The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0178 advisory.

  - Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote     attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that     triggers a certain state change in the absence of an aggregation session. (CVE-2009-4027)

  - The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-     assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed     ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex     value). (CVE-2009-4307)

  - The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in     the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files     that are setgid without group-execute permission, which allows local users to cause a denial of service     (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this     file's permissions. (CVE-2010-0727)

  - Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when     IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service     (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not     properly handled and causes the skb structure to be freed. (CVE-2010-1188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix bug number for commit 'cciss: Update HPSA_BOUNDARY'     (Joe Jin) [Orabug: 14681166]

  - cciss: Update HPSA_BOUNDARY. (Joe Jin) [Orabug:
    14319765]

  - KVM: introduce kvm_for_each_memslot macro (Maxim Uvarov)     [Bugdb: 13966]

  - dl2k: Clean up rio_ioctl (Jeff Mahoney) [Orabug:
    14126896] (CVE-2012-2313)

  - NFSv4: include bitmap in nfsv4 get acl data (Andy     Adamson) (CVE-2011-4131)

  - KVM: Fix buffer overflow in kvm_set_irq (Avi Kivity)     [Bugdb: 13966] (CVE-2012-2137)

  - net: sock: validate data_len before allocating skb in     sock_alloc_send_pskb (Jason Wang) [Bugdb: 13966]     (CVE-2012-2136)

  - mm: pmd_read_atomic: fix 32bit PAE pmd walk vs     pmd_populate SMP race condition (Andrea Arcangeli)     [Bugdb: 13966] (CVE-2012-2373)

  - KVM: lock slots_lock around device assignment (Alex     Williamson) [Bugdb: 13966] (CVE-2012-2121)

  - KVM: unmap pages from the iommu when slots are removed     (Maxim Uvarov) [Bugdb: 13966] (CVE-2012-2121)

  - fcaps: clear the same personality flags as suid when     fcaps are used (Eric Paris) [Bugdb: 13966]     (CVE-2012-2123)

  - tilegx: enable SYSCALL_WRAPPERS support (Chris Metcalf)     (CVE-2009-0029)

  - drm/i915: fix integer overflow in i915_gem_do_execbuffer     (Xi Wang) [Orabug: 14107456] (CVE-2012-2384)

  - drm/i915: fix integer overflow in i915_gem_execbuffer2     (Xi Wang) [Orabug: 14107445] (CVE-2012-2383)

  - [dm] do not forward ioctls from logical volumes to the     underlying device (Joe Jin) (CVE-2011-4127)

  - [block] fail SCSI passthrough ioctls on partition     devices (Joe Jin) (CVE-2011-4127)

  - [block] add and use scsi_blk_cmd_ioctl (Joe Jin)     [Orabug: 14056755] (CVE-2011-4127)

  - KVM: Ensure all vcpus are consistent with in-kernel     irqchip settings (Avi Kivity) [Bugdb: 13871]     (CVE-2012-1601)

  - regset: Return -EFAULT, not -EIO, on host-side memory     fault (H. Peter Anvin) (CVE-2012-1097)

  - regset: Prevent null pointer reference on readonly     regsets (H. Peter Anvin) (CVE-2012-1097)

  - cifs: fix dentry refcount leak when opening a FIFO on     lookup (Jeff Layton) (CVE-2012-1090)

  - mm: thp: fix pmd_bad triggering in code paths holding     mmap_sem read mode (Andrea Arcangeli) (CVE-2012-1179)

  - ext4: fix undefined behavior in ext4_fill_flex_info (Xi     Wang) (CVE-2009-4307)

  - ocfs2: clear unaligned io flag when dio fails (Junxiao     Bi) [Orabug: 14063941]

  - aio: make kiocb->private NUll in init_sync_kiocb     (Junxiao Bi) [Orabug: 14063941]

  - igb: Fix for Alt MAC Address feature on 82580 and later     devices (Carolyn Wyborny) [Orabug: 14258706]

  - igb: Alternate MAC Address Updates for Func2&3 (Akeem G.
    Abodunrin) [Orabug: 14258706]

  - igb: Alternate MAC Address EEPROM Updates (Akeem G.
    Abodunrin) [Orabug: 14258706]

  - cciss: only enable cciss_allow_hpsa when for ol5 (Joe     Jin) [Orabug: 14106006]

