RHSA-2015:2152: Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linuxoperating system. A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and thedestination was outside of a bind mount. A privileged user inside acontainer could use this flaw to escape the bind mount and, potentially,escalate their privileges on the system. (CVE-2015-2925, Important) A race condition flaw was found in the way the Linux kernel's IPC subsystem initialized certain fields in an IPC object structure that werelater used for permission checking before inserting the object into aglobally visible list. A local, unprivileged user could potentially usethis flaw to elevate their privileges on the system. (CVE-2015-7613,Important) It was found that reporting emulation failures to user space could lead to either a local (CVE-2014-7842) or a L2->L1 (CVE-2010-5313) denial ofservice. In the case of a local denial of service, an attacker must haveaccess to the MMIO area or be able to access an I/O port. (CVE-2010-5313,CVE-2014-7842, Moderate) A flaw was found in the way the Linux kernel's KVM subsystem handled non-canonical addresses when emulating instructions that change the RIP(for example, branches or calls). A guest user with access to an I/O orMMIO region could use this flaw to crash the guest. (CVE-2014-3647,Moderate) It was found that the Linux kernel memory resource controller's (memcg) handling of OOM (out of memory) conditions could lead to deadlocks.An attacker could use this flaw to lock up the system. (CVE-2014-8171,Moderate) A race condition flaw was found between the chown and execve system calls. A local, unprivileged user could potentially use this flaw toescalate their privileges on the system. (CVE-2015-3339, Moderate) A flaw was discovered in the way the Linux kernel's TTY subsystem handled the tty shutdown phase. A local, unprivileged user could use this flaw tocause a denial of service on the system. (CVE-2015-4170, Moderate) A NULL pointer dereference flaw was found in the SCTP implementation. A local user could use this flaw to cause a denial of service on the systemby triggering a kernel panic when creating multiple sockets in parallelwhile the system did not have the SCTP module loaded. (CVE-2015-5283,Moderate) A flaw was found in the way the Linux kernel's perf subsystem retrieved userlevel stack traces on PowerPC systems. A local, unprivileged user coulduse this flaw to cause a denial of service on the system. (CVE-2015-6526,Moderate) A flaw was found in the way the Linux kernel's Crypto subsystem handled automatic loading of kernel modules. A local user could use this flaw toload any installed kernel module, and thus increase the attack surface ofthe running kernel. (CVE-2013-7421, CVE-2014-9644, Low) An information leak flaw was found in the way the Linux kernel changed certain segment registers and thread-local storage (TLS) during a contextswitch. A local, unprivileged user could use this flaw to leak the userspace TLS base address of an arbitrary process. (CVE-2014-9419, Low) It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient. An unprivileged guest user could use thisflaw to escalate their privileges by tricking the hypervisor to emulate aSYSENTER instruction in 16-bit mode, if the guest OS did not initialize theSYSENTER model-specific registers (MSRs). Note: Certified guest operatingsystems for Red Hat Enterprise Linux with KVM do initialize the SYSENTERMSRs and are thus not vulnerable to this issue when running on a KVMhypervisor. (CVE-2015-0239, Low) A flaw was found in the way the Linux kernel handled the securelevel functionality after performing a kexec operation. A local attacker coulduse this flaw to bypass the security mechanism of thesecurelevel/secureboot combination. (CVE-2015-7837, Low)