Oracle Linux 5 ELSA-2011-2038 Critical: KVM Privilege Escalation and DoS

* CVE-2011-4127: KVM privilege escalation through insufficient validation in SG_IO ioctl. Using the SG_IO IOCTL to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged user only had access to a single partition or LVM volume, they could use this flaw to bypass those restrictions and gain read and write access (and be able to issue other SCSI commands) to the entire block device. In KVM (Kernel-based Virtual Machine) environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests (and other SCSI commands) on the host, and possibly access the data of other guests that reside on the same underlying block device. (CVE-2011-4127, Important) * CVE-2011-1493: Insufficient validation in X.25 Rose parsing. Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fi...