The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory).

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :

  - Kernel
  - krb5
  - glibc
  - mtp2sas
  - mptsas
  - mptspi

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0723 advisory.

    - [misc] make compat_alloc_user_space() incorporate the access_ok()       (Don Howard) [634463 634464] {CVE-2010-3081}
    - [fs] xfs: fix missing untrusted inode lookup tag (Dave Chinner)       [624366 607032] {CVE-2010-2943}
    - [net] sched: fix some kernel memory leaks (Jiri Pirko) [624904 624638]       {CVE-2010-2942}
    - [usb] fix usbfs information leak (Eugene Teo) [566628 566629] {CVE-2010-1083}
    - [fs] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED (Dave Chinner)       [624366 607032] {CVE-2010-2943}
    - [fs] xfs: validate untrusted inode numbers during lookup (Dave Chinner)       [624366 607032] {CVE-2010-2943}
    - [fs] xfs: always use iget in bulkstat (Dave Chinner) [624366 607032]       {CVE-2010-2943}
    - [xen] fix guest crash on non-EPT machine may crash host (Paolo Bonzini)       [621429 621430] {CVE-2010-2938}
    - [fs] ext4: consolidate in_range definitions (Eric Sandeen) [624331 624332]       {CVE-2010-3015}
    - [mm] accept an abutting stack segment (Jiri Pirko) [607857 607858]       {CVE-2010-2240}
    - [mm] pass correct mm when growing stack (Jiri Pirko) [607857 607858]       {CVE-2010-2240}
    - [mm] fix up some user-visible effects of stack guard page (Jiri Pirko)       [607857 607858] {CVE-2010-2240}
    - [mm] fix page table unmap for stack guard page properly (Jiri Pirko)       [607857 607858] {CVE-2010-2240}
    - [mm] fix missing unmap for stack guard page failure case (Jiri Pirko)       [607857 607858] {CVE-2010-2240}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2010:0394 :

Updated kernel packages that fix multiple security issues, several bugs, and add three enhancements are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* RHSA-2009:1024 introduced a flaw in the ptrace implementation on Itanium systems. ptrace_check_attach() was not called during certain ptrace() requests. Under certain circumstances, a local, unprivileged user could use this flaw to call ptrace() on a process they do not own, giving them control over that process. (CVE-2010-0729, Important)

* a flaw was found in the kernel's Unidirectional Lightweight Encapsulation (ULE) implementation. A remote attacker could send a specially crafted ISO MPEG-2 Transport Stream (TS) frame to a target system, resulting in a denial of service. (CVE-2010-1086, Important)

* a use-after-free flaw was found in tcp_rcv_state_process() in the kernel's TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic. (CVE-2010-1188, Important)

* a divide-by-zero flaw was found in azx_position_ok() in the Intel High Definition Audio driver, snd-hda-intel. A local, unprivileged user could trigger this flaw to cause a denial of service.
(CVE-2010-1085, Moderate)

* an information leak flaw was found in the kernel's USB implementation. Certain USB errors could result in an uninitialized kernel buffer being sent to user-space. An attacker with physical access to a target system could use this flaw to cause an information leak. (CVE-2010-1083, Low)

Red Hat would like to thank Ang Way Chuang for reporting CVE-2010-1086.

Bug fixes :

* a regression prevented the Broadcom BCM5761 network device from working when in the first (top) PCI-E slot of Hewlett-Packard (HP) Z600 systems. Note: The card worked in the 2nd or 3rd PCI-E slot.
(BZ#567205)

* the Xen hypervisor supports 168 GB of RAM for 32-bit guests. The physical address range was set incorrectly, however, causing 32-bit, para-virtualized Red Hat Enterprise Linux 4.8 guests to crash when launched on AMD64 or Intel 64 hosts that have more than 64 GB of RAM.
(BZ#574392)

* RHSA-2009:1024 introduced a regression, causing diskdump to fail on systems with certain adapters using the qla2xxx driver. (BZ#577234)

* a race condition caused TX to stop in a guest using the virtio_net driver. (BZ#580089)

* on some systems, using the 'arp_validate=3' bonding option caused both links to show as 'down' even though the arp_target was responding to ARP requests sent by the bonding driver. (BZ#580842)

