Scientific Linux 6: 2016-0494-1 Moderate: Kernel Bug Fix and Enhancement

Date: Tue, 22 Mar 2016 14:50:11 -0500
Reply-To: Pat Riehecky 
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: FASTBUGS for SL 6x i386, x86_64 now available
MIME-Version: 1.0
Message-ID: <56F1A1F3.5000208@fnal.gov>

The following FASTBUGS have been uploaded to

i386:
389-ds-base-1.2.11.15-72.el6_7.i686.rpm
389-ds-base-devel-1.2.11.15-72.el6_7.i686.rpm
389-ds-base-libs-1.2.11.15-72.el6_7.i686.rpm
ca-certificates-2015.2.6-65.0.1.el6_7.noarch.rpm
crash-7.1.0-3.el6_7.1.i686.rpm
crash-devel-7.1.0-3.el6_7.1.i686.rpm
grub-0.97-94.el6_7.1.i686.rpm
haproxy-1.5.4-2.el6_7.2.i686.rpm
httpd-2.2.15-47.sl6.4.i686.rpm
httpd-devel-2.2.15-47.sl6.4.i686.rpm
httpd-manual-2.2.15-47.sl6.4.noarch.rpm
httpd-tools-2.2.15-47.sl6.4.i686.rpm
kdebase-4.3.4-7.el6_7.i686.rpm
kdebase-devel-4.3.4-7.el6_7.i686.rpm
kdebase-libs-4.3.4-7.el6_7.i686.rpm
kexec-tools-2.0.0-286.el6_7.2.i686.rpm
kexec-tools-eppic-2.0.0-286.el6_7.2.i686.rpm
kmod-sdhci-0.1_rh1-1.el6_7.i686.rpm
libcgroup-0.40.rc1-17.el6_7.i686.rpm
libcgroup-devel-0.40.rc1-17.el6_7.i686.rpm
libcgroup-pam-0.40.rc1-17.el6_7.i686.rpm
libipa_hbac-1.12.4-47.el6_7.8.i686.rpm
libipa_hbac-devel-1.12.4-47.el6_7.8.i686.rpm
libipa_hbac-python-1.12.4-47.el6_7.8.i686.rpm
libsss_idmap-1.12.4-47.el6_7.8.i686.rpm
libsss_idmap-devel-1.12.4-47.el6_7.8.i686.rpm
libsss_nss_idmap-1.12.4-47.el6_7.8.i686.rpm
libsss_nss_idmap-devel-1.12.4-47.el6_7.8.i686.rpm
libsss_nss_idmap-python-1.12.4-47.el6_7.8.i686.rpm
libsss_simpleifp-1.12.4-47.el6_7.8.i686.rpm
libsss_simpleifp-devel-1.12.4-47.el6_7.8.i686.rpm
libvirt-0.10.2-54.el6_7.6.i686.rpm
libvirt-client-0.10.2-54.el6_7.6.i686.rpm
libvirt-devel-0.10.2-54.el6_7.6.i686.rpm
libvirt-python-0.10.2-54.el6_7.6.i686.rpm
mod_ssl-2.2.15-47.sl6.4.i686.rpm
mysql-5.1.73-5.el6_7.1.i686.rpm
mysql-bench-5.1.73-5.el6_7.1.i686.rpm
mysql-devel-5.1.73-5.el6_7.1.i686.rpm
mysql-embedded-5.1.73-5.el6_7.1.i686.rpm
mysql-embedded-devel-5.1.73-5.el6_7.1.i686.rpm
mysql-libs-5.1.73-5.el6_7.1.i686.rpm
mysql-server-5.1.73-5.el6_7.1.i686.rpm
mysql-test-5.1.73-5.el6_7.1.i686.rpm
python-sssdconfig-1.12.4-47.el6_7.8.noarch.rpm
sg3_utils-1.28-10.el6_7.i686.rpm
sg3_utils-devel-1.28-10.el6_7.i686.rpm
sg3_utils-libs-1.28-10.el6_7.i686.rpm
sssd-1.12.4-47.el6_7.8.i686.rpm
sssd-ad-1.12.4-47.el6_7.8.i686.rpm
sssd-client-1.12.4-47.el6_7.8.i686.rpm
sssd-common-1.12.4-47.el6_7.8.i686.rpm
sssd-common-pac-1.12.4-47.el6_7.8.i686.rpm
sssd-dbus-1.12.4-47.el6_7.8.i686.rpm
sssd-ipa-1.12.4-47.el6_7.8.i686.rpm
sssd-krb5-1.12.4-47.el6_7.8.i686.rpm
sssd-krb5-common-1.12.4-47.el6_7.8.i686.rpm
sssd-ldap-1.12.4-47.el6_7.8.i686.rpm
sssd-proxy-1.12.4-47.el6_7.8.i686.rpm
sssd-tools-1.12.4-47.el6_7.8.i686.rpm
virt-who-0.12-10.3.el6_7.noarch.rpm
vsftpd-2.2.2-14.el6_7.1.i686.rpm
zsh-4.3.11-4.el6_7.2.i686.rpm
zsh-html-4.3.11-4.el6_7.2.i686.rpm

