Date:         Sat, 8 Aug 2009 22:32:29 -0500
Reply-To:     Connie Sieh 
Sender:       Security Errata for Scientific Linux
              
From:         Connie Sieh 
Subject:      Security ERRATA Important: kernel for SL 5.x on i386/x86_64
Comments: To: scientific 

Synopsis:          Important: kernel
CVE Names:         CVE-2007-5966 CVE-2009-1385 CVE-2009-1388
                       CVE-2009-1389 CVE-2009-1895 CVE-2009-2406
                       CVE-2009-2407

      CVE-2007-5966 kernel: non-root can trigger cpu_idle soft lockup
      CVE-2009-1385 kernel: e1000_clean_rx_irq() denial of service
      CVE-2009-1388 kernel: do_coredump() vs ptrace_start() deadlock
      CVE-2009-1389 kernel: r8169: fix crash when large packets are received
      CVE-2009-1895 kernel: personality: fix PER_CLEAR_ON_SETID
      CVE-2009-2406 kernel: ecryptfs stack overflow in parse_tag_11_packet()
      CVE-2009-2407 kernel: ecryptfs heap overflow in parse_tag_3_packet()

Security fixes:

* the possibility of a timeout value overflow was found in the Linux kernel
high-resolution timers functionality, hrtimers. This could allow a local,
unprivileged user to execute arbitrary code, or cause a denial of service
(kernel panic). (CVE-2007-5966, Important)

* a flaw was found in the Intel PRO/1000 network driver in the Linux
kernel. Frames with sizes near the MTU of an interface may be split across
multiple hardware receive descriptors. Receipt of such a frame could leak
through a validation check, leading to a corruption of the length check. A
remote attacker could use this flaw to send a specially-crafted packet that
would cause a denial of service or code execution. (CVE-2009-1385,
Important)

* Michael Tokarev reported a flaw in the Realtek r8169 Ethernet driver in
the Linux kernel. This driver allowed interfaces using this driver to
receive frames larger than could be handled, which could lead to a remote
denial of service or code execution. (CVE-2009-1389, Important)

* the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a
setuid or setgid program was executed. A local, unprivileged user could use
this flaw to bypass the mmap_min_addr protection mechanism and perform a
NULL pointer dereference attack, or bypass the Address Space Layout
Randomization (ASLR) security feature. (CVE-2009-1895, Important)

* Ramon de Carvalho Valle reported two flaws in the Linux kernel eCryptfs
implementation. A local attacker with permissions to perform an eCryptfs
mount could modify the metadata of the files in that eCrypfts mount to
cause a buffer overflow, leading to a denial of service or privilege
escalation. (CVE-2009-2406, CVE-2009-2407, Important)

* Konstantin Khlebnikov discovered a race condition in the ptrace
implementation in the Linux kernel. This race condition can occur when the
process tracing and the process being traced participate in a core dump. A
local, unprivileged user could use this flaw to trigger a deadlock,
resulting in a partial denial of service. (CVE-2009-1388, Moderate)

Bug fixes:

* possible host (dom0) crash when installing a Xen para-virtualized guest
while another para-virtualized guest was rebooting. (BZ#497812)

* no audit record for a directory removal if the directory and its subtree
were recursively watched by an audit rule. (BZ#507561)

* running "echo 1 > /proc/sys/vm/drop_caches" on systems under high memory
load could cause a kernel panic. (BZ#503692)

* on 32-bit systems, core dumps for some multithreaded applications did not
include all thread information. (BZ#505322)

* a stack buffer used by get_event_name() was not large enough for the nul
terminator sprintf() writes. This could lead to an invalid pointer or
kernel panic. (BZ#506906)

* when using the aic94xx driver, a system with SATA drives may not boot due
to a bug in libsas. (BZ#506029)

* incorrect stylus button handling when moving it away then returning it to
the tablet for Wacom Cintiq 21UX and Intuos tablets. (BZ#508275)

* CPU "soft lockup" messages and possibly a system hang on systems with
certain Broadcom network devices and running the Linux kernel from the
kernel-xen package. (BZ#503689)

* on 64-bit PowerPC, getitimer() failed for programs using the ITIMER_REAL
timer and that were also compiled for 64-bit systems (this caused such
programs to abort). (BZ#510018)

* write operations could be blocked even when using O_NONBLOCK. (BZ#510239)

* the "pci=nomsi" option was required for installing and booting Red Hat
Enterprise Linux 5.2 on systems with VIA VT3364 chipsets. (BZ#507529)

* shutting down, destroying, or migrating Xen guests with large amounts of
memory could cause other guests to be temporarily unresponsive. (BZ#512311)

