Scientific Linux: CVE-2012-2100 Moderate: Kernel Denial of Service Fix

Date: Wed, 19 Dec 2012 09:45:12 -0600
Reply-To: Pat Riehecky 
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Organization: Fermilab
Subject: Security ERRATA Moderate: kernel on SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Moderate: kernel security, bug fix and enhancement update
Issue Date: 2012-12-18
CVE Numbers: CVE-2012-2100
 CVE-2012-4565
 CVE-2012-2375
 CVE-2012-4444
 CVE-2012-5517
--

This update fixes the following security issues:

* It was found that a previous update did not correctly fix the
CVE-2011-4131
issue. A malicious Network File System version 4 (NFSv4) server could return
a crafted reply to a GETACL request, causing a denial of service on the
client.
(CVE-2012-2375, Moderate)

* A divide-by-zero flaw was found in the TCP Illinois congestion control
algorithm implementation in the Linux kernel. If the TCP Illinois congestion
control algorithm were in use (the sysctl net.ipv4.tcp_congestion_control
variable set to "illinois"), a local, unprivileged user could trigger
this flaw
and cause a denial of service. (CVE-2012-4565, Moderate)

* A NULL pointer dereference flaw was found in the way a new node's hot
added
memory was propagated to other nodes' zonelists. By utilizing this newly
added
memory from one of the remaining nodes, a local, unprivileged user could use
this flaw to cause a denial of service. (CVE-2012-5517, Moderate)

* It was found that the initial release of Scientific Linux 6 did not
correctly
fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system
code. A local, unprivileged user with the ability to mount an ext4 file
system
could use this flaw to cause a denial of service. (CVE-2012-2100, Low)

* A flaw was found in the way the Linux kernel's IPv6 implementation handled
overlapping, fragmented IPv6 packets. A remote attacker could
potentially use
this flaw to bypass protection mechanisms (such as a firewall or intrusion
detection system (IDS)) when sending network packets to a target system.
(CVE-2012-4444, Low)

The system must be rebooted for this update to take effect.
--

SL6
 x86_64
 kernel-2.6.32-279.19.1.el6.x86_64.rpm
 kernel-debug-2.6.32-279.19.1.el6.x86_64.rpm
 kernel-debug-debuginfo-2.6.32-279.19.1.el6.x86_64.rpm
 kernel-debug-devel-2.6.32-279.19.1.el6.x86_64.rpm
 kernel-debuginfo-2.6.32-279.19.1.el6.x86_64.rpm
 kernel-debuginfo-common-x86_64-2.6.32-279.19.1.el6.x86_64.rpm
 kernel-devel-2.6.32-279.19.1.el6.x86_64.rpm
 kernel-headers-2.6.32-279.19.1.el6.x86_64.rpm
 perf-2.6.32-279.19.1.el6.x86_64.rpm
 perf-debuginfo-2.6.32-279.19.1.el6.x86_64.rpm
 python-perf-debuginfo-2.6.32-279.19.1.el6.x86_64.rpm
 python-perf-2.6.32-279.19.1.el6.x86_64.rpm
 i386
 kernel-2.6.32-279.19.1.el6.i686.rpm
 kernel-debug-2.6.32-279.19.1.el6.i686.rpm
 kernel-debug-debuginfo-2.6.32-279.19.1.el6.i686.rpm
 kernel-debug-devel-2.6.32-279.19.1.el6.i686.rpm
 kernel-debuginfo-2.6.32-279.19.1.el6.i686.rpm
 kernel-debuginfo-common-i686-2.6.32-279.19.1.el6.i686.rpm
 kernel-devel-2.6.32-279.19.1.el6.i686.rpm
 kernel-headers-2.6.32-279.19.1.el6.i686.rpm
 perf-2.6.32-279.19.1.el6.i686.rpm
 perf-debuginfo-2.6.32-279.19.1.el6.i686.rpm
 python-perf-debuginfo-2.6.32-279.19.1.el6.i686.rpm
 python-perf-2.6.32-279.19.1.el6.i686.rpm
 noarch
 kernel-doc-2.6.32-279.19.1.el6.noarch.rpm
 kernel-firmware-2.6.32-279.19.1.el6.noarch.rpm

- Scientific Linux Development Team