SuSE: 2009-056: Linux kernel Security Update
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Announcement
Package: kernel
Announcement ID: SUSE-SA:2009:056
Date: Mon, 16 Nov 2009 13:00:00 +0000
Affected Products: SUSE SLES 9
Novell Linux Desktop 9
Novell Linux POS 9
Vulnerability Type: local privilege escalation
Severity (1-10): 7
SUSE Default Package: yes
Cross-References: CVE-2009-1192, CVE-2009-1633, CVE-2009-2848
CVE-2009-2909, CVE-2009-2910, CVE-2009-3002
CVE-2009-3547, CVE-2009-3726
Content of This Advisory:
1) Security Vulnerability Resolved:
Linux kernel security update
Problem Description
2) Solution or Work-Around
3) Special Instructions and Notes
4) Package Location and Checksums
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
See SUSE Security Summary Report.
6) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Problem Description and Brief Discussion
Several security issues and some bugs were fixed in the SUSE Linux
Enterprise 9 kernel.
Following security bugs were fixed:
CVE-2009-3547: A race condition in the pipe(2) system call could be
used by local attackers to execute code and escalate privileges.
CVE-2009-2910: On x86_64 systems a information leak of high register
contents (upper 32bit) was fixed.
CVE-2009-1192: The (1) agp_generic_alloc_page and (2)
agp_generic_alloc_pages functions in drivers/char/agp/generic.c in
the agp subsystem in the Linux kernel do not zero out pages that may
later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.
CVE-2009-2909: Unsigned check in the ax25 socket handler could allow
local attackers to potentially crash the kernel or even execute code.
CVE-2009-2848: The execve function in the Linux kernel did not properly
clear the current->clear_child_tid pointer, which allows local
users to cause a denial of service (memory corruption) or possibly
gain privileges via a clone system call with CLONE_CHILD_SETTID or
CLONE_CHILD_CLEARTID enabled, which is not properly handled during
thread creation and exit.
CVE-2009-3002: Fixed various socket handler getname leaks, which
could disclose memory previously used by the kernel or other userland
processes to the local attacker.
CVE-2009-1633: Multiple buffer overflows in the cifs subsystem in the
Linux kernel allow remote CIFS servers to cause a denial of service
(memory corruption) and possibly have unspecified other impact via (1)
a malformed Unicode string, related to Unicode string area alignment
in fs/cifs/sess.c; or (2) long Unicode characters, related to
fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.
CVE-2009-3726: The nfs4_proc_lock function in fs/nfs/nfs4proc.c in
the NFSv4 client in the allows remote NFS servers to cause a denial
of service (NULL pointer dereference and panic) by sending a certain
response containing incorrect file attributes, which trigger attempted
use of an open file that lacks NFSv4 state.
For a complete list of changes, please refer to the RPM changelog.
2) Solution or Work-Around
There is no known workaround, please install the update packages.
3) Special Instructions and Notes
Reboot the machine after installing the update.
4) Package Location and Checksums
The preferred method for installing security updates is to use the YaST
Online Update (YOU) tool. YOU detects which updates are required and
automatically performs the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command
rpm -Fhv
References