  - Revert 'cciss: remove controllers supported by hpsa'     (Joe Jin) [Orabug: 14106006]

  - [scsi] hpsa: add all support devices for ol5 (Joe Jin)     [Orabug: 14106006]

  - Disable VLAN 0 tagging for none VLAN traffic (Adnan     Misherfi) [Orabug: 14406424]

  - x86: Add Xen kexec control code size check to linker     script (Daniel Kiper)

  - drivers/xen: Export vmcoreinfo through sysfs (Daniel     Kiper)

  - x86/xen/enlighten: Add init and crash kexec/kdump hooks     (Maxim Uvarov)

  - x86/xen: Add kexec/kdump makefile rules (Daniel Kiper)

  - x86/xen: Add x86_64 kexec/kdump implementation (Daniel     Kiper)

  - x86/xen: Add placeholder for i386 kexec/kdump     implementation (Daniel Kiper)

  - x86/xen: Register resources required by kexec-tools     (Daniel Kiper)

  - x86/xen: Introduce architecture dependent data for     kexec/kdump (Daniel Kiper)

  - xen: Introduce architecture independent data for     kexec/kdump (Daniel Kiper)

  - x86/kexec: Add extra pointers to transition page table     PGD, PUD, PMD and PTE (Daniel Kiper)

  - kexec: introduce kexec_ops struct (Daniel Kiper)

  - SPEC: replace DEFAULTKERNEL from kernel-ovs to     kernel-uek

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.4 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a race condition was found in the mac80211 implementation, a framework used for writing drivers for wireless devices. An attacker could trigger this flaw by sending a Delete Block ACK (DELBA) packet to a target system, resulting in a remote denial of service. Note:
This issue only affected users on 802.11n networks, and that also use the iwlagn driver with Intel wireless hardware. (CVE-2009-4027, Important)

* a use-after-free flaw was found in the tcp_rcv_state_process() function in the Linux kernel TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic (denial of service). (CVE-2010-1188, Important)

* a flaw was found in the gfs2_lock() implementation. The GFS2 locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS2 file system mounted could use this flaw to cause a kernel panic (denial of service). (CVE-2010-0727, Moderate)

* a divide-by-zero flaw was found in the ext4 file system code. A local attacker could use this flaw to cause a denial of service by mounting a specially crafted ext4 file system. (CVE-2009-4307, Low)

Bug fixes :

* if a program that calls posix_fadvise() were compiled on x86, and then run on a 64-bit system, that program could experience various problems, including performance issues and the call to posix_fadvise() failing, causing the program to not run as expected or even abort.
With this update, when such programs attempt to call posix_fadvise() on 64-bit systems, sys32_fadvise64() is called instead, which resolves this issue. This update also fixes other 32-bit system calls that were mistakenly called on 64-bit systems (including systems running the kernel-xen kernel). (BZ#569597)

* on some systems able to set a P-State limit via the BIOS, it was not possible to set the limit to a higher frequency if the system was rebooted while a low limit was set:
'/sys/devices/system/cpu/cpu[x]/cpufreq/scaling_max_freq' would retain the low limit in these situations. With this update, limits are correctly set, even after being changed after a system reboot.
(BZ#569727)

* certain Intel ICH hardware (using the e1000e driver) has an NFS filtering capability that did not work as expected, causing memory corruption, which could lead to kernel panics, or other unexpected behavior. In a reported case, a panic occurred when running NFS connection tests. This update resolves this issue by disabling the filtering capability. (BZ#569797)

* if 'open(/proc/[PID]/[xxxx])' was called at the same time the process was exiting, the call would fail with an EINVAL error (an incorrect error for this situation). With this update, the correct error, ENOENT, is returned in this situation. (BZ#571362)

* multiqueue is used for transmitting data, but a single queue transmit ON/OFF scheme was used. This led to a race condition on systems with the bnx2x driver in situations where one queue became full, but not stopped, and the other queue enabled transmission. With this update, only a single queue is used. (BZ#576951)

* the '/proc/sys/vm/mmap_min_addr' tunable helps prevent unprivileged users from creating new memory mappings below the minimum address. The sysctl value for mmap_min_addr could be changed by a process or user that has an effective user ID (euid) of 0, even if the process or user does not have the CAP_SYS_RAWIO capability. This update adds a capability check for the CAP_SYS_RAWIO capability before allowing the mmap_min_addr value to be changed. (BZ#577206)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

