====================================================================                   Red Hat Security Advisory

Synopsis:          Important: kernel-rt security, bug fix, and enhancement update
Advisory ID:       RHSA-2009:1540-01
Product:           Red Hat Enterprise MRG for RHEL-5
Advisory URL:      https://access.redhat.com/errata/RHSA-2009:1540.html
Issue date:        2009-11-03
CVE Names:         CVE-2009-1895 CVE-2009-2691 CVE-2009-2695 
                   CVE-2009-2849 CVE-2009-2910 CVE-2009-3002 
                   CVE-2009-3228 CVE-2009-3547 CVE-2009-3612 
                   CVE-2009-3613 CVE-2009-3620 CVE-2009-3621 
====================================================================
1. Summary:

Updated kernel-rt packages that fix several security issues, multiple bugs,
and add enhancements are now available for Red Hat Enterprise MRG 1.1.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

MRG Realtime for RHEL 5 Server - i386, noarch, x86_64

3. Description:

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

Security fixes:

* the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a
setuid or setgid program was executed. A local, unprivileged user could use
this flaw to bypass the mmap_min_addr protection mechanism and perform a
NULL pointer dereference attack, or bypass the Address Space Layout
Randomization (ASLR) security feature. (CVE-2009-1895, Important)

* a system with SELinux enforced was more permissive in allowing local
users in the unconfined_t domain to map low memory areas even if the
mmap_min_addr restriction was enabled. This could aid in the local
exploitation of NULL pointer dereference bugs. (CVE-2009-2695, Important)

* missing initialization flaws were found in getname() implementations in
numerous network protocol implementations in the Linux kernel. Certain
data structures in these getname() implementations were not initialized
properly before being copied to user-space. These flaws could lead to an
information leak. (CVE-2009-3002, Important)

* a NULL pointer dereference flaw was found in each of the following
functions in the Linux kernel: pipe_read_open(), pipe_write_open(), and
pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could
be released by other processes before it is used to update the pipe's
reader and writer counters. This could lead to a local denial of service or
privilege escalation. (CVE-2009-3547, Important)

* a flaw was found in the Realtek r8169 Ethernet driver in the Linux
kernel. pci_unmap_single() presented a memory leak that could lead to IOMMU
space exhaustion and a system crash. An attacker on the local network could
abuse this flaw by using jumbo frames for large amounts of network traffic.
(CVE-2009-3613, Important)

* NULL pointer dereference flaws were found in the r128 driver in the
Linux kernel. Checks to test if the Concurrent Command Engine state was
initialized were missing in private IOCTL functions. An attacker could use
these flaws to cause a local denial of service or escalate their
privileges. (CVE-2009-3620, Important)

* Kees Cook and Steve Beattie discovered a race condition in the /proc
code in the Linux kernel. This could lead to information in the
"/proc/[pid]/maps" and "/proc/[pid]/smaps" files being leaked to users (who
would otherwise not have access to this information) during ELF loading.
This could help a local attacker bypass the ASLR security feature.
(CVE-2009-2691, Moderate)

* a NULL pointer dereference flaw was found in the md driver in the Linux
kernel. If the suspend_lo or suspend_hi file in "/sys/" is modified when
the disk array is inactive, it could lead to a local denial of service or
privilege escalation. By default, only root can write to these two files.
(CVE-2009-2849, Moderate)

* an information leak was found in the Linux kernel. On AMD64 systems,
32-bit processes could access and read certain 64-bit registers by
temporarily switching themselves to 64-bit mode. (CVE-2009-2910, Moderate)

* padding data in several core network structures was not initialized
properly before being sent to user-space, possibly leading to information
leaks. (CVE-2009-3228, CVE-2009-3612, Moderate)

* the unix_stream_connect() function in the Linux kernel did not check if a
UNIX domain socket was in the shutdown state. This could lead to a
deadlock. A local, unprivileged user could use this flaw to cause a denial
of service. (CVE-2009-3621, Moderate)

These updated packages also include bug fixes and enhancements. Users are
directed to the Realtime Security Update Release Notes for version 1.1 for
information on these changes, which will be available shortly from: 

http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/

Users should upgrade to these updated packages, which contain backported
patches to correct these issues and add enhancements. The system must be
rebooted for this update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at