* in some circumstances, when a Red Hat Enterprise Linux client connected to a re-booted Windows-based NFS server, server-side filehandle-to-inode mapping changes caused a kernel panic.
'bad_inode_ops' handling was changed to prevent this. Note:
filehandle-to-inode mapping changes may still cause errors, but not panics. (BZ#582908)

* when installing a Red Hat Enterprise Linux 4 guest via PXE, hard-coded fixed-size scatterlists could conflict with host requests, causing the guest's kernel to panic. With this update, dynamically allocated scatterlists are used, resolving this issue. (BZ#582911)

Enhancements :

* kernel support for connlimit. Note: iptables errata update RHBA-2010:0395 is also required for connlimit to work correctly.
(BZ#563223)

* support for the Intel architectural performance monitoring subsystem (arch_perfmon). On supported CPUs, arch_perfmon offers means to mark performance events and options for configuring and counting these events. (BZ#582913)

* kernel support for OProfile sampling of Intel microarchitecture (Nehalem) CPUs. This update alone does not address OProfile support for such CPUs. A future oprofile package update will allow OProfile to work on Intel Nehalem CPUs. (BZ#582241)

Users should upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.
The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A buffer overflow flaw was found in the ecryptfs_uid_hash() function in the Linux kernel eCryptfs implementation. On systems that have the eCryptfs netlink transport (Red Hat Enterprise Linux 5 does) or where the '/dev/ecryptfs' file has world-writable permissions (which it does not, by default, on Red Hat Enterprise Linux 5), a local, unprivileged user could use this flaw to cause a denial of service or possibly escalate their privileges. (CVE-2010-2492, Important)

* A miscalculation of the size of the free space of the initial directory entry in a directory leaf block was found in the Linux kernel Global File System 2 (GFS2) implementation. A local, unprivileged user with write access to a GFS2-mounted file system could perform a rename operation on that file system to trigger a NULL pointer dereference, possibly resulting in a denial of service or privilege escalation. (CVE-2010-2798, Important)

* A flaw was found in the Xen hypervisor implementation when running a system that has an Intel CPU without Extended Page Tables (EPT) support. While attempting to dump information about a crashing fully-virtualized guest, the flaw could cause the hypervisor to crash the host as well. A user with permissions to configure a fully-virtualized guest system could use this flaw to crash the host.
(CVE-2010-2938, Moderate)

* Information leak flaws were found in the Linux kernel's Traffic Control Unit implementation. A local attacker could use these flaws to cause the kernel to leak kernel memory to user-space, possibly leading to the disclosure of sensitive information. (CVE-2010-2942, Moderate)

* A flaw was found in the Linux kernel's XFS file system implementation. The file handle lookup could return an invalid inode as valid. If an XFS file system was mounted via NFS (Network File System), a local attacker could access stale data or overwrite existing data that reused the inodes. (CVE-2010-2943, Moderate)

* An integer overflow flaw was found in the extent range checking code in the Linux kernel's ext4 file system implementation. A local, unprivileged user with write access to an ext4-mounted file system could trigger this flaw by writing to a file at a very large file offset, resulting in a local denial of service. (CVE-2010-3015, Moderate)

* An information leak flaw was found in the Linux kernel's USB implementation. Certain USB errors could result in an uninitialized kernel buffer being sent to user-space. An attacker with physical access to a target system could use this flaw to cause an information leak. (CVE-2010-1083, Low)

Red Hat would like to thank Andre Osterhues for reporting CVE-2010-2492; Grant Diffey of CenITex for reporting CVE-2010-2798;
Toshiyuki Okajima for reporting CVE-2010-3015; and Marcus Meissner for reporting CVE-2010-1083.

This update also fixes several bugs. Documentation for these bug fixes will be available shortly from the Technical Notes document linked to in the References.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Security fixes :

  - Kernel update 2.6.9-89.EL introduced a flaw in the     ptrace implementation on Itanium systems.
    ptrace_check_attach() was not called during certain     ptrace() requests. Under certain circumstances, a local,     unprivileged user could use this flaw to call ptrace()     on a process they do not own, giving them control over     that process. (CVE-2010-0729, Important)

  - a flaw was found in the kernel's Unidirectional     Lightweight Encapsulation (ULE) implementation. A remote     attacker could send a specially crafted ISO MPEG-2     Transport Stream (TS) frame to a target system,     resulting in a denial of service. (CVE-2010-1086,     Important)