This update fixes the following security issues :

  - It was found that a previous update did not correctly     fix the CVE-2011-4131 issue. A malicious Network File     System version 4 (NFSv4) server could return a crafted     reply to a GETACL request, causing a denial of service     on the client. (CVE-2012-2375, Moderate)

  - A divide-by-zero flaw was found in the TCP Illinois     congestion control algorithm implementation in the Linux     kernel. If the TCP Illinois congestion control algorithm     were in use (the sysctl net.ipv4.tcp_congestion_control     variable set to 'illinois'), a local, unprivileged user     could trigger this flaw and cause a denial of service.
    (CVE-2012-4565, Moderate)

  - A NULL pointer dereference flaw was found in the way a     new node's hot added memory was propagated to other     nodes' zonelists. By utilizing this newly added memory     from one of the remaining nodes, a local, unprivileged     user could use this flaw to cause a denial of service.
    (CVE-2012-5517, Moderate)

  - It was found that the initial release of Scientific     Linux 6 did not correctly fix the CVE-2009-4307 issue, a     divide-by-zero flaw in the ext4 file system code. A     local, unprivileged user with the ability to mount an     ext4 file system could use this flaw to cause a denial     of service. (CVE-2012-2100, Low)

  - A flaw was found in the way the Linux kernel's IPv6     implementation handled overlapping, fragmented IPv6     packets. A remote attacker could potentially use this     flaw to bypass protection mechanisms (such as a firewall     or intrusion detection system (IDS)) when sending     network packets to a target system. (CVE-2012-4444, Low)

The system must be rebooted for this update to take effect.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

  - It was found that a previous update did not correctly     fix the CVE-2009-4307 issue, a divide-by-zero flaw in     the ext4 file system code. A local, unprivileged user     with the ability to mount an ext4 file system could use     this flaw to cause a denial of service. (CVE-2012-2100,     Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4307     Nageswara R Sastry reported an issue in the ext4     filesystem. Local users with the privileges to mount a     filesystem can cause a denial of service (BUG) by     providing a s_log_groups_per_flex value greater than 31.

  - CVE-2011-1833     Vasiliy Kulikov of Openwall and Dan Rosenberg discovered     an information leak in the eCryptfs filesystem. Local     users were able to mount arbitrary directories.

  - CVE-2011-4347     Sasha Levin reported an issue in the device assignment     functionality in KVM. Local users with permission to     access /dev/kvm could assign unused pci devices to a     guest and cause a denial of service (crash).

  - CVE-2012-0045     Stephan Barwolf reported an issue in KVM. Local users in     a 32-bit guest running on a 64-bit system can crash the     guest with a syscall instruction.

  - CVE-2012-1090     CAI Qian reported an issue in the CIFS filesystem. A     reference count leak can occur during the lookup of     special files, resulting in a denial of service (oops)     on umount.

  - CVE-2012-1097     H. Peter Anvin reported an issue in the regset     infrastructure. Local users can cause a denial of     service (NULL pointer dereference) by triggering the     write methods of readonly regsets.

Indications Everyone using the Linux Kernel on s390x architecture should update.

Contraindications None.

Problem description

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.42 fixing various bugs and security issues.

The following security issues were fixed :

  - A underflow in the e1000 jumbo ethernet frame handling     could be use by link-local remote attackers to crash the     machine or potentially execute code in kernel context.
    This requires the attacker to be able to send Jumbo     Frames to the target machine. (CVE-2009-4536)

  - A underflow in the e1000e jumbo ethernet frame handling     could be use by link-local remote attackers to crash the     machine or potentially execute code in kernel context.
    This requires the attacker to be able to send Jumbo     Frames to the target machine. (CVE-2009-4538)

  - drivers/firewire/ohci.c in the Linux kernel, when     packet-per-buffer mode is used, allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unknown other impact via     an unspecified ioctl associated with receiving an ISO     packet that contains zero in the payload-length field.
    (CVE-2009-4138)

  - The ext4_fill_flex_info function in fs/ext4/super.c in     the Linux kernel allows user-assisted remote attackers     to cause a denial of service (divide-by-zero error and     panic) via a malformed ext4 filesystem containing a     super block with a large FLEX_BG group size (aka     s_log_groups_per_flex value). (CVE-2009-4307)