5. Bugs fixed (http://bugzilla.redhat.com/):

511171 - CVE-2009-1895 kernel: personality: fix PER_CLEAR_ON_SETID
516171 - CVE-2009-2691 kernel: /proc/$pid/maps visible during initial setuid ELF loading
517830 - CVE-2009-2695 kernel: SELinux and mmap_min_addr
518132 - CVE-2009-2849 kernel: md: NULL pointer deref when accessing suspend_* sysfs attributes
518160 - [FOCUS] Boot hang with x3950 using MRG's -108 kernel
519305 - CVE-2009-3001, CVE-2009-3002 kernel: numerous getname() infoleaks
520990 - CVE-2009-3228 kernel: tc: uninitialised kernel memory leak
521999 - ip_tables: connlimit match: invalid size 32 != 24
522359 - MRG 1.1 SMI remeidation support for HS22 and Rackmounts
522501 - Turn off IPX protocol module
522503 - Turn off AppleTalk protocol module in realtime kernel
523986 - kernel: ipt_recent: sanity check hit count [mrg-1]
526788 - CVE-2009-2910 kernel: x86_64 32 bit process register leak
528139 - FTRACE: check for failure for all conversions, tracing: correct module boundaries for ftrace_release
528868 - CVE-2009-3612 kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
529137 - CVE-2009-3613 kernel: flood ping cause out-of-iommu error and panic when mtu larger than 1500
529597 - CVE-2009-3620 kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised
529626 - CVE-2009-3621 kernel: AF_UNIX: Fix deadlock on connecting to shutdown socket
530490 - CVE-2009-3547 kernel: fs: pipe.c null pointer dereference

6. Package List:

MRG Realtime for RHEL 5 Server:

Source:

i386:
kernel-rt-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debug-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debug-debuginfo-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debug-devel-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debuginfo-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debuginfo-common-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-devel-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-trace-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-trace-debuginfo-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-trace-devel-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-vanilla-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-vanilla-debuginfo-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-vanilla-devel-2.6.24.7-137.el5rt.i686.rpm

noarch:
kernel-rt-doc-2.6.24.7-137.el5rt.noarch.rpm

x86_64:
kernel-rt-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debug-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debug-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debug-devel-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debuginfo-common-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-devel-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-trace-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-trace-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-trace-devel-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-vanilla-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-vanilla-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-vanilla-devel-2.6.24.7-137.el5rt.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1895
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2691
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2695
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2849
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2910
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3002
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3547
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3612
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3613
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3620
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3621
http://www.redhat.com/security/updates/classification/#important
http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.

RedHat: Important: kernel-rt security, bug fix, RHSA-2009:1540-01

Updated kernel-rt packages that fix several security issues, multiple bugs, and add enhancements are now available for Red Hat Enterprise MRG 1.1. This update has been rated as ha...

Summary

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.
Security fixes:
* the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a setuid or setgid program was executed. A local, unprivileged user could use this flaw to bypass the mmap_min_addr protection mechanism and perform a NULL pointer dereference attack, or bypass the Address Space Layout Randomization (ASLR) security feature. (CVE-2009-1895, Important)
* a system with SELinux enforced was more permissive in allowing local users in the unconfined_t domain to map low memory areas even if the mmap_min_addr restriction was enabled. This could aid in the local exploitation of NULL pointer dereference bugs. (CVE-2009-2695, Important)
* missing initialization flaws were found in getname() implementations in numerous network protocol implementations in the Linux kernel. Certain data structures in these getname() implementations were not initialized properly before being copied to user-space. These flaws could lead to an information leak. (CVE-2009-3002, Important)
* a NULL pointer dereference flaw was found in each of the following functions in the Linux kernel: pipe_read_open(), pipe_write_open(), and pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could be released by other processes before it is used to update the pipe's reader and writer counters. This could lead to a local denial of service or privilege escalation. (CVE-2009-3547, Important)
* a flaw was found in the Realtek r8169 Ethernet driver in the Linux kernel. pci_unmap_single() presented a memory leak that could lead to IOMMU space exhaustion and a system crash. An attacker on the local network could abuse this flaw by using jumbo frames for large amounts of network traffic. (CVE-2009-3613, Important)
* NULL pointer dereference flaws were found in the r128 driver in the Linux kernel. Checks to test if the Concurrent Command Engine state was initialized were missing in private IOCTL functions. An attacker could use these flaws to cause a local denial of service or escalate their privileges. (CVE-2009-3620, Important)
* Kees Cook and Steve Beattie discovered a race condition in the /proc code in the Linux kernel. This could lead to information in the "/proc/[pid]/maps" and "/proc/[pid]/smaps" files being leaked to users (who would otherwise not have access to this information) during ELF loading. This could help a local attacker bypass the ASLR security feature. (CVE-2009-2691, Moderate)
* a NULL pointer dereference flaw was found in the md driver in the Linux kernel. If the suspend_lo or suspend_hi file in "/sys/" is modified when the disk array is inactive, it could lead to a local denial of service or privilege escalation. By default, only root can write to these two files. (CVE-2009-2849, Moderate)
* an information leak was found in the Linux kernel. On AMD64 systems, 32-bit processes could access and read certain 64-bit registers by temporarily switching themselves to 64-bit mode. (CVE-2009-2910, Moderate)
* padding data in several core network structures was not initialized properly before being sent to user-space, possibly leading to information leaks. (CVE-2009-3228, CVE-2009-3612, Moderate)
* the unix_stream_connect() function in the Linux kernel did not check if a UNIX domain socket was in the shutdown state. This could lead to a deadlock. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2009-3621, Moderate)
These updated packages also include bug fixes and enhancements. Users are directed to the Realtime Security Update Release Notes for version 1.1 for information on these changes, which will be available shortly from:
http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/
Users should upgrade to these updated packages, which contain backported patches to correct these issues and add enhancements. The system must be rebooted for this update to take effect.