  - a use-after-free flaw was found in     tcp_rcv_state_process() in the kernel's TCP/IP protocol     suite implementation. If a system using IPv6 had the     IPV6_RECVPKTINFO option set on a listening socket, a     remote attacker could send an IPv6 packet to that     system, causing a kernel panic. (CVE-2010-1188,     Important)

  - a divide-by-zero flaw was found in azx_position_ok() in     the Intel High Definition Audio driver, snd-hda-intel. A     local, unprivileged user could trigger this flaw to     cause a denial of service. (CVE-2010-1085, Moderate)

  - an information leak flaw was found in the kernel's USB     implementation. Certain USB errors could result in an     uninitialized kernel buffer being sent to user-space. An     attacker with physical access to a target system could     use this flaw to cause an information leak.
    (CVE-2010-1083, Low)

Bug fixes :

  - a regression prevented the Broadcom BCM5761 network     device from working when in the first (top) PCI-E slot     of Hewlett-Packard (HP) Z600 systems. Note: The card     worked in the 2nd or 3rd PCI-E slot. (BZ#567205)

  - the Xen hypervisor supports 168 GB of RAM for 32-bit     guests. The physical address range was set incorrectly,     however, causing 32-bit, para-virtualized Scientific     Linux 4.8 guests to crash when launched on AMD64 or     Intel 64 hosts that have more than 64 GB of RAM.
    (BZ#574392)

  - Kernel update 2.6.9-89.EL introduced a regression,     causing diskdump to fail on systems with certain     adapters using the qla2xxx driver. (BZ#577234)

  - a race condition caused TX to stop in a guest using the     virtio_net driver. (BZ#580089)

  - on some systems, using the 'arp_validate=3' bonding     option caused both links to show as 'down' even though     the arp_target was responding to ARP requests sent by     the bonding driver. (BZ#580842)

  - in some circumstances, when a Scientific Linux client     connected to a re-booted Windows-based NFS server,     server-side filehandle-to-inode mapping changes caused a     kernel panic. 'bad_inode_ops' handling was changed to     prevent this. Note: filehandle-to-inode mapping changes     may still cause errors, but not panics. (BZ#582908)

  - when installing a Scientific Linux 4 guest via PXE,     hard-coded fixed-size scatterlists could conflict with     host requests, causing the guest's kernel to panic. With     this update, dynamically allocated scatterlists are     used, resolving this issue. (BZ#582911)

Enhancements :

  - kernel support for connlimit. Note: iptables errata     update RHBA-2010:0395 is also required for connlimit to     work correctly. (BZ#563223)

  - support for the Intel architectural performance     monitoring subsystem (arch_perfmon). On supported CPUs,     arch_perfmon offers means to mark performance events and     options for configuring and counting these events.
    (BZ#582913)

  - kernel support for OProfile sampling of Intel     microarchitecture (Nehalem) CPUs. This update alone does     not address OProfile support for such CPUs. A future     oprofile package update will allow OProfile to work on     Intel Nehalem CPUs. (BZ#582241)

The system must be rebooted for this update to take effect.

This update fixes a several security issues and various bugs in the SUSE Linux Enterprise 10 SP 2 kernel. The bugs fixed include a serious data corruption regression in NFS.

The following security issues were fixed :

  - drivers/net/r8169.c in the r8169 driver in the Linux     kernel does not properly check the size of an Ethernet     frame that exceeds the MTU, which allows remote     attackers to (1) cause a denial of service (temporary     network outage) via a packet with a crafted size, in     conjunction with certain packets containing A characters     and certain packets containing E characters; or (2)     cause a denial of service (system crash) via a packet     with a crafted size, in conjunction with certain packets     containing '0' characters, related to the value of the     status register and erroneous behavior associated with     the RxMaxSize register. (CVE-2009-4537)

  - The ULE decapsulation functionality in     drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in the     Linux kernel arlier allows attackers to cause a denial     of service (infinite loop) via a crafted MPEG2-TS frame,     related to an invalid Payload Pointer ULE.
    (CVE-2010-1086)

  - fs/namei.c in Linux kernel does not always follow NFS     automount 'symlinks,' which allows attackers to have an     unknown impact, related to LOOKUP_FOLLOW.
    (CVE-2010-1088)

