RHSA-2014:1318: Moderate: Red Hat Enterprise MRG Realtime 2.5 security and enhancement update

First published: Mon Sep 29 2014(Updated: )

Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation<br>IT infrastructure for enterprise computing. MRG offers increased<br>performance, reliability, interoperability, and faster computing for<br>enterprise customers.<br>MRG Realtime provides the highest levels of predictability for consistent<br>low-latency response times to meet the needs of time-sensitive workloads.<br>MRG Realtime also provides new levels of determinism by optimizing lengthy<br>kernel code paths to ensure that they do not become bottlenecks. This<br>allows for better prioritization of applications, resulting in consistent,<br>predictable response times for high-priority applications.<br><li> An out-of-bounds write flaw was found in the way the Apple Magic</li> Mouse/Trackpad multi-touch driver handled Human Interface Device (HID)<br>reports with an invalid size. An attacker with physical access to the<br>system could use this flaw to crash the system or, potentially, escalate<br>their privileges on the system. (CVE-2014-3181, Moderate)<br><li> A memory corruption flaw was found in the way the USB ConnectTech</li> WhiteHEAT serial driver processed completion commands sent via USB Request<br>Blocks buffers. An attacker with physical access to the system could use<br>this flaw to crash the system or, potentially, escalate their privileges on<br>the system. (CVE-2014-3185, Moderate)<br><li> A race condition flaw was found in the way the Linux kernel's mmap(2),</li> madvise(2), and fallocate(2) system calls interacted with each other while<br>operating on virtual memory file system files. A local user could use this<br>flaw to cause a denial of service. (CVE-2014-4171, Moderate)<br><li> A stack overflow flaw caused by infinite recursion was found in the way</li> the Linux kernel's Universal Disk Format (UDF) file system implementation<br>processed indirect Information Control Blocks (ICBs). An attacker with<br>physical access to the system could use a specially crafted UDF image to<br>crash the system. (CVE-2014-6410, Low)<br><li> An out-of-bounds read flaw was found in the way the Logitech Unifying</li> receiver driver handled HID reports with an invalid device_index value.<br>An attacker with physical access to the system could use this flaw to crash<br>the system or, potentially, escalate their privileges on the system.<br>(CVE-2014-3182, Low)<br><li> Multiple out-of-bounds write flaws were found in the way the Cherry</li> Cymotion keyboard driver, KYE/Genius device drivers, Logitech device<br>drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote<br>control driver, and Sunplus wireless desktop driver handled HID reports<br>with an invalid report descriptor size. An attacker with physical access to<br>the system could use either of these flaws to write data past an allocated<br>memory buffer. (CVE-2014-3184, Low)<br><li> It was found that the parse_rock_ridge_inode_internal() function of the</li> Linux kernel's ISOFS implementation did not correctly check relocated<br>directories when processing Rock Ridge child link (CL) tags. An attacker<br>with physical access to the system could use a specially crafted ISO image<br>to crash the system or, potentially, escalate their privileges on the<br>system. (CVE-2014-5471, CVE-2014-5472, Low)<br>This update also adds the following enhancement:<br><li> The Solarflare SFC9120 10GBE Ethernet NICs were not supported by the MRG</li> Realtime kernel. With this update, the drivers have been updated to enable<br>the Solarflare SFC9120 cards on the Realtime kernel. (BZ#1086945)<br>All Red Hat Enterprise MRG Realtime users are advised to upgrade to these<br>updated packages, which contain backported patches to correct these issues<br>and add this enhancement.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• anchor-id/RHSA-2014:1318
• package-manager/redhat