  - The ext4_decode_error function in fs/ext4/super.c in the     ext4 filesystem in the Linux kernel before 2.6.32 allows     user-assisted remote attackers to cause a denial of     service (NULL pointer dereference), and possibly have     unspecified other impact, via a crafted read-only     filesystem that lacks a journal. (CVE-2009-4308)

  - The poll_mode_io file for the megaraid_sas driver in the     Linux kernel has world-writable permissions, which     allows local users to change the I/O mode of the driver     by modifying this file. (CVE-2009-3939)

  - The collect_rx_frame function in     drivers/isdn/hisax/hfc_usb.c in the Linux kernel allows     attackers to have an unspecified impact via a crafted     HDLC packet that arrives over ISDN and triggers a buffer     under-read. (CVE-2009-4005)

  - A negative offset in a ioctl in the GDTH RAID driver was     fixed. (CVE-2009-3080)

  - Stack-based buffer overflow in the hfs subsystem in the     Linux kernel allows remote attackers to have an     unspecified impact via a crafted Hierarchical File     System (HFS) filesystem, related to the hfs_readdir     function in fs/hfs/dir.c. (CVE-2009-4020)

For a complete list of changes, please look at the RPM changelog.

Solution

Please install the updates provided at the location noted below.

Installation notes

This update is provided as a set of RPM packages that can easily be installed onto a running system by using the YaST online update module.

Updated kernel packages that fix three security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the fifth regular update.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a race condition was found in the mac80211 implementation, a framework used for writing drivers for wireless devices. An attacker could trigger this flaw by sending a Delete Block ACK (DELBA) packet to a target system, resulting in a remote denial of service. Note:
This issue only affected users on 802.11n networks, and that also use the iwlagn driver with Intel wireless hardware. (CVE-2009-4027, Important)

* a flaw was found in the gfs2_lock() implementation. The GFS2 locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS2 file system mounted could use this flaw to cause a kernel panic. (CVE-2010-0727, Moderate)

* a divide-by-zero flaw was found in the ext4 file system code. A local attacker could use this flaw to cause a denial of service by mounting a specially crafted ext4 file system. (CVE-2009-4307, Low)

These updated packages also include several hundred bug fixes for and enhancements to the Linux kernel. Space precludes documenting each of these changes in this advisory and users are directed to the Red Hat Enterprise Linux 5.5 Release Notes for information on the most significant of these changes :

http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.5/html/ Release_Notes/

Also, for details concerning every bug fixed in and every enhancement added to the kernel for this release, refer to the kernel chapter in the Red Hat Enterprise Linux 5.5 Technical Notes :

http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.5/html/ Technical_Notes/kernel.html

All Red Hat Enterprise Linux 5 users are advised to install these updated packages, which address these vulnerabilities as well as fixing the bugs and adding the enhancements noted in the Red Hat Enterprise Linux 5.5 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.

Indications Everyone using the Linux Kernel on x86_64 architecture should update.

Contraindications None.

Problem description

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.42 fixing various bugs and security issues.

The following security issues were fixed :

  - A underflow in the e1000 jumbo ethernet frame handling     could be use by link-local remote attackers to crash the     machine or potentially execute code in kernel context.
    This requires the attacker to be able to send Jumbo     Frames to the target machine. (CVE-2009-4536)

  - A underflow in the e1000e jumbo ethernet frame handling     could be use by link-local remote attackers to crash the     machine or potentially execute code in kernel context.
    This requires the attacker to be able to send Jumbo     Frames to the target machine. (CVE-2009-4538)

  - drivers/firewire/ohci.c in the Linux kernel, when     packet-per-buffer mode is used, allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unknown other impact via     an unspecified ioctl associated with receiving an ISO     packet that contains zero in the payload-length field.
    (CVE-2009-4138)

  - The ext4_fill_flex_info function in fs/ext4/super.c in     the Linux kernel allows user-assisted remote attackers     to cause a denial of service (divide-by-zero error and     panic) via a malformed ext4 filesystem containing a     super block with a large FLEX_BG group size (aka     s_log_groups_per_flex value). (CVE-2009-4307)