  - Stack-based buffer overflow in the hfs subsystem in the     Linux kernel allows remote attackers to have an     unspecified impact via a crafted Hierarchical File     System (HFS) filesystem, related to the hfs_readdir     function in fs/hfs/dir.c. (CVE-2009-4020)

  - The processcompl_compat function in     drivers/usb/core/devio.c in the Linux kernel does not     clear the transfer buffer before returning to userspace     when a USB command fails, which might make it easier for     physically proximate attackers to obtain sensitive     information (kernel memory). (CVE-2010-1083)

  - drivers/connector/connector.c in the Linux kernel allows     local users to cause a denial of service (memory     consumption and system crash) by sending the kernel many     NETLINK_CONNECTOR messages. (CVE-2010-0410)

a. ESX third-party update for Service Console kernel

   This update takes the console OS kernel package to    kernel-2.6.18-238.9.1 which resolves multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798,    CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015,    CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086,    CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477,    CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865,    CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904,    CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080,    CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158,    CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243,    CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251,    CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346,    CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710,    CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues.

b. ESX third-party update for Service Console krb5 RPMs

   This patch updates the krb5-libs and krb5-workstation RPMs of the    console OS to version 1.6.1-55.el5_6.1, which resolves multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282    to these issues.

c. ESXi and ESX update to third-party component glibc

   The glibc third-party library is updated to resolve multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071,    CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues.

d. ESX update to third-party drivers mptsas, mpt2sas, and mptspi

   The mptsas, mpt2sas, and mptspi drivers are updated which addresses    multiple security issues in the mpt2sas driver.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0723 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A buffer overflow flaw was found in the ecryptfs_uid_hash() function in     the Linux kernel eCryptfs implementation. On systems that have the eCryptfs     netlink transport (Red Hat Enterprise Linux 5 does) or where the     /dev/ecryptfs file has world writable permissions (which it does not, by     default, on Red Hat Enterprise Linux 5), a local, unprivileged user could     use this flaw to cause a denial of service or possibly escalate their     privileges. (CVE-2010-2492, Important)

    * A miscalculation of the size of the free space of the initial directory     entry in a directory leaf block was found in the Linux kernel Global File     System 2 (GFS2) implementation. A local, unprivileged user with write     access to a GFS2-mounted file system could perform a rename operation on     that file system to trigger a NULL pointer dereference, possibly resulting     in a denial of service or privilege escalation. (CVE-2010-2798, Important)

    * A flaw was found in the Xen hypervisor implementation when running a     system that has an Intel CPU without Extended Page Tables (EPT) support.
    While attempting to dump information about a crashing fully-virtualized     guest, the flaw could cause the hypervisor to crash the host as well. A     user with permissions to configure a fully-virtualized guest system could     use this flaw to crash the host. (CVE-2010-2938, Moderate)

    * Information leak flaws were found in the Linux kernel's Traffic Control     Unit implementation. A local attacker could use these flaws to cause the     kernel to leak kernel memory to user-space, possibly leading to the     disclosure of sensitive information. (CVE-2010-2942, Moderate)

    * A flaw was found in the Linux kernel's XFS file system implementation.
    The file handle lookup could return an invalid inode as valid. If an XFS     file system was mounted via NFS (Network File System), a local attacker     could access stale data or overwrite existing data that reused the inodes.
    (CVE-2010-2943, Moderate)

    * An integer overflow flaw was found in the extent range checking code in     the Linux kernel's ext4 file system implementation. A local, unprivileged     user with write access to an ext4-mounted file system could trigger this     flaw by writing to a file at a very large file offset, resulting in a local     denial of service. (CVE-2010-3015, Moderate)

    * An information leak flaw was found in the Linux kernel's USB     implementation. Certain USB errors could result in an uninitialized kernel     buffer being sent to user-space. An attacker with physical access to a     target system could use this flaw to cause an information leak.
    (CVE-2010-1083, Low)

    Red Hat would like to thank Andre Osterhues for reporting CVE-2010-2492;
    Grant Diffey of CenITex for reporting CVE-2010-2798; Toshiyuki Okajima for     reporting CVE-2010-3015; and Marcus Meissner for reporting CVE-2010-1083.

    This update also fixes several bugs. Documentation for these bug fixes will     be available shortly from the Technical Notes document linked to in the     References.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues. The system must be rebooted for this     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes various security issues and some bugs in the SUSE Linux Enterprise 9 kernel.

