RHSA-2013:0744: Important: kernel security and bug fix update

Security: An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the Intel i915 driver in the Linux kernel handled theallocation of the buffer used for relocation copies. A local user withconsole access could use this flaw to cause a denial of service or escalatetheir privileges. (CVE-2013-0913, Important) A buffer overflow flaw was found in the way UTF-8 characters were converted to UTF-16 in the utf8stoutf16s() function of the Linux kernel'sFAT file system implementation. A local user able to mount a FAT filesystem with the "utf8=1" option could use this flaw to crash the system or,potentially, to escalate their privileges. (CVE-2013-1773, Important) A flaw was found in the way KVM handled guest time updates when the buffer the guest registered by writing to the MSRKVMSYSTEMTIME machinestate register (MSR) crossed a page boundary. A privileged guest user coulduse this flaw to crash the host or, potentially, escalate their privileges,allowing them to execute arbitrary code at the host kernel level.(CVE-2013-1796, Important) A potential use-after-free flaw was found in the way KVM handled guest time updates when the GPA (guest physical address) the guest registered bywriting to the MSRKVMSYSTEMTIME machine state register (MSR) fell into amovable or removable memory region of the hosting user-space process (bydefault, QEMU-KVM) on the host. If that memory region is deregistered fromKVM using KVMSETUSERMEMORYREGION and the allocated virtual memoryreused, a privileged guest user could potentially use this flaw toescalate their privileges on the host. (CVE-2013-1797, Important) A flaw was found in the way KVM emulated IOAPIC (I/O Advanced Programmable Interrupt Controller). A missing validation check in theioapicreadindirect() function could allow a privileged guest user tocrash the host, or read a substantial portion of host kernel memory.(CVE-2013-1798, Important) A race condition in installuserkeyrings(), leading to a NULL pointer dereference, was found in the key management facility. A local,unprivileged user could use this flaw to cause a denial of service.(CVE-2013-1792, Moderate) A NULL pointer dereference in the XFRM implementation could allow a local user who has the CAPNETADMIN capability to cause a denial of service.(CVE-2013-1826, Moderate) A NULL pointer dereference in the Datagram Congestion Control Protocol (DCCP) implementation could allow a local user to cause a denial ofservice. (CVE-2013-1827, Moderate) Information leak flaws in the XFRM implementation could allow a local user who has the CAPNETADMIN capability to leak kernel stack memory touser-space. (CVE-2012-6537, Low) Two information leak flaws in the Asynchronous Transfer Mode (ATM) subsystem could allow a local, unprivileged user to leak kernel stackmemory to user-space. (CVE-2012-6546, Low) An information leak was found in the TUN/TAP device driver in the networking implementation. A local user with access to a TUN/TAP virtualinterface could use this flaw to leak kernel stack memory to user-space.(CVE-2012-6547, Low) An information leak in the Bluetooth implementation could allow a local user who has the CAPNETADMIN capability to leak kernel stack memory touser-space. (CVE-2013-0349, Low) A use-after-free flaw was found in the tmpfs implementation. A local user able to mount and unmount a tmpfs file system could use this flaw to causea denial of service or, potentially, escalate their privileges.(CVE-2013-1767, Low) A NULL pointer dereference was found in the Linux kernel's USB Inside Out Edgeport Serial Driver implementation. An attacker with physical access toa system could use this flaw to cause a denial of service. (CVE-2013-1774,Low)Red Hat would like to thank Andrew Honig of Google for reportingCVE-2013-1796, CVE-2013-1797, and CVE-2013-1798. CVE-2013-1792 wasdiscovered by Mateusz Guzik of Red Hat EMEA GSS SEG Team.