RHSA-2012:1491: Important: kernel-rt security and bug fix update

First published: Tue Dec 04 2012(Updated: )

The kernel-rt packages contain the Linux kernel, the core of any Linux<br>operating system.<br>This update fixes the following security issues:<br><li> A flaw was found in the way Netlink messages without SCM_CREDENTIALS</li> (used for authentication) data set were handled. When not explicitly set,<br>the data was sent but with all values set to 0, including the process ID<br>and user ID, causing the Netlink message to appear as if it were sent with<br>root privileges. A local, unprivileged user could use this flaw to send<br>spoofed Netlink messages to an application, possibly resulting in the<br>application performing privileged operations if it relied on<br>SCM_CREDENTIALS data for the authentication of Netlink messages.<br>(CVE-2012-3520, Important)<br><li> A race condition was found in the way asynchronous I/O and fallocate()</li> interacted when using the ext4 file system. A local, unprivileged user<br>could use this flaw to expose random data from an extent whose data blocks<br>have not yet been written, and thus contain data from a deleted file.<br>(CVE-2012-4508, Important)<br><li> A use-after-free flaw was found in the Linux kernel's memory management</li> subsystem in the way quota handling for huge pages was performed. A local,<br>unprivileged user could use this flaw to cause a denial of service or,<br>potentially, escalate their privileges. (CVE-2012-2133, Moderate)<br><li> A use-after-free flaw was found in the madvise() system call</li> implementation in the Linux kernel. A local, unprivileged user could use<br>this flaw to cause a denial of service or, potentially, escalate their<br>privileges. (CVE-2012-3511, Moderate)<br><li> A divide-by-zero flaw was found in the TCP Illinois congestion control</li> algorithm implementation in the Linux kernel. If the TCP Illinois<br>congestion control algorithm were in use (the sysctl<br>net.ipv4.tcp_congestion_control variable set to "illinois"), a local,<br>unprivileged user could trigger this flaw and cause a denial of service.<br>(CVE-2012-4565, Moderate)<br><li> An information leak flaw was found in the uname() system call</li> implementation in the Linux kernel. A local, unprivileged user could use<br>this flaw to leak kernel stack memory to user-space by setting the UNAME26<br>personality and then calling the uname() system call. (CVE-2012-0957, Low)<br><li> Buffer overflow flaws were found in the udf_load_logicalvol() function in</li> the Universal Disk Format (UDF) file system implementation in the Linux<br>kernel. An attacker with physical access to a system could use these flaws<br>to cause a denial of service or escalate their privileges. (CVE-2012-3400,<br>Low)<br><li> A flaw was found in the way the msg_namelen variable in the rds_recvmsg()</li> function of the Linux kernel's Reliable Datagram Sockets (RDS) protocol<br>implementation was initialized. A local, unprivileged user could use this<br>flaw to leak kernel stack memory to user-space. (CVE-2012-3430, Low)<br>Red Hat would like to thank Pablo Neira Ayuso for reporting CVE-2012-3520;<br>Theodore Ts'o for reporting CVE-2012-4508; Shachar Raindel for reporting<br>CVE-2012-2133; and Kees Cook for reporting CVE-2012-0957. Upstream<br>acknowledges Dmitry Monakhov as the original reporter of CVE-2012-4508. The<br>CVE-2012-4565 issue was discovered by Rodrigo Freire of Red Hat, and the<br>CVE-2012-3430 issue was discovered by the Red Hat InfiniBand team.<br>This update also fixes multiple bugs. Documentation for these changes will<br>be available shortly from the Technical Notes document linked to in the<br>References section.<br>Users should upgrade to these updated packages, which upgrade the kernel-rt<br>kernel to version kernel-rt-3.2.33-rt50, and correct these issues. The<br>system must be rebooted for this update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• anchor-id/RHSA-2012:1491
• package-manager/redhat