RHSA-2014:0285: Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linuxoperating system. A buffer overflow flaw was found in the way the qethsnmpcommand() function in the Linux kernel's QETH network device driver implementationhandled SNMP IOCTL requests with an out-of-bounds length. A local,unprivileged user could use this flaw to crash the system or, potentially,escalate their privileges on the system. (CVE-2013-6381, Important) A flaw was found in the way the ipcrcuputref() function in the Linux kernel's IPC implementation handled reference counter decrementing.A local, unprivileged user could use this flaw to trigger an Out of Memory(OOM) condition and, potentially, crash the system. (CVE-2013-4483,Moderate) It was found that the Xen hypervisor implementation did not correctly check privileges of hypercall attempts made by HVM guests, allowinghypercalls to be invoked from protection rings 1 and 2 in addition to ring0. A local attacker in an HVM guest able to execute code on privilegelevels 1 and 2 could potentially use this flaw to further escalate theirprivileges in that guest. Note: Xen HVM guests running unmodified versionsof Red Hat Enterprise Linux and Microsoft Windows are not affected by thisissue because they are known to only use protection rings 0 (kernel) and 3(userspace). (CVE-2013-4554, Moderate) A flaw was found in the way the Linux kernel's Adaptec RAID controller (aacraid) checked permissions of compat IOCTLs. A local attacker could usethis flaw to bypass intended security restrictions. (CVE-2013-6383,Moderate) It was found that, under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause acore hang on certain AMD CPUs (for more information, refer to AMD CPUerratum 793 linked in the References section). A privileged user in a guestrunning under the Xen hypervisor could use this flaw to cause a denial ofservice on the host system. This update adds a workaround to the Xenhypervisor implementation, which mitigates the AMD CPU issue. Note: thisissue only affects AMD Family 16h Models 00h-0Fh Processors. Non-AMD CPUsare not vulnerable. (CVE-2013-6885, Moderate) It was found that certain protocol handlers in the Linux kernel's networking implementation could set the addrlen value without initializingthe associated data structure. A local, unprivileged user could use thisflaw to leak kernel stack memory to user space using the recvmsg, recvfrom,and recvmmsg system calls. (CVE-2013-7263, Low) A flaw was found in the way the getdumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When'fs.suiddumpable' was set to 2, a local, unprivileged local user coulduse this flaw to bypass intended ptrace restrictions and obtainpotentially sensitive information. (CVE-2013-2929, Low)Red Hat would like to thank Vladimir Davydov of Parallels for reportingCVE-2013-4483 and the Xen project for reporting CVE-2013-4554 andCVE-2013-6885. Upstream acknowledges Jan Beulich as the original reporterof CVE-2013-4554 and CVE-2013-6885.This update also fixes several bugs and adds one enhancement.Documentation for these changes will be available shortly from theTechnical Notes document linked to in the References section.All kernel users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues and add thisenhancement. The system must be rebooted for this update to take effect.