x86_64:
389-ds-base-1.2.11.15-72.el6_7.x86_64.rpm
389-ds-base-devel-1.2.11.15-72.el6_7.i686.rpm
389-ds-base-devel-1.2.11.15-72.el6_7.x86_64.rpm
389-ds-base-libs-1.2.11.15-72.el6_7.i686.rpm
389-ds-base-libs-1.2.11.15-72.el6_7.x86_64.rpm
ca-certificates-2015.2.6-65.0.1.el6_7.noarch.rpm
crash-7.1.0-3.el6_7.1.x86_64.rpm
crash-devel-7.1.0-3.el6_7.1.i686.rpm
crash-devel-7.1.0-3.el6_7.1.x86_64.rpm
glusterfs-3.6.0.55-1.el6.x86_64.rpm
glusterfs-api-3.6.0.55-1.el6.x86_64.rpm
glusterfs-api-devel-3.6.0.55-1.el6.x86_64.rpm
glusterfs-cli-3.6.0.55-1.el6.x86_64.rpm
glusterfs-devel-3.6.0.55-1.el6.x86_64.rpm
glusterfs-fuse-3.6.0.55-1.el6.x86_64.rpm
glusterfs-geo-replication-3.6.0.55-1.el6.x86_64.rpm
glusterfs-libs-3.6.0.55-1.el6.x86_64.rpm
glusterfs-rdma-3.6.0.55-1.el6.x86_64.rpm
glusterfs-resource-agents-3.6.0.55-1.el6.noarch.rpm
glusterfs-server-3.6.0.55-1.el6.x86_64.rpm
grub-0.97-94.el6_7.1.x86_64.rpm
haproxy-1.5.4-2.el6_7.2.x86_64.rpm
httpd-2.2.15-47.sl6.4.x86_64.rpm
httpd-devel-2.2.15-47.sl6.4.i686.rpm
httpd-devel-2.2.15-47.sl6.4.x86_64.rpm
httpd-manual-2.2.15-47.sl6.4.noarch.rpm
httpd-tools-2.2.15-47.sl6.4.x86_64.rpm
kdebase-4.3.4-7.el6_7.x86_64.rpm
kdebase-devel-4.3.4-7.el6_7.i686.rpm
kdebase-devel-4.3.4-7.el6_7.x86_64.rpm
kdebase-libs-4.3.4-7.el6_7.i686.rpm
kdebase-libs-4.3.4-7.el6_7.x86_64.rpm
kexec-tools-2.0.0-286.el6_7.2.x86_64.rpm
kexec-tools-eppic-2.0.0-286.el6_7.2.x86_64.rpm
kmod-sdhci-0.1_rh1-1.el6_7.x86_64.rpm
libcgroup-0.40.rc1-17.el6_7.i686.rpm
libcgroup-0.40.rc1-17.el6_7.x86_64.rpm
libcgroup-devel-0.40.rc1-17.el6_7.i686.rpm
libcgroup-devel-0.40.rc1-17.el6_7.x86_64.rpm
libcgroup-pam-0.40.rc1-17.el6_7.i686.rpm
libcgroup-pam-0.40.rc1-17.el6_7.x86_64.rpm
libipa_hbac-1.12.4-47.el6_7.8.i686.rpm
libipa_hbac-1.12.4-47.el6_7.8.x86_64.rpm
libipa_hbac-devel-1.12.4-47.el6_7.8.i686.rpm
libipa_hbac-devel-1.12.4-47.el6_7.8.x86_64.rpm
libipa_hbac-python-1.12.4-47.el6_7.8.x86_64.rpm
libsss_idmap-1.12.4-47.el6_7.8.i686.rpm
libsss_idmap-1.12.4-47.el6_7.8.x86_64.rpm
libsss_idmap-devel-1.12.4-47.el6_7.8.i686.rpm
libsss_idmap-devel-1.12.4-47.el6_7.8.x86_64.rpm
libsss_nss_idmap-1.12.4-47.el6_7.8.i686.rpm
libsss_nss_idmap-1.12.4-47.el6_7.8.x86_64.rpm
libsss_nss_idmap-devel-1.12.4-47.el6_7.8.i686.rpm
