Scientific Linux: CVE-2010-1083 Important Kernel Security Fix

Date: Thu, 30 Sep 2010 10:44:10 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Important: kernel on SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Important: kernel security and bug fix update
Issue date:	2010-09-29
CVE Names:	CVE-2010-1083 CVE-2010-2492 CVE-2010-2798
 CVE-2010-2938 CVE-2010-2942 CVE-2010-2943
 CVE-2010-3015

This update fixes the following security issues:

* A buffer overflow flaw was found in the ecryptfs_uid_hash() function
in the Linux kernel eCryptfs implementation. On systems that have the
eCryptfs netlink transport (Scientific Linux 5 does) or where the
"/dev/ecryptfs" file has world writable permissions (which it does not,
by default, on Scientific Linux 5), a local, unprivileged user could
use this flaw to cause a denial of service or possibly escalate their
privileges. (CVE-2010-2492, Important)

* A miscalculation of the size of the free space of the initial
directory entry in a directory leaf block was found in the Linux kernel
Global File System 2 (GFS2) implementation. A local, unprivileged user
with write access to a GFS2-mounted file system could perform a rename
operation on that file system to trigger a NULL pointer dereference,
possibly resulting in a denial of service or privilege escalation.
(CVE-2010-2798, Important)

* A flaw was found in the Xen hypervisor implementation when running a
system that has an Intel CPU without Extended Page Tables (EPT) support.
While attempting to dump information about a crashing fully-virtualized
guest, the flaw could cause the hypervisor to crash the host as well. A
user with permissions to configure a fully-virtualized guest system
could use this flaw to crash the host. (CVE-2010-2938, Moderate)

* Information leak flaws were found in the Linux kernel's Traffic
Control Unit implementation. A local attacker could use these flaws to
cause the kernel to leak kernel memory to user-space, possibly leading
to the disclosure of sensitive information. (CVE-2010-2942, Moderate)

* A flaw was found in the Linux kernel's XFS file system implementation.
The file handle lookup could return an invalid inode as valid. If an XFS
file system was mounted via NFS (Network File System), a local attacker
could access stale data or overwrite existing data that reused the
inodes. (CVE-2010-2943, Moderate)

* An integer overflow flaw was found in the extent range checking code
in the Linux kernel's ext4 file system implementation. A local,
unprivileged user with write access to an ext4-mounted file system could
trigger this flaw by writing to a file at a very large file offset,
resulting in a local denial of service. (CVE-2010-3015, Moderate)

* An information leak flaw was found in the Linux kernel's USB
implementation. Certain USB errors could result in an uninitialized
kernel buffer being sent to user-space. An attacker with physical access
to a target system could use this flaw to cause an information leak.
(CVE-2010-1083, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