The following security issues were fixed :

  - A crafted NFS write request might have caused a buffer     overwrite, potentially causing a kernel crash.
    (CVE-2010-2521)

  - The x86_64 copy_to_user implementation might have leaked     kernel memory depending on specific user buffer setups.
    (CVE-2008-0598)

  - drivers/net/r8169.c in the r8169 driver in the Linux     kernel did not properly check the size of an Ethernet     frame that exceeds the MTU, which allows remote     attackers to (1) cause a denial of service (temporary     network outage) via a packet with a crafted size, in     conjunction with certain packets containing A characters     and certain packets containing E characters; or (2)     cause a denial of service (system crash) via a packet     with a crafted size, in conjunction with certain packets     containing '\0' characters, related to the value of the     status register and erroneous behavior associated with     the RxMaxSize register. NOTE: this vulnerability exists     because of an incorrect fix for CVE-2009-1389.
    (CVE-2009-4537)

  - Use-after-free vulnerability in net/ipv4/tcp_input.c in     the Linux kernel 2.6 when IPV6_RECVPKTINFO is set on a     listening socket, allowed remote attackers to cause a     denial of service (kernel panic) via a SYN packet while     the socket is in a listening (TCP_LISTEN) state, which     is not properly handled causes the skb structure to be     freed. (CVE-2010-1188)

  - The (1) real_lookup and (2) __lookup_hash functions in     fs/namei.c in the vfs implementation in the Linux kernel     did not prevent creation of a child dentry for a deleted     (aka S_DEAD) directory, which allowed local users to     cause a denial of service ('overflow' of the UBIFS     orphan area) via a series of attempted file creations     within deleted directories. (CVE-2008-3275)

  - The nfs_lock function in fs/nfs/file.c in the Linux     kernel did not properly remove POSIX locks on files that     are setgid without group-execute permission, which     allows local users to cause a denial of service (BUG and     system crash) by locking a file on an NFS filesystem and     then changing this files permissions, a related issue to     CVE-2010-0727. (CVE-2007-6733)

  - The do_coredump function in fs/exec.c in Linux kernel     did not change the UID of a core dump file if it exists     before a root process creates a core dump in the same     location, which might have allowed local users to obtain     sensitive information. (CVE-2007-6206)

  - fs/namei.c in the Linux kernel did not always follow NFS     automount 'symlinks,' which allowed attackers to have an     unknown impact, related to LOOKUP_FOLLOW.
    (CVE-2010-1088)

  - Stack-based buffer overflow in the hfs subsystem in the     Linux kernel allowed remote attackers to have an     unspecified impact via a crafted Hierarchical File     System (HFS) filesystem, related to the hfs_readdir     function in fs/hfs/dir.c. (CVE-2009-4020)

  - The processcompl_compat function in     drivers/usb/core/devio.c in Linux kernel did not clear     the transfer buffer before returning to userspace when a     USB command fails, which might have made it easier for     physically proximate attackers to obtain sensitive     information (kernel memory). (CVE-2010-1083)

USN-947-1 fixed vulnerabilities in the Linux kernel. Fixes for CVE-2010-0419 caused failures when using KVM in certain situations.
This update reverts that fix until a better solution can be found.

We apologize for the inconvenience.

It was discovered that the Linux kernel did not correctly handle memory protection of the Virtual Dynamic Shared Object page when running a 32-bit application on a 64-bit kernel. A local attacker could exploit this to cause a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2009-4271)

It was discovered that the r8169 network driver did not correctly check the size of Ethernet frames. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2009-4537)

Wei Yongjun discovered that SCTP did not correctly validate certain chunks. A remote attacker could send specially crafted traffic to monopolize CPU resources, leading to a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2010-0008)

It was discovered that KVM did not correctly limit certain privileged IO accesses on x86. Processes in the guest OS with access to IO regions could gain further privileges within the guest OS. (Did not affect Ubuntu 6.06 LTS.) (CVE-2010-0298, CVE-2010-0306, CVE-2010-0419)

Evgeniy Polyakov discovered that IPv6 did not correctly handle certain TUN packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(Only affected Ubuntu 8.04 LTS.) (CVE-2010-0437)

Sachin Prabhu discovered that GFS2 did not correctly handle certain locks. A local attacker with write access to a GFS2 filesystem could exploit this to crash the system, leading to a denial of service. (CVE-2010-0727)