  - The ext4_decode_error function in fs/ext4/super.c in the     ext4 filesystem in the Linux kernel before 2.6.32 allows     user-assisted remote attackers to cause a denial of     service (NULL pointer dereference), and possibly have     unspecified other impact, via a crafted read-only     filesystem that lacks a journal. (CVE-2009-4308)

  - The poll_mode_io file for the megaraid_sas driver in the     Linux kernel has world-writable permissions, which     allows local users to change the I/O mode of the driver     by modifying this file. (CVE-2009-3939)

  - The collect_rx_frame function in     drivers/isdn/hisax/hfc_usb.c in the Linux kernel allows     attackers to have an unspecified impact via a crafted     HDLC packet that arrives over ISDN and triggers a buffer     under-read. (CVE-2009-4005)

  - A negative offset in a ioctl in the GDTH RAID driver was     fixed. (CVE-2009-3080)

  - Stack-based buffer overflow in the hfs subsystem in the     Linux kernel allows remote attackers to have an     unspecified impact via a crafted Hierarchical File     System (HFS) filesystem, related to the hfs_readdir     function in fs/hfs/dir.c. (CVE-2009-4020)

For a complete list of changes, please look at the RPM changelog.

Solution

Please install the updates provided at the location noted below.

Installation notes

This update is provided as a set of RPM packages that can easily be installed onto a running system by using the YaST online update module.

The openSUSE 11.1 Kernel was updated to 2.6.27.42 fixing various bugs and security issues.

Following security issues were fixed: CVE-2009-4536: A underflow in the e1000 jumbo ethernet frame handling could be use by link-local remote attackers to crash the machine or potentially execute code in kernel context. This requires the attacker to be able to send Jumbo Frames to the target machine.

CVE-2009-4538: A underflow in the e1000e jumbo ethernet frame handling could be use by link-local remote attackers to crash the machine or potentially execute code in kernel context. This requires the attacker to be able to send Jumbo Frames to the target machine.

CVE-2009-4138: drivers/firewire/ohci.c in the Linux kernel, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl associated with receiving an ISO packet that contains zero in the payload-length field.

CVE-2009-4307: The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).

CVE-2009-4308: The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.

CVE-2009-3939: The poll_mode_io file for the megaraid_sas driver in the Linux kernel has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

CVE-2009-4005: The collect_rx_frame function in drivers/isdn/hisax/hfc_usb.c in the Linux kernel allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.

CVE-2009-3080: A negative offset in a ioctl in the GDTH RAID driver was fixed.

CVE-2009-4020: Stack-based buffer overflow in the hfs subsystem in the Linux kernel allows remote attackers to have an unspecified impact via a crafted Hierarchical File System (HFS) filesystem, related to the hfs_readdir function in fs/hfs/dir.c.

For a complete list of changes, please look at the RPM changelog.

The Linux kernel for openSUSE 11.2 was updated to 2.6.31.8 to fix the following bugs and security issues :

  - A file overwrite issue on the ext4 filesystem could be     used by local attackers that have write access to a     filesystem to change/overwrite files of other users,     including root. (CVE-2009-4131)

  - A remote denial of service by sending overly long     packets could be used by remote attackers to crash a     machine. (CVE-2009-1298)

  - The mac80211 subsystem in the Linux kernel allows remote     attackers to cause a denial of service (panic) via a     crafted Delete Block ACK (aka DELBA) packet, related to     an erroneous 'code shuffling patch.' (CVE-2009-4026)

  - Race condition in the mac80211 subsystem in the Linux     kernel allows remote attackers to cause a denial of     service (system crash) via a Delete Block ACK (aka     DELBA) packet that triggers a certain state change in     the absence of an aggregation session. (CVE-2009-4027)

  - The poll_mode_io file for the megaraid_sas driver in     the Linux kernel has world-writable permissions, which     allows local users to change the I/O mode of the driver     by modifying this file. (CVE-2009-3939)

  - The collect_rx_frame function in     drivers/isdn/hisax/hfc_usb.c in the Linux kernel allows     attackers to have an unspecified impact via a crafted     HDLC packet that arrives over ISDN and triggers a buffer     under-read. This requires the attacker to access the     machine on ISDN protocol level. (CVE-2009-4005)

  - Array index error in the gdth_read_event function in     drivers/scsi/gdth.c in the Linux kernel allows local     users to cause a denial of service or possibly gain     privileges via a negative event index in an IOCTL     request. (CVE-2009-3080)