libsss_nss_idmap-devel-1.12.4-47.el6_7.8.x86_64.rpm
libsss_nss_idmap-python-1.12.4-47.el6_7.8.x86_64.rpm
libsss_simpleifp-1.12.4-47.el6_7.8.i686.rpm
libsss_simpleifp-1.12.4-47.el6_7.8.x86_64.rpm
libsss_simpleifp-devel-1.12.4-47.el6_7.8.i686.rpm
libsss_simpleifp-devel-1.12.4-47.el6_7.8.x86_64.rpm
libvirt-0.10.2-54.el6_7.6.x86_64.rpm
libvirt-client-0.10.2-54.el6_7.6.i686.rpm
libvirt-client-0.10.2-54.el6_7.6.x86_64.rpm
libvirt-devel-0.10.2-54.el6_7.6.i686.rpm
libvirt-devel-0.10.2-54.el6_7.6.x86_64.rpm
libvirt-lock-sanlock-0.10.2-54.el6_7.6.x86_64.rpm
libvirt-python-0.10.2-54.el6_7.6.x86_64.rpm
mod_ssl-2.2.15-47.sl6.4.x86_64.rpm
mysql-5.1.73-5.el6_7.1.x86_64.rpm
mysql-bench-5.1.73-5.el6_7.1.x86_64.rpm
mysql-devel-5.1.73-5.el6_7.1.i686.rpm
mysql-devel-5.1.73-5.el6_7.1.x86_64.rpm
mysql-embedded-5.1.73-5.el6_7.1.i686.rpm
mysql-embedded-5.1.73-5.el6_7.1.x86_64.rpm
mysql-embedded-devel-5.1.73-5.el6_7.1.i686.rpm
mysql-embedded-devel-5.1.73-5.el6_7.1.x86_64.rpm
mysql-libs-5.1.73-5.el6_7.1.i686.rpm
mysql-libs-5.1.73-5.el6_7.1.x86_64.rpm
mysql-server-5.1.73-5.el6_7.1.x86_64.rpm
mysql-test-5.1.73-5.el6_7.1.x86_64.rpm
python-sssdconfig-1.12.4-47.el6_7.8.noarch.rpm
sg3_utils-1.28-10.el6_7.x86_64.rpm
sg3_utils-devel-1.28-10.el6_7.i686.rpm
sg3_utils-devel-1.28-10.el6_7.x86_64.rpm
sg3_utils-libs-1.28-10.el6_7.i686.rpm
sg3_utils-libs-1.28-10.el6_7.x86_64.rpm
sssd-1.12.4-47.el6_7.8.x86_64.rpm
sssd-ad-1.12.4-47.el6_7.8.x86_64.rpm
sssd-client-1.12.4-47.el6_7.8.i686.rpm
sssd-client-1.12.4-47.el6_7.8.x86_64.rpm
sssd-common-1.12.4-47.el6_7.8.x86_64.rpm
sssd-common-pac-1.12.4-47.el6_7.8.x86_64.rpm
sssd-dbus-1.12.4-47.el6_7.8.x86_64.rpm
sssd-ipa-1.12.4-47.el6_7.8.x86_64.rpm
sssd-krb5-1.12.4-47.el6_7.8.x86_64.rpm
sssd-krb5-common-1.12.4-47.el6_7.8.x86_64.rpm
sssd-ldap-1.12.4-47.el6_7.8.x86_64.rpm
sssd-proxy-1.12.4-47.el6_7.8.x86_64.rpm
sssd-tools-1.12.4-47.el6_7.8.x86_64.rpm
virt-who-0.12-10.3.el6_7.noarch.rpm
vsftpd-2.2.2-14.el6_7.1.x86_64.rpm
zsh-4.3.11-4.el6_7.2.x86_64.rpm
zsh-html-4.3.11-4.el6_7.2.x86_64.rpm
Date: Wed, 23 Mar 2016 16:28:00 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: kernel on SL6.x i386/x86_64
MIME-Version: 1.0
Message-ID: <20160323162800.22520.90980@slpackages.fnal.gov>