Jamie Strandboge discovered that network virtio in KVM did not correctly handle certain high-traffic conditions. A remote attacker could exploit this by sending specially crafted traffic to a guest OS, causing the guest to crash, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0741)

Marcus Meissner discovered that the USB subsystem did not correctly handle certain error conditions. A local attacker with access to a USB device could exploit this to read recently used kernel memory, leading to a loss of privacy and potentially root privilege escalation. (CVE-2010-1083)

Neil Brown discovered that the Bluetooth subsystem did not correctly handle large amounts of traffic. A physically proximate remote attacker could exploit this by sending specially crafted traffic that would consume all available system memory, leading to a denial of service. (Ubuntu 6.06 LTS and 10.04 LTS were not affected.) (CVE-2010-1084)

Jody Bruchon discovered that the sound driver for the AMD780V did not correctly handle certain conditions. A local attacker with access to this hardward could exploit the flaw to cause a system crash, leading to a denial of service.
(CVE-2010-1085)

Ang Way Chuang discovered that the DVB driver did not correctly handle certain MPEG2-TS frames. An attacker could exploit this by delivering specially crafted frames to monopolize CPU resources, leading to a denial of service.
(Ubuntu 10.04 LTS was not affected.) (CVE-2010-1086)

Trond Myklebust discovered that NFS did not correctly handle truncation under certain conditions. A local attacker with write access to an NFS share could exploit this to crash the system, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1087)

Al Viro discovered that automount of NFS did not correctly handle symlinks under certain conditions. A local attacker could exploit this to crash the system, leading to a denial of service. (Ubuntu 6.06 LTS and Ubuntu 10.04 LTS were not affected.) (CVE-2010-1088)

Matt McCutchen discovered that ReiserFS did not correctly protect xattr files in the .reiserfs_priv directory. A local attacker could exploit this to gain root privileges or crash the system, leading to a denial of service. (CVE-2010-1146)

Eugene Teo discovered that CIFS did not correctly validate arguments when creating new files. A local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges if mmap_min_addr was not set. (CVE-2010-1148)

Catalin Marinas and Tetsuo Handa discovered that the TTY layer did not correctly release process IDs. A local attacker could exploit this to consume kernel resources, leading to a denial of service. (CVE-2010-1162)

Neil Horman discovered that TIPC did not correctly check its internal state. A local attacker could send specially crafted packets via AF_TIPC that would cause the system to crash, leading to a denial of service. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1187)

Masayuki Nakagawa discovered that IPv6 did not correctly handle certain settings when listening. If a socket were listening with the IPV6_RECVPKTINFO flag, a remote attacker could send specially crafted traffic that would cause the system to crash, leading to a denial of service. (Only Ubuntu 6.06 LTS was affected.) (CVE-2010-1188)

Oleg Nesterov discovered that the Out-Of-Memory handler did not correctly handle certain arrangements of processes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-1488).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Linux kernel did not correctly handle memory protection of the Virtual Dynamic Shared Object page when running a 32-bit application on a 64-bit kernel. A local attacker could exploit this to cause a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2009-4271)

It was discovered that the r8169 network driver did not correctly check the size of Ethernet frames. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2009-4537)

Wei Yongjun discovered that SCTP did not correctly validate certain chunks. A remote attacker could send specially crafted traffic to monopolize CPU resources, leading to a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2010-0008)

It was discovered that KVM did not correctly limit certain privileged IO accesses on x86. Processes in the guest OS with access to IO regions could gain further privileges within the guest OS. (Did not affect Ubuntu 6.06 LTS.) (CVE-2010-0298, CVE-2010-0306, CVE-2010-0419)

Evgeniy Polyakov discovered that IPv6 did not correctly handle certain TUN packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0437)

Sachin Prabhu discovered that GFS2 did not correctly handle certain locks. A local attacker with write access to a GFS2 filesystem could exploit this to crash the system, leading to a denial of service.
(CVE-2010-0727)

Jamie Strandboge discovered that network virtio in KVM did not correctly handle certain high-traffic conditions. A remote attacker could exploit this by sending specially crafted traffic to a guest OS, causing the guest to crash, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0741)