  - The get_instantiation_keyring function in     security/keys/keyctl.c in the KEYS subsystem in the     Linux kernel does not properly maintain the reference     count of a keyring, which allows local users to gain     privileges or cause a denial of service (OOPS) via     vectors involving calls to this function without     specifying a keyring by ID, as demonstrated by a series     of keyctl request2 and keyctl list commands.
    (CVE-2009-3624)

  - The fuse_direct_io function in fs/fuse/file.c in the     fuse subsystem in the Linux kernel might allow attackers     to cause a denial of service (invalid pointer     dereference and OOPS) via vectors possibly related to a     memory-consumption attack. (CVE-2009-4021)

  - Multiple race conditions in fs/pipe.c in the Linux     kernel allow local users to cause a denial of service     (NULL pointer dereference and system crash) or gain     privileges by attempting to open an anonymous pipe via a     /proc/*/fd/ pathname. As openSUSE 11.2 by default sets     mmap_min_addr protection, this issue will just Oops the     kernel and not be able to execute code. (CVE-2009-3547)

  - net/unix/af_unix.c in the Linux kernel allows local     users to cause a denial of service (system hang) by     creating an abstract-namespace AF_UNIX listening socket,     performing a shutdown operation on this socket, and then     performing a series of connect operations to this     socket. (CVE-2009-3621)

  - drivers/firewire/ohci.c in the Linux kernel when     packet-per-buffer mode is used, allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unknown other impact via     an unspecified ioctl associated with receiving an ISO     packet that contains zero in the payload-length field.
    (CVE-2009-4138)

  - The ext4_decode_error function in fs/ext4/super.c in     the ext4 filesystem in the Linux kernel allows     user-assisted remote attackers to cause a denial of     service (NULL pointer dereference), and possibly have     unspecified other impact, via a crafted read-only     filesystem that lacks a journal. (CVE-2009-4308)

  - The ext4_fill_flex_info function in fs/ext4/super.c in     the Linux kernel allows user-assisted remote attackers     to cause a denial of service (divide-by-zero error and     panic) via a malformed ext4 filesystem containing a     super block with a large FLEX_BG group size (aka     s_log_groups_per_flex value). (CVE-2009-4307)

  - Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka     move extents) ioctl implementation in the ext4     filesystem in the Linux kernel allows local users to     cause a denial of service (filesystem corruption) via     unknown vectors, a different vulnerability than     CVE-2009-4131. (CVE-2009-4306)

  - The EXT4_IOC_MOVE_EXT (aka move extents) ioctl     implementation in the ext4 filesystem in the Linux     kernel allows local users to overwrite arbitrary files     via a crafted request, related to insufficient checks     for file permissions. This can lead to privilege     escalations. (CVE-2009-4131)

  - The rt2870 and rt2860 drivers were refreshed to the     level they are in the Linux 2.6.32 kernel, bringing new     device support and new functionality.

ID	Name	Product	Family	Severity
180620	Oracle Linux 5 : Oracle / Enterprise / Linux / 5.5 / kernel (ELSA-2010-0178)	Nessus	Oracle Linux Local Security Checks	medium
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
79484	OracleVM 3.1 : kernel-uek (OVMSA-2012-0042)	Nessus	OracleVM Local Security Checks	high
63932	RHEL 5 : kernel (RHSA-2010:0380)	Nessus	Red Hat Local Security Checks	high
63313	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20121218)	Nessus	Scientific Linux Local Security Checks	high
62924	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20121113)	Nessus	Scientific Linux Local Security Checks	high
58486	Debian DSA-2443-1 : linux-2.6 - privilege escalation/denial of service	Nessus	Debian Local Security Checks	high
52685	SuSE 11 Security Update : Linux kernel (SAT Patch Number 1753)	Nessus	SuSE Local Security Checks	critical
46282	RHEL 5 : kernel (RHSA-2010:0178)	Nessus	Red Hat Local Security Checks	high
44037	SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 1754 / 1760)	Nessus	SuSE Local Security Checks	critical
44034	openSUSE Security Update : kernel (kernel-1749)	Nessus	SuSE Local Security Checks	critical
43631	SuSE 11.2 Security Update: kernel (2009-12-18)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-4307

high

Tenable Plugins

medium

high

high

high

high

high

high

critical

high

critical

critical

high