RHSA-2014:0913: Important: kernel-rt security update

The kernel-rt packages contain the Linux kernel, the core of any Linuxoperating system. A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local,unprivileged user could use this flaw to escalate their privileges on thesystem. (CVE-2014-3153, Important) It was found that the Linux kernel's ptrace subsystem allowed a traced process' instruction pointer to be set to a non-canonical memory addresswithout forcing the non-sysret code path when returning to user space.A local, unprivileged user could use this flaw to crash the system or,potentially, escalate their privileges on the system. (CVE-2014-4699,Important)Note: The CVE-2014-4699 issue only affected systems using an Intel CPU. It was found that the permission checks performed by the Linux kernel when a netlink message was received were not sufficient. A local,unprivileged user could potentially bypass these restrictions by passing anetlink socket as stdout or stderr to a more privileged process andaltering the output of this process. (CVE-2014-0181, Moderate) It was found that the aioreadeventsring() function of the Linux kernel's Asynchronous I/O (AIO) subsystem did not properly sanitize the AIOring head received from user space. A local, unprivileged user could usethis flaw to disclose random parts of the (physical) memory belonging tothe kernel and/or other processes. (CVE-2014-0206, Moderate) An out-of-bounds memory access flaw was found in the Netlink Attribute extension of the Berkeley Packet Filter (BPF) interpreter functionality inthe Linux kernel's networking implementation. A local, unprivileged usercould use this flaw to crash the system or leak kernel memory to user spacevia a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145,Moderate) An out-of-bounds memory access flaw was found in the Linux kernel's system call auditing implementation. On a system with existing audit rulesdefined, a local, unprivileged user could use this flaw to leak kernelmemory to user space or, potentially, crash the system. (CVE-2014-3917,Moderate) A flaw was found in the way Linux kernel's Transparent Huge Pages (THP) implementation handled non-huge page migration. A local, unprivileged usercould use this flaw to crash the kernel by migrating transparent hugepages.(CVE-2014-3940, Moderate) An integer underflow flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation processed certainCOOKIEECHO packets. By sending a specially crafted SCTP packet, a remoteattacker could use this flaw to prevent legitimate connections to aparticular SCTP server socket to be made. (CVE-2014-4667, Moderate) An information leak flaw was found in the RAM Disks Memory Copy (rdmcp) backend driver of the iSCSI Target subsystem of the Linux kernel.A privileged user could use this flaw to leak the contents of kernel memoryto an iSCSI initiator remote client. (CVE-2014-4027, Low)Red Hat would like to thank Kees Cook of Google for reportingCVE-2014-3153, Andy Lutomirski for reporting CVE-2014-4699 andCVE-2014-0181, and Gopal Reddy Kodudula of Nokia Siemens Networks forreporting CVE-2014-4667. Google acknowledges Pinkie Pie as the originalreporter of CVE-2014-3153. The CVE-2014-0206 issue was discovered byMateusz Guzik of Red Hat.Users are advised to upgrade to these updated packages, which upgrade thekernel-rt kernel to version kernel-rt-3.10.33-rt32.43 and correct theseissues. The system must be rebooted for this update to take effect.