Marcus Meissner discovered that the USB subsystem did not correctly handle certain error conditions. A local attacker with access to a USB device could exploit this to read recently used kernel memory, leading to a loss of privacy and potentially root privilege escalation.
(CVE-2010-1083)

Neil Brown discovered that the Bluetooth subsystem did not correctly handle large amounts of traffic. A physically proximate remote attacker could exploit this by sending specially crafted traffic that would consume all available system memory, leading to a denial of service. (Ubuntu 6.06 LTS and 10.04 LTS were not affected.) (CVE-2010-1084)

Jody Bruchon discovered that the sound driver for the AMD780V did not correctly handle certain conditions. A local attacker with access to this hardward could exploit the flaw to cause a system crash, leading to a denial of service. (CVE-2010-1085)

Ang Way Chuang discovered that the DVB driver did not correctly handle certain MPEG2-TS frames. An attacker could exploit this by delivering specially crafted frames to monopolize CPU resources, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1086)

Trond Myklebust discovered that NFS did not correctly handle truncation under certain conditions. A local attacker with write access to an NFS share could exploit this to crash the system, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1087)

Al Viro discovered that automount of NFS did not correctly handle symlinks under certain conditions. A local attacker could exploit this to crash the system, leading to a denial of service. (Ubuntu 6.06 LTS and Ubuntu 10.04 LTS were not affected.) (CVE-2010-1088)

Matt McCutchen discovered that ReiserFS did not correctly protect xattr files in the .reiserfs_priv directory. A local attacker could exploit this to gain root privileges or crash the system, leading to a denial of service. (CVE-2010-1146)

Eugene Teo discovered that CIFS did not correctly validate arguments when creating new files. A local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges if mmap_min_addr was not set. (CVE-2010-1148)

Catalin Marinas and Tetsuo Handa discovered that the TTY layer did not correctly release process IDs. A local attacker could exploit this to consume kernel resources, leading to a denial of service.
(CVE-2010-1162)

Neil Horman discovered that TIPC did not correctly check its internal state. A local attacker could send specially crafted packets via AF_TIPC that would cause the system to crash, leading to a denial of service. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1187)

Masayuki Nakagawa discovered that IPv6 did not correctly handle certain settings when listening. If a socket were listening with the IPV6_RECVPKTINFO flag, a remote attacker could send specially crafted traffic that would cause the system to crash, leading to a denial of service. (Only Ubuntu 6.06 LTS was affected.) (CVE-2010-1188)

Oleg Nesterov discovered that the Out-Of-Memory handler did not correctly handle certain arrangements of processes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-1488).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4537     Fabian Yamaguchi reported a missing check for Ethernet     frames larger than the MTU in the r8169 driver. This may     allow users on the local network to crash a system,     resulting in a denial of service.

  - CVE-2010-0727     Sachin Prabhu reported an issue in the GFS2 filesystem.
    Local users can trigger a BUG() altering the permissions     on a locked file, resulting in a denial of service.

  - CVE-2010-1083     Linus Torvalds reported an issue in the USB subsystem,     which may allow local users to obtain portions of     sensitive kernel memory.

  - CVE-2010-1084     Neil Brown reported an issue in the Bluetooth subsystem     that may permit remote attackers to overwrite memory     through the creation of large numbers of sockets,     resulting in a denial of service.

  - CVE-2010-1086     Ang Way Chuang reported an issue in the DVB subsystem     for Digital TV adapters. By creating a specially-encoded     MPEG2-TS frame, a remote attacker could cause the     receiver to enter an endless loop, resulting in a denial     of service.

  - CVE-2010-1087     Trond Myklebust reported an issue in the NFS filesystem.
    A local user may cause an oops by sending a fatal signal     during a file truncation operation, resulting in a     denial of service.

  - CVE-2010-1088     Al Viro reported an issue where automount symlinks may     not be followed when LOOKUP_FOLLOW is not set. This has     an unknown security impact.

  - CVE-2010-1162     Catalin Marinas reported an issue in the tty subsystem     that allows local attackers to cause a kernel memory     leak, possibly resulting in a denial of service.

  - CVE-2010-1173     Chris Guo from Nokia China and Jukka Taimisto and Olli     Jarva from Codenomicon Ltd reported an issue in the SCTP     subsystem that allows a remote attacker to cause a     denial of service using a malformed init package.