SL 5.x

 SRPMS:
kernel-2.6.18-194.17.1.el5.src.rpm
 i386:
kernel-2.6.18-194.17.1.el5.i686.rpm
kernel-debug-2.6.18-194.17.1.el5.i686.rpm
kernel-debug-devel-2.6.18-194.17.1.el5.i686.rpm
kernel-devel-2.6.18-194.17.1.el5.i686.rpm
kernel-doc-2.6.18-194.17.1.el5.noarch.rpm
kernel-PAE-2.6.18-194.17.1.el5.i686.rpm
kernel-PAE-devel-2.6.18-194.17.1.el5.i686.rpm
kernel-xen-2.6.18-194.17.1.el5.i686.rpm
kernel-xen-devel-2.6.18-194.17.1.el5.i686.rpm
 Dependancies:
kernel-module-aufs-2.6.18-194.17.1.el5-0.20090202.cvs-6.sl5.i686.rpm
kernel-module-aufs-2.6.18-194.17.1.el5PAE-0.20090202.cvs-6.sl5.i686.rpm
kernel-module-aufs-2.6.18-194.17.1.el5xen-0.20090202.cvs-6.sl5.i686.rpm
kernel-module-ipw3945-2.6.18-194.17.1.el5-1.2.0-2.sl5.i686.rpm
kernel-module-ipw3945-2.6.18-194.17.1.el5PAE-1.2.0-2.sl5.i686.rpm
kernel-module-ipw3945-2.6.18-194.17.1.el5xen-1.2.0-2.sl5.i686.rpm
kernel-module-madwifi-2.6.18-194.17.1.el5-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-2.6.18-194.17.1.el5PAE-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-2.6.18-194.17.1.el5xen-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-hal-2.6.18-194.17.1.el5-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-hal-2.6.18-194.17.1.el5PAE-0.9.4-15.sl5.i686.rpm
kernel-module-madwifi-hal-2.6.18-194.17.1.el5xen-0.9.4-15.sl5.i686.rpm
kernel-module-ndiswrapper-2.6.18-194.17.1.el5-1.55-1.SL.i686.rpm
kernel-module-ndiswrapper-2.6.18-194.17.1.el5PAE-1.55-1.SL.i686.rpm
kernel-module-ndiswrapper-2.6.18-194.17.1.el5xen-1.55-1.SL.i686.rpm
kernel-module-openafs-2.6.18-194.17.1.el5-1.4.12-79.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.17.1.el5PAE-1.4.12-79.sl5.i686.rpm
kernel-module-openafs-2.6.18-194.17.1.el5xen-1.4.12-79.sl5.i686.rpm
kernel-module-xfs-2.6.18-194.17.1.el5-0.4-2.sl5.i686.rpm
kernel-module-xfs-2.6.18-194.17.1.el5PAE-0.4-2.sl5.i686.rpm
kernel-module-xfs-2.6.18-194.17.1.el5xen-0.4-2.sl5.i686.rpm

 x86_64:
kernel-2.6.18-194.17.1.el5.x86_64.rpm
kernel-debug-2.6.18-194.17.1.el5.x86_64.rpm
kernel-debug-devel-2.6.18-194.17.1.el5.x86_64.rpm
kernel-devel-2.6.18-194.17.1.el5.x86_64.rpm
kernel-doc-2.6.18-194.17.1.el5.noarch.rpm
kernel-headers-2.6.18-194.17.1.el5.x86_64.rpm
kernel-xen-2.6.18-194.17.1.el5.x86_64.rpm
kernel-xen-devel-2.6.18-194.17.1.el5.x86_64.rpm
 Dependancies:
kernel-module-aufs-2.6.18-194.17.1.el5-0.20090202.cvs-6.sl5.x86_64.rpm
kernel-module-aufs-2.6.18-194.17.1.el5xen-0.20090202.cvs-6.sl5.x86_64.rpm
kernel-module-ipw3945-2.6.18-194.17.1.el5-1.2.0-2.sl5.x86_64.rpm
kernel-module-ipw3945-2.6.18-194.17.1.el5xen-1.2.0-2.sl5.x86_64.rpm
kernel-module-madwifi-2.6.18-194.17.1.el5-0.9.4-15.sl5.x86_64.rpm
kernel-module-madwifi-2.6.18-194.17.1.el5xen-0.9.4-15.sl5.x86_64.rpm
kernel-module-madwifi-hal-2.6.18-194.17.1.el5-0.9.4-15.sl5.x86_64.rpm
kernel-module-madwifi-hal-2.6.18-194.17.1.el5xen-0.9.4-15.sl5.x86_64.rpm
kernel-module-ndiswrapper-2.6.18-194.17.1.el5-1.55-1.SL.x86_64.rpm
kernel-module-ndiswrapper-2.6.18-194.17.1.el5xen-1.55-1.SL.x86_64.rpm
kernel-module-openafs-2.6.18-194.17.1.el5-1.4.11-76.sl5.x86_64.rpm
kernel-module-openafs-2.6.18-194.17.1.el5-1.4.12-79.sl5.x86_64.rpm
kernel-module-openafs-2.6.18-194.17.1.el5xen-1.4.11-76.sl5.x86_64.rpm
kernel-module-openafs-2.6.18-194.17.1.el5xen-1.4.12-79.sl5.x86_64.rpm

-Connie Sieh
-Troy Dawson