while working properly, returned warningmessages regarding this missing option during start up. With this update,CONFIGCRYPTOFIPS has been enabled and no warning messages are nowreturned in the described scenario. (BZ#786145) Previously, when a read operation on a loop device failed, the data successfully read from the device was not cleared and could eventuallyleak. This bug has been fixed and all data are now properly cleared in thedescribed scenario. (BZ#761420) Due to an assembler-sourced object, the perf utility (from the perf-rt package) for AMD64 and Intel 64 architectures contained an executablestack. This update adds the ".note.GNU-stack" section definition to thebench/mem-memcpy-x86-64-asm.S component of perf, with all flags disabled,and perf no longer contains an executable stack, thus fixing this bug.(BZ#783570)