SuSE: 2010-013: Linux kernel Security Update
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Announcement
Package: kernel
Announcement ID: SUSE-SA:2010:013
Date: Thu, 18 Feb 2010 16:00:00 +0000
Affected Products: SUSE SLES 9
Novell Linux POS 9
Vulnerability Type: remote denial of service
CVSS v2 Base Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
SUSE Default Package: yes
Cross-References: CVE-2009-1883, CVE-2009-2903, CVE-2009-3080
CVE-2009-3620, CVE-2009-3621, CVE-2009-3889
CVE-2009-4005, CVE-2009-4536, CVE-2010-0007
Content of This Advisory:
1) Security Vulnerability Resolved:
Linux kernel security update
Problem Description
2) Solution or Work-Around
3) Special Instructions and Notes
4) Package Location and Checksums
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
See SUSE Security Summary Report.
6) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Problem Description and Brief Discussion
This update fixes various security issues and some bugs in the SUSE
Linux Enterprise 9 kernel.
CVE-2009-4005: The collect_rx_frame function in
drivers/isdn/hisax/hfc_usb.c in the Linux kernel allows attackers to have an unspecified impact via a crafted HDLC packet that arrives
over ISDN and triggers a buffer under-read.
CVE-2009-3080: Array index error in the gdth_read_event function in
drivers/scsi/gdth.c in the Linux kernel allows local users to cause
a denial of service or possibly gain privileges via a negative event
index in an IOCTL request.
CVE-2010-0007: Missing CAP_NET_ADMIN checks in the ebtables netfilter
code might have allowed local attackers to modify bridge firewall
settings.
CVE-2009-4536: drivers/net/e1000/e1000_main.c in the e1000 driver
in the Linux kernel handles Ethernet frames that exceed the MTU by
processing certain trailing payload data as if it were a complete
frame, which allows remote attackers to bypass packet filters via a
large packet with a crafted payload.
CVE-2009-3889: The dbg_lvl file for the megaraid_sas driver in the
Linux kernel has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by
modifying this file.
CVE-2009-1883: The z90crypt_unlocked_ioctl function in the z90crypt
driver in the Linux kernel does not perform a capability check for
the Z90QUIESCE operation, which allows local users to leverage euid
0 privileges to force a driver outage.
CVE-2009-2903: Memory leak in the appletalk subsystem in the Linux
kernel, when the appletalk and ipddp modules are loaded but the
ipddp"N" device is not found, allows remote attackers to cause a
denial of service (memory consumption) via IP-DDP datagrams.
CVE-2009-3621: net/unix/af_unix.c in the Linux kernel allows local
users to cause a denial of service (system hang) by creating an
abstract-namespace AF_UNIX listening socket, performing a shutdown
operation on this socket, and then performing a series of connect
operations to this socket.
CVE-2009-3620: The ATI Rage 128 (aka r128) driver in the Linux
kernel does not properly verify Concurrent Command Engine (CCE)
state initialization, which allows local users to cause a denial of
service (NULL pointer dereference and system crash) or possibly gain
privileges via unspecified ioctl calls.
2) Solution or Work-Around
There is no known workaround, please install the update packages.
3) Special Instructions and Notes
Please reboot the machine after installing the update.
4) Package Location and Checksums
The preferred method for installing security updates is to use the YaST
Online Update (YOU) tool. YOU detects which updates are required and
automatically performs the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command
rpm -Fhv
References
