RHSA-2014:0520: Important: kernel security and bug fix update

First published: Tue May 20 2014(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br><li> A flaw was found in the way the Linux kernel processed an authenticated</li> COOKIE_ECHO chunk during the initialization of an SCTP connection. A remote<br>attacker could use this flaw to crash the system by initiating a specially<br>crafted SCTP handshake in order to trigger a NULL pointer dereference on<br>the system. (CVE-2014-0101, Important)<br><li> A race condition flaw, leading to heap-based buffer overflows, was found</li> in the way the Linux kernel's N_TTY line discipline (LDISC) implementation<br>handled concurrent processing of echo output and TTY write operations<br>originating from user space when the underlying TTY driver was PTY.<br>An unprivileged, local user could use this flaw to crash the system or,<br>potentially, escalate their privileges on the system. (CVE-2014-0196,<br>Important)<br>Red Hat would like to thank Nokia Siemens Networks for reporting<br>CVE-2014-0101.<br>This update also fixes the following bug:<br><li> Prior to this update, a guest-provided value was used as the head length</li> of the socket buffer allocated on the host. If the host was under heavy<br>memory load and the guest-provided value was too large, the allocation<br>could have failed, resulting in stalls and packet drops in the guest's Tx<br>path. With this update, the guest-provided value has been limited to a<br>reasonable size so that socket buffer allocations on the host succeed<br>regardless of the memory load on the host, and guests can send packets<br>without experiencing packet drops or stalls. (BZ#1092349)<br>All kernel users are advised to upgrade to these updated packages, which<br>contain backported patches to correct these issues. The system must be<br>rebooted for this update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2014:0520
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• package-manager/redhat