The kernel-rt packages contain the Linux kernel, the core of any Linuxoperating system.Security fixes: Missing boundary checks in the PPP over L2TP sockets implementation could allow a local, unprivileged user to cause a denial of service or escalatetheir privileges. (CVE-2010-4160, Important) Integer overflow in ibuverbspollcq() could allow a local, unprivileged user to cause a denial of service or escalate their privileges.(CVE-2010-4649, Important) Missing boundary check in dvbcaioctl() in the av7110 module. On systems using old DVB cards requiring the av7110 module, a local, unprivileged usercould use this flaw to cause a denial of service or escalate theirprivileges. (CVE-2011-0521, Important) Flaw in tcfactpolicedump() in the network traffic policing implementation could allow a local, unprivileged user to cause aninformation leak. (CVE-2010-3477, Moderate) Missing boundary checks in the block layer implementation could allow a local, unprivileged user to cause a denial of service. (CVE-2010-4162,CVE-2010-4163, CVE-2010-4668, Moderate) Divide-by-zero flaw in tcpselectinitialwindow() in the Linux kernel's TCP/IP protocol suite implementation could allow a local, unprivileged userto cause a denial of service. (CVE-2010-4165, Moderate) NULL pointer dereference flaw in the Bluetooth HCI UART driver could allow a local, unprivileged user to cause a denial of service.(CVE-2010-4242, Moderate) Flaw in the CPU time clocks implementation for the POSIX clock interface could allow a local, unprivileged user to cause a denial of service.(CVE-2010-4248, Moderate) Flaw in the garbage collector for AFUNIX sockets could allow a local, unprivileged user to trigger a denial of service (out-of-memory condition).(CVE-2010-4249, Moderate) Memory leak in the inotifyinit() system call. In some cases, it could leak a group, which could allow a local, unprivileged user to eventuallycause a denial of service. (CVE-2010-4250, Moderate) /sys/kernel/debug/acpi/custommethod had world-writable permissions, which could allow a local, unprivileged user to escalate their privileges.Note: The debugfs file system must be mounted locally to exploit thisissue. It is not mounted by default. (CVE-2010-4347, Moderate) Heap overflow in iowarriorwrite() could allow a user with access to an IO-Warrior USB device to cause a denial of service or escalate theirprivileges. (CVE-2010-4656, Moderate) Missing security check in the Linux kernel's implementation of the installspecialmapping routine could allow a local, unprivileged user tobypass the mmapminaddr protection mechanism. (CVE-2010-4346, Low) Information leak in bcmconnect() in the Controller Area Network (CAN) Broadcast Manager implementation could allow a local, unprivileged user toleak kernel mode addresses in /proc/net/can-bcm. (CVE-2010-4565, Low) A logic error in orinocoioctlsetauth() in the Linux kernel's ORiNOCO wireless extensions support implementation could render TKIPcountermeasures ineffective when it is enabled, as it enabled the cardinstead of shutting it down. (CVE-2010-4648, Low) Missing initialization flaw in ethtoolgetregs() could allow a local user who has the CAPNETADMIN capability to cause an information leak.(CVE-2010-4655, Low) Flaw in ibuverbspollcq() could allow a local, unprivileged user to cause an information leak. (CVE-2011-1044, Low)Red Hat would like to thank Dan Rosenberg for reporting CVE-2010-4160,CVE-2010-4162, CVE-2010-4163, CVE-2010-4668, and CVE-2010-4565; Steve Chenfor reporting CVE-2010-4165; Alan Cox for reporting CVE-2010-4242; VegardNossum for reporting CVE-2010-4249 and CVE-2010-4250; Kees Cook forreporting CVE-2010-4656 and CVE-2010-4655; and Tavis Ormandy for reportingCVE-2010-4346.This update also fixes three bugs. Documentation for these bug fixes willbe available shortly from the Technical Notes document linked to in theReferences section.

The kernel-rt packages contain the Linux kernel, the core of any Linuxoperating system.This update fixes the following security issues: A race condition in the way the Linux kernel's InfiniBand implementation set up new connections could allow a remote user to cause a denial ofservice. (CVE-2011-0695, Important) An integer signedness flaw in drmmodesetctl() could allow a local, unprivileged user to cause a denial of service or escalate theirprivileges. (CVE-2011-1013, Important) A flaw in dccprcvstateprocess() could allow a remote attacker to cause a denial of service, even when the socket was already closed.(CVE-2011-1093, Important) A missing validation of a null-terminated string data structure element in bnepsockioctl() could allow a local user to cause an information leakor a denial of service. (CVE-2011-1079, Moderate) A flaw in the Linux kernel's Event Poll (epoll) implementation could allow a local, unprivileged user to cause a denial of service.(CVE-2011-1082, Moderate) A missing initialization flaw in the XFS file system implementation could lead to an information leak. (CVE-2011-0711, Low) The startcode and endcode values in "/proc/[pid]/stat" were not protected. In certain scenarios, this flaw could be used to defeat AddressSpace Layout Randomization (ASLR). (CVE-2011-0726, Low) A missing validation check in the Linux kernel's macpartition() implementation, used for supporting file systems created on Mac OSoperating systems, could allow a local attacker to cause a denial ofservice by mounting a disk that contains specially-crafted partitions.(CVE-2011-1010, Low) A flaw in devload() could allow a local user who has the CAPNETADMIN capability to load arbitrary modules from "/lib/modules/", instead of onlynetdev modules. (CVE-2011-1019, Low) A missing initialization flaw in scosockgetsockoptold() could allow a local, unprivileged user to cause an information leak. (CVE-2011-1078, Low) A buffer overflow flaw in the DEC Alpha OSF partition implementation in the Linux kernel could allow a local attacker to cause an information leakby mounting a disk that contains specially-crafted partition tables.(CVE-2011-1163, Low) Missing validations of null-terminated string data structure elements in the doreplace(), compatdoreplace(), doiptgetctl(),doip6tgetctl(), and doarptgetctl() functions could allow a local userwho has the CAPNETADMIN capability to cause an information leak.(CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1080, Low)Red Hat would like to thank Jens Kuehnel for reporting CVE-2011-0695;Vasiliy Kulikov for reporting CVE-2011-1079, CVE-2011-1019, CVE-2011-1078,CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, and CVE-2011-1080; NelsonElhage for reporting CVE-2011-1082; Dan Rosenberg for reportingCVE-2011-0711; Kees Cook for reporting CVE-2011-0726; and Timo Warns forreporting CVE-2011-1010 and CVE-2011-1163.This update also fixes various bugs. Documentation for these bug fixes willbe available shortly from the Technical Notes document linked to in theReferences section.Users should upgrade to these updated packages, which upgrade the kernel-rtkernel to version 2.6.33.9-rt31, and correct these issues. The system mustbe rebooted for this update to take effect.