Summary


Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1895 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2691 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2695 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2849 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2910 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3002 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3228 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3547 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3612 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3613 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3620 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3621 http://www.redhat.com/security/updates/classification/#important http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/

Package List

MRG Realtime for RHEL 5 Server:
Source:
i386: kernel-rt-2.6.24.7-137.el5rt.i686.rpm kernel-rt-debug-2.6.24.7-137.el5rt.i686.rpm kernel-rt-debug-debuginfo-2.6.24.7-137.el5rt.i686.rpm kernel-rt-debug-devel-2.6.24.7-137.el5rt.i686.rpm kernel-rt-debuginfo-2.6.24.7-137.el5rt.i686.rpm kernel-rt-debuginfo-common-2.6.24.7-137.el5rt.i686.rpm kernel-rt-devel-2.6.24.7-137.el5rt.i686.rpm kernel-rt-trace-2.6.24.7-137.el5rt.i686.rpm kernel-rt-trace-debuginfo-2.6.24.7-137.el5rt.i686.rpm kernel-rt-trace-devel-2.6.24.7-137.el5rt.i686.rpm kernel-rt-vanilla-2.6.24.7-137.el5rt.i686.rpm kernel-rt-vanilla-debuginfo-2.6.24.7-137.el5rt.i686.rpm kernel-rt-vanilla-devel-2.6.24.7-137.el5rt.i686.rpm
noarch: kernel-rt-doc-2.6.24.7-137.el5rt.noarch.rpm
x86_64: kernel-rt-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-debug-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-debug-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-debug-devel-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-debuginfo-common-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-devel-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-trace-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-trace-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-trace-devel-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-vanilla-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-vanilla-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm kernel-rt-vanilla-devel-2.6.24.7-137.el5rt.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package


Severity
Advisory ID: RHSA-2009:1540-01
Product: Red Hat Enterprise MRG for RHEL-5
Advisory URL: https://access.redhat.com/errata/RHSA-2009:1540.html
Issued Date: : 2009-11-03
CVE Names: CVE-2009-1895 CVE-2009-2691 CVE-2009-2695 CVE-2009-2849 CVE-2009-2910 CVE-2009-3002 CVE-2009-3228 CVE-2009-3547 CVE-2009-3612 CVE-2009-3613 CVE-2009-3620 CVE-2009-3621

Topic

Updated kernel-rt packages that fix several security issues, multiple bugs,and add enhancements are now available for Red Hat Enterprise MRG 1.1.This update has been rated as having important security impact by the RedHat Security Response Team.


Topic


 

Relevant Releases Architectures

MRG Realtime for RHEL 5 Server - i386, noarch, x86_64


Bugs Fixed

511171 - CVE-2009-1895 kernel: personality: fix PER_CLEAR_ON_SETID

516171 - CVE-2009-2691 kernel: /proc/$pid/maps visible during initial setuid ELF loading

517830 - CVE-2009-2695 kernel: SELinux and mmap_min_addr

518132 - CVE-2009-2849 kernel: md: NULL pointer deref when accessing suspend_* sysfs attributes

518160 - [FOCUS] Boot hang with x3950 using MRG's -108 kernel

519305 - CVE-2009-3001, CVE-2009-3002 kernel: numerous getname() infoleaks

520990 - CVE-2009-3228 kernel: tc: uninitialised kernel memory leak

521999 - ip_tables: connlimit match: invalid size 32 != 24

522359 - MRG 1.1 SMI remeidation support for HS22 and Rackmounts

522501 - Turn off IPX protocol module

522503 - Turn off AppleTalk protocol module in realtime kernel

523986 - kernel: ipt_recent: sanity check hit count [mrg-1]

526788 - CVE-2009-2910 kernel: x86_64 32 bit process register leak

528139 - FTRACE: check for failure for all conversions, tracing: correct module boundaries for ftrace_release

528868 - CVE-2009-3612 kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7

529137 - CVE-2009-3613 kernel: flood ping cause out-of-iommu error and panic when mtu larger than 1500

529597 - CVE-2009-3620 kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised

529626 - CVE-2009-3621 kernel: AF_UNIX: Fix deadlock on connecting to shutdown socket

530490 - CVE-2009-3547 kernel: fs: pipe.c null pointer dereference


Related News

Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered
Open Source Strategies for Enhancing Security in Digital Business Operations
5 - 9 min read
Digital transformation, powered by the principles of open-source security , is vital for businesses looking to excel in today's technology-driven
Microsoft Update Mayhem: Rescuing Linux Dual-Boot Systems from Secure Boot Woes
2 - 4 min read
Microsoft's recent patch, intended to strengthen Secure Boot defenses, has resulted in an unexpected setback for Linux-Windows dual-boot setups

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved