RHSA-2014:0913: Important: kernel-rt security update

First published: Tue Jul 22 2014(Updated: )

The kernel-rt packages contain the Linux kernel, the core of any Linux<br>operating system.<br><li> A flaw was found in the way the Linux kernel's futex subsystem handled</li> the requeuing of certain Priority Inheritance (PI) futexes. A local,<br>unprivileged user could use this flaw to escalate their privileges on the<br>system. (CVE-2014-3153, Important)<br><li> It was found that the Linux kernel's ptrace subsystem allowed a traced</li> process' instruction pointer to be set to a non-canonical memory address<br>without forcing the non-sysret code path when returning to user space.<br>A local, unprivileged user could use this flaw to crash the system or,<br>potentially, escalate their privileges on the system. (CVE-2014-4699,<br>Important)<br>Note: The CVE-2014-4699 issue only affected systems using an Intel CPU.<br><li> It was found that the permission checks performed by the Linux kernel</li> when a netlink message was received were not sufficient. A local,<br>unprivileged user could potentially bypass these restrictions by passing a<br>netlink socket as stdout or stderr to a more privileged process and<br>altering the output of this process. (CVE-2014-0181, Moderate)<br><li> It was found that the aio_read_events_ring() function of the Linux</li> kernel's Asynchronous I/O (AIO) subsystem did not properly sanitize the AIO<br>ring head received from user space. A local, unprivileged user could use<br>this flaw to disclose random parts of the (physical) memory belonging to<br>the kernel and/or other processes. (CVE-2014-0206, Moderate)<br><li> An out-of-bounds memory access flaw was found in the Netlink Attribute</li> extension of the Berkeley Packet Filter (BPF) interpreter functionality in<br>the Linux kernel's networking implementation. A local, unprivileged user<br>could use this flaw to crash the system or leak kernel memory to user space<br>via a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145,<br>Moderate)<br><li> An out-of-bounds memory access flaw was found in the Linux kernel's</li> system call auditing implementation. On a system with existing audit rules<br>defined, a local, unprivileged user could use this flaw to leak kernel<br>memory to user space or, potentially, crash the system. (CVE-2014-3917,<br>Moderate)<br><li> A flaw was found in the way Linux kernel's Transparent Huge Pages (THP)</li> implementation handled non-huge page migration. A local, unprivileged user<br>could use this flaw to crash the kernel by migrating transparent hugepages.<br>(CVE-2014-3940, Moderate)<br><li> An integer underflow flaw was found in the way the Linux kernel's Stream</li> Control Transmission Protocol (SCTP) implementation processed certain<br>COOKIE_ECHO packets. By sending a specially crafted SCTP packet, a remote<br>attacker could use this flaw to prevent legitimate connections to a<br>particular SCTP server socket to be made. (CVE-2014-4667, Moderate)<br><li> An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp)</li> backend driver of the iSCSI Target subsystem of the Linux kernel.<br>A privileged user could use this flaw to leak the contents of kernel memory<br>to an iSCSI initiator remote client. (CVE-2014-4027, Low)<br>Red Hat would like to thank Kees Cook of Google for reporting<br>CVE-2014-3153, Andy Lutomirski for reporting CVE-2014-4699 and<br>CVE-2014-0181, and Gopal Reddy Kodudula of Nokia Siemens Networks for<br>reporting CVE-2014-4667. Google acknowledges Pinkie Pie as the original<br>reporter of CVE-2014-3153. The CVE-2014-0206 issue was discovered by<br>Mateusz Guzik of Red Hat.<br>Users are advised to upgrade to these updated packages, which upgrade the<br>kernel-rt kernel to version kernel-rt-3.10.33-rt32.43 and correct these<br>issues. The system must be rebooted for this update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• collector/redhat-errata
• anchor-id/RHSA-2014:0913
• package-manager/redhat