SRPMS:
       kernel-2.6.18-128.4.1.el5.src.rpm

i386:
      kernel-2.6.18-128.4.1.el5.i686.rpm
      kernel-PAE-2.6.18-128.4.1.el5.i686.rpm
      kernel-PAE-devel-2.6.18-128.4.1.el5.i686.rpm
      kernel-debug-2.6.18-128.4.1.el5.i686.rpm
      kernel-debug-devel-2.6.18-128.4.1.el5.i686.rpm
      kernel-devel-2.6.18-128.4.1.el5.i686.rpm
      kernel-headers-2.6.18-128.4.1.el5.i386.rpm
      kernel-xen-2.6.18-128.4.1.el5.i686.rpm
      kernel-xen-devel-2.6.18-128.4.1.el5.i686.rpm
      kernel-doc-2.6.18-128.4.1.el5.noarch.rpm
      kernel-module-aufs-2.6.18-128.4.1.el5-0.20090202.cvs-6.sl5.i686.rpm
      kernel-module-aufs-2.6.18-128.4.1.el5PAE-0.20090202.cvs-6.sl5.i686.rpm
      kernel-module-aufs-2.6.18-128.4.1.el5xen-0.20090202.cvs-6.sl5.i686.rpm
      kernel-module-fuse-2.6.18-128.4.1.el5-2.6.3-1.sl5.i686.rpm
      kernel-module-fuse-2.6.18-128.4.1.el5PAE-2.6.3-1.sl5.i686.rpm
      kernel-module-fuse-2.6.18-128.4.1.el5xen-2.6.3-1.sl5.i686.rpm
      kernel-module-ipw3945-2.6.18-128.4.1.el5-1.2.0-2.sl5.i686.rpm
      kernel-module-ipw3945-2.6.18-128.4.1.el5PAE-1.2.0-2.sl5.i686.rpm
      kernel-module-ipw3945-2.6.18-128.4.1.el5xen-1.2.0-2.sl5.i686.rpm
      kernel-module-madwifi-2.6.18-128.4.1.el5-0.9.4-15.sl5.i686.rpm
      kernel-module-madwifi-2.6.18-128.4.1.el5PAE-0.9.4-15.sl5.i686.rpm
      kernel-module-madwifi-2.6.18-128.4.1.el5xen-0.9.4-15.sl5.i686.rpm
      kernel-module-madwifi-hal-2.6.18-128.4.1.el5-0.9.4-15.sl5.i686.rpm
      kernel-module-madwifi-hal-2.6.18-128.4.1.el5PAE-0.9.4-15.sl5.i686.rpm
      kernel-module-madwifi-hal-2.6.18-128.4.1.el5xen-0.9.4-15.sl5.i686.rpm
      kernel-module-ndiswrapper-2.6.18-128.4.1.el5-1.53-1.SL.i686.rpm
      kernel-module-ndiswrapper-2.6.18-128.4.1.el5PAE-1.53-1.SL.i686.rpm
      kernel-module-ndiswrapper-2.6.18-128.4.1.el5xen-1.53-1.SL.i686.rpm
      kernel-module-openafs-2.6.18-128.4.1.el5-1.4.7-68.2.SL5.i686.rpm
      kernel-module-openafs-2.6.18-128.4.1.el5PAE-1.4.7-68.2.SL5.i686.rpm
      kernel-module-openafs-2.6.18-128.4.1.el5xen-1.4.7-68.2.SL5.i686.rpm
      kernel-module-xfs-2.6.18-128.4.1.el5-0.4-2.sl5.i686.rpm
      kernel-module-xfs-2.6.18-128.4.1.el5PAE-0.4-2.sl5.i686.rpm
      kernel-module-xfs-2.6.18-128.4.1.el5xen-0.4-2.sl5.i686.rpm

x86_64:
      kernel-2.6.18-128.4.1.el5.x86_64.rpm
      kernel-debug-2.6.18-128.4.1.el5.x86_64.rpm
      kernel-debug-devel-2.6.18-128.4.1.el5.x86_64.rpm
      kernel-devel-2.6.18-128.4.1.el5.x86_64.rpm
      kernel-headers-2.6.18-128.4.1.el5.x86_64.rpm
      kernel-xen-2.6.18-128.4.1.el5.x86_64.rpm
      kernel-xen-devel-2.6.18-128.4.1.el5.x86_64.rpm
      kernel-doc-2.6.18-128.4.1.el5.noarch.rpm
      kernel-module-aufs-2.6.18-128.4.1.el5-0.20090202.cvs-6.sl5.x86_64.rpm
      kernel-module-aufs-2.6.18-128.4.1.el5xen-0.20090202.cvs-6.sl5.x86_64.rpm
      kernel-module-fuse-2.6.18-128.4.1.el5-2.6.3-1.sl5.x86_64.rpm
      kernel-module-fuse-2.6.18-128.4.1.el5xen-2.6.3-1.sl5.x86_64.rpm
      kernel-module-ipw3945-2.6.18-128.4.1.el5-1.2.0-2.sl5.x86_64.rpm
      kernel-module-ipw3945-2.6.18-128.4.1.el5xen-1.2.0-2.sl5.x86_64.rpm
      kernel-module-madwifi-2.6.18-128.4.1.el5-0.9.4-15.sl5.x86_64.rpm
      kernel-module-madwifi-2.6.18-128.4.1.el5xen-0.9.4-15.sl5.x86_64.rpm
      kernel-module-madwifi-hal-2.6.18-128.4.1.el5-0.9.4-15.sl5.x86_64.rpm
      kernel-module-madwifi-hal-2.6.18-128.4.1.el5xen-0.9.4-15.sl5.x86_64.rpm
      kernel-module-ndiswrapper-2.6.18-128.4.1.el5-1.53-1.SL.x86_64.rpm
      kernel-module-ndiswrapper-2.6.18-128.4.1.el5xen-1.53-1.SL.x86_64.rpm
      kernel-module-openafs-2.6.18-128.4.1.el5-1.4.7-68.2.SL5.x86_64.rpm
      kernel-module-openafs-2.6.18-128.4.1.el5xen-1.4.7-68.2.SL5.x86_64.rpm
      kernel-module-xfs-2.6.18-128.4.1.el5-0.4-2.sl5.x86_64.rpm
      kernel-module-xfs-2.6.18-128.4.1.el5xen-0.4-2.sl5.x86_64.rpm

-Connie Sieh
-Troy Dawson