Synopsis: Moderate: kernel security, bug fix, and enhancement
Advisory ID: SLSA-2016:0494-1
Issue Date: 2016-03-23
CVE Numbers: CVE-2016-0774
--

* It was found that the fix for CVE-2015-1805 incorrectly kept buffer
offset and buffer length in sync on a failed atomic read, potentially
resulting in a pipe buffer state corruption. A local, unprivileged user
could use this flaw to crash the system or leak kernel memory to user
space. (CVE-2016-0774, Moderate)

This update also fixes the following bugs:

* In the anon_vma structure, the degree counts number of child anon_vmas
and of VMAs which points to this anon_vma. Failure to decrement the
parent's degree in the unlink_anon_vma() function, when its list was
empty, previously triggered a BUG_ON() assertion. The provided patch makes
sure the anon_vma degree is always decremented when the VMA list is empty,
thus fixing this bug.

* When running Internet Protocol Security (IPSEC) on external storage
encrypted with LUKS under a substantial load on the system, data
corruptions could previously occur. A set of upstream patches has been
provided, and data corruption is no longer reported in this situation.

* Due to prematurely decremented calc_load_task, the calculated load
average was off by up to the number of CPUs in the machine. As a
consequence, job scheduling worked improperly causing a drop in the system
performance. This update keeps the delta of the CPU going into NO_HZ idle
separately, and folds the pending idle delta into the global active count
while correctly aging the averages for the idle-duration when leaving
NO_HZ mode. Now, job scheduling works correctly, ensuring balanced CPU
load.

* Due to a regression in the Scientific Linux 6.7 kernel, the cgroup OOM
notifier accessed a cgroup-specific internal data structure without a
proper locking protection, which led to a kernel panic. This update
adjusts the cgroup OOM notifier to lock internal data properly, thus
fixing the bug.

* GFS2 had a rare timing window that sometimes caused it to reference an
uninitialized variable. Consequently, a kernel panic occurred. The code
has been changed to reference the correct value during this timing window,
and the kernel no longer panics.

* Due to a race condition whereby a cache operation could be submitted
after a cache object was killed, the kernel occasionally crashed on
systems running the cachefilesd service. The provided patch prevents the
race condition by adding serialization in the code that makes the object
unavailable. As a result, all subsequent operations targetted on the
object are rejected and the kernel no longer crashes in this scenario.

This update also adds this enhancement:

* The lpfc driver has been updated to version 11.0.0.4.

The system must be rebooted for this update to take effect.
--

SL6
 x86_64
 kernel-2.6.32-573.22.1.el6.x86_64.rpm
 kernel-debug-2.6.32-573.22.1.el6.x86_64.rpm
 kernel-debug-debuginfo-2.6.32-573.22.1.el6.i686.rpm
 kernel-debug-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
 kernel-debug-devel-2.6.32-573.22.1.el6.i686.rpm
 kernel-debug-devel-2.6.32-573.22.1.el6.x86_64.rpm
 kernel-debuginfo-2.6.32-573.22.1.el6.i686.rpm
 kernel-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
 kernel-debuginfo-common-i686-2.6.32-573.22.1.el6.i686.rpm
 kernel-debuginfo-common-x86_64-2.6.32-573.22.1.el6.x86_64.rpm
 kernel-devel-2.6.32-573.22.1.el6.x86_64.rpm
 kernel-headers-2.6.32-573.22.1.el6.x86_64.rpm
 perf-2.6.32-573.22.1.el6.x86_64.rpm
 perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm
 perf-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
 python-perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm
 python-perf-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
 python-perf-2.6.32-573.22.1.el6.x86_64.rpm
 i386
 kernel-2.6.32-573.22.1.el6.i686.rpm
 kernel-debug-2.6.32-573.22.1.el6.i686.rpm
 kernel-debug-debuginfo-2.6.32-573.22.1.el6.i686.rpm
 kernel-debug-devel-2.6.32-573.22.1.el6.i686.rpm
 kernel-debuginfo-2.6.32-573.22.1.el6.i686.rpm
 kernel-debuginfo-common-i686-2.6.32-573.22.1.el6.i686.rpm
 kernel-devel-2.6.32-573.22.1.el6.i686.rpm
 kernel-headers-2.6.32-573.22.1.el6.i686.rpm
 perf-2.6.32-573.22.1.el6.i686.rpm
 perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm
 python-perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm
 python-perf-2.6.32-573.22.1.el6.i686.rpm
 noarch
 kernel-abi-whitelists-2.6.32-573.22.1.el6.noarch.rpm
 kernel-doc-2.6.32-573.22.1.el6.noarch.rpm
 kernel-firmware-2.6.32-573.22.1.el6.noarch.rpm

- Scientific Linux Development Team