Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Red Hat 6 Moderate: RHSA-2012-0862-04 Kernel DoS Security Update

red hat
Calendar Grey June 20, 2012
Scroller Redhat
A balanced security notice for the Red Hat 6 kernel tackles a pair of vulnerabilities, while this upgrade rectifies numerous bugs.
Updated kernel packages that fix two security issues, address several hundred bugs and add numerous enhancements are now available as part of the ongoing support and maintenance of...

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system.

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.
This update fixes the following security issues:
* A flaw was found in the way the Linux kernel's Event Poll (epoll) subsystem handled large, nested epoll structures. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2011-1083, Moderate)
* A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on the client. (CVE-2011-4131, Moderate)
Red Hat would like to thank Nelson Elhage for reporting CVE-2011-1083, and Andy Adamson for reporting CVE-2011-4131.
This update also fixes several hundred bugs and adds enhancements. Refer to the Red Hat Enterprise Linux 6.3 Release Notes for information on the most significant of these changes, and the Technical Notes for further information, both linked to in the References.
All Red Hat Enterprise Linux 6 users are advised to install these updated packages, which correct these issues, and fix the bugs and add the enhancements noted in the Red Hat Enterprise Linux 6.3 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.

Topics%20covered

Topics Covered

security advisory moderate Red Hat update bug fix DoS kernel

References

https://access.redhat.com/security/cve/CVE-2011-1083 https://access.redhat.com/security/cve/CVE-2011-4131 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/search/ https://access.redhat.com/search/

Package List

Red Hat Enterprise Linux Desktop (v. 6):
Source:
i386: kernel-2.6.32-279.el6.i686.rpm kernel-debug-2.6.32-279.el6.i686.rpm kernel-debug-debuginfo-2.6.32-279.el6.i686.rpm kernel-debug-devel-2.6.32-279.el6.i686.rpm kernel-debuginfo-2.6.32-279.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-279.el6.i686.rpm kernel-devel-2.6.32-279.el6.i686.rpm kernel-headers-2.6.32-279.el6.i686.rpm perf-2.6.32-279.el6.i686.rpm perf-debuginfo-2.6.32-279.el6.i686.rpm python-perf-debuginfo-2.6.32-279.el6.i686.rpm
noarch: kernel-doc-2.6.32-279.el6.noarch.rpm kernel-firmware-2.6.32-279.el6.noarch.rpm
x86_64: kernel-2.6.32-279.el6.x86_64.rpm kernel-debug-2.6.32-279.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-279.el6.x86_64.rpm kernel-debug-devel-2.6.32-279.el6.x86_64.rpm kernel-debuginfo-2.6.32-279.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-279.el6.x86_64.rpm kernel-devel-2.6.32-279.el6.x86_64.rpm kernel-headers-2.6.32-279.el6.x86_64.rpm perf-2.6.32-279.el6.x86_64.rpm perf-debuginfo-2.6.32-279.el6.x86_64.rpm python-perf-debuginfo-2.6.32-279.el6.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
i386: kernel-debug-debuginfo-2.6.32-279.el6.i686.rpm kernel-debuginfo-2.6.32-279.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-279.el6.i686.rpm

Read the Full Advisory


Advisory ID: RHSA-2012:0862-04
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2012:0862.html
Issue date: 2012-06-20

Topic

Updated kernel packages that fix two security issues, address severalhundred bugs and add numerous enhancements are now available as part of theongoing support and maintenance of Red Hat Enterprise Linux version 6. Thisis the third regular update.The Red Hat Security Response Team has rated this update as having moderatesecurity impact. Common Vulnerability Scoring System (CVSS) base scores,which give detailed severity ratings, are available for each vulnerabilityfrom the CVE links in the References section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat update bug fix DoS kernel

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64

Red Hat Enterprise Linux HPC Node (v. 6) - noarch, x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

Bugs Fixed

542378 - fix suspend to disk of virtio block

596419 - capability check in pci_read_config() bypasses lsm/selinux

623913 - [virtio] virtio-serial doesn't work after s3/s4 in kvm guest.

624189 - [virtio] virtio-balloon doesn't work after s3/s4 in kvm guest.

624756 - idle time accounted for twice in /proc/stat for Xen guest

645365 - KVM: Implement emulation of emulated virtual PMU

681578 - CVE-2011-1083 kernel: excessive in kernel CPU consumption when creating large nested epoll structures

694801 - Guest fail to resume from S4 if guest using kvmclock

726369 - host reboot auto when run guest with cgroup charge_migrate enabled

727700 - Anomaly in mbind memory map causing Java Hotspot JVM Seg fault with NUMA aware ParallelScavange GC

729586 - xen: fix drive naming

735105 - ext4 corruption via Ceph userspace program

738151 - xHCI driver died after times of attach/detach usb3 hub(with usb3 device) from usb3 root hub

745713 - command-line clocksource override fails

745775 - Unable to unmount autofs filesystems inside a container

745952 - cxgb4: remove forgotten real_num_tx_queues inicialization

746929 - nVidia NVS 300 -- won't boot

747034 - nVidia NVS 450 -- won't boot

747106 - CVE-2011-4131 kernel: nfs4_getfacl decoding kernel oops

749117 - extN: new file created even if open(2) returned -EPERM

752137 - memcg: catch memcg page accounting leaks in debug kernel

755046 - max_segments in dm is always 128

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.