RHSA-2015:0062: Important: kernel security, bug fix, and enhancement update

First published: Tue Jan 20 2015(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br><li> A flaw was found in the way the Linux kernel's SCTP implementation</li> handled malformed or duplicate Address Configuration Change Chunks<br>(ASCONF). A remote attacker could use either of these flaws to crash the<br>system. (CVE-2014-3673, CVE-2014-3687, Important)<br><li> A flaw was found in the way the Linux kernel's SCTP implementation</li> handled the association's output queue. A remote attacker could send<br>specially crafted packets that would cause the system to use an excessive<br>amount of memory, leading to a denial of service. (CVE-2014-3688,<br>Important)<br><li> A flaw was found in the way the Linux kernel's VFS subsystem handled</li> reference counting when performing unmount operations on symbolic links.<br>A local, unprivileged user could use this flaw to exhaust all available<br>memory on the system or, potentially, trigger a use-after-free error,<br>resulting in a system crash or privilege escalation. (CVE-2014-5045,<br>Moderate)<br><li> An integer overflow flaw was found in the way the lzo1x_decompress_safe()</li> function of the Linux kernel's LZO implementation processed Literal Runs.<br>A local attacker could, in extremely rare cases, use this flaw to crash the<br>system or, potentially, escalate their privileges on the system.<br>(CVE-2014-4608, Low)<br>Red Hat would like to thank Vasily Averin of Parallels for reporting<br>CVE-2014-5045, and Don A. Bailey from Lab Mouse Security for reporting<br>CVE-2014-4608. The CVE-2014-3673 issue was discovered by Liu Wei of<br>Red Hat.<br>This update also fixes several bugs and adds one enhancement.<br>Documentation for these changes is available from the Technical Notes<br>document linked to in the References section.<br>All kernel users are advised to upgrade to these updated packages, which<br>contain backported patches to correct these issues and add this<br>enhancement. The system must be rebooted for this update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• anchor-id/RHSA-2015:0062
• package-manager/redhat