  - CVE-2010-1187     Neil Hormon reported an issue in the TIPC subsystem.
    Local users can cause a denial of service by way of a     NULL pointer dereference by sending datagrams through     AF_TIPC before entering network mode.

  - CVE-2010-1437     Toshiyuki Okajima reported a race condition in the     keyring subsystem. Local users can cause memory     corruption via keyctl commands that access a keyring in     the process of being deleted, resulting in a denial of     service.

  - CVE-2010-1446     Wufei reported an issue with kgdb on the PowerPC     architecture, allowing local users to write to kernel     memory. Note: this issue does not affect binary kernels     provided by Debian. The fix is provided for the benefit     of users who build their own kernels from Debian source.

  - CVE-2010-1451     Brad Spengler reported an issue on the SPARC     architecture that allows local users to execute     non-executable pages.

This update also includes fixes a regression introduced by a previous update. See the referenced Debian bug page for details.

Updated kernel packages that fix multiple security issues, several bugs, and add three enhancements are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* RHSA-2009:1024 introduced a flaw in the ptrace implementation on Itanium systems. ptrace_check_attach() was not called during certain ptrace() requests. Under certain circumstances, a local, unprivileged user could use this flaw to call ptrace() on a process they do not own, giving them control over that process. (CVE-2010-0729, Important)

* a flaw was found in the kernel's Unidirectional Lightweight Encapsulation (ULE) implementation. A remote attacker could send a specially crafted ISO MPEG-2 Transport Stream (TS) frame to a target system, resulting in a denial of service. (CVE-2010-1086, Important)

* a use-after-free flaw was found in tcp_rcv_state_process() in the kernel's TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic. (CVE-2010-1188, Important)

* a divide-by-zero flaw was found in azx_position_ok() in the Intel High Definition Audio driver, snd-hda-intel. A local, unprivileged user could trigger this flaw to cause a denial of service.
(CVE-2010-1085, Moderate)

* an information leak flaw was found in the kernel's USB implementation. Certain USB errors could result in an uninitialized kernel buffer being sent to user-space. An attacker with physical access to a target system could use this flaw to cause an information leak. (CVE-2010-1083, Low)

Red Hat would like to thank Ang Way Chuang for reporting CVE-2010-1086.

Bug fixes :

* a regression prevented the Broadcom BCM5761 network device from working when in the first (top) PCI-E slot of Hewlett-Packard (HP) Z600 systems. Note: The card worked in the 2nd or 3rd PCI-E slot.
(BZ#567205)

* the Xen hypervisor supports 168 GB of RAM for 32-bit guests. The physical address range was set incorrectly, however, causing 32-bit, para-virtualized Red Hat Enterprise Linux 4.8 guests to crash when launched on AMD64 or Intel 64 hosts that have more than 64 GB of RAM.
(BZ#574392)

* RHSA-2009:1024 introduced a regression, causing diskdump to fail on systems with certain adapters using the qla2xxx driver. (BZ#577234)

* a race condition caused TX to stop in a guest using the virtio_net driver. (BZ#580089)

* on some systems, using the 'arp_validate=3' bonding option caused both links to show as 'down' even though the arp_target was responding to ARP requests sent by the bonding driver. (BZ#580842)

* in some circumstances, when a Red Hat Enterprise Linux client connected to a re-booted Windows-based NFS server, server-side filehandle-to-inode mapping changes caused a kernel panic.
'bad_inode_ops' handling was changed to prevent this. Note:
filehandle-to-inode mapping changes may still cause errors, but not panics. (BZ#582908)

* when installing a Red Hat Enterprise Linux 4 guest via PXE, hard-coded fixed-size scatterlists could conflict with host requests, causing the guest's kernel to panic. With this update, dynamically allocated scatterlists are used, resolving this issue. (BZ#582911)

Enhancements :

* kernel support for connlimit. Note: iptables errata update RHBA-2010:0395 is also required for connlimit to work correctly.
(BZ#563223)

* support for the Intel architectural performance monitoring subsystem (arch_perfmon). On supported CPUs, arch_perfmon offers means to mark performance events and options for configuring and counting these events. (BZ#582913)

* kernel support for OProfile sampling of Intel microarchitecture (Nehalem) CPUs. This update alone does not address OProfile support for such CPUs. A future oprofile package update will allow OProfile to work on Intel Nehalem CPUs. (BZ#582241)

Users should upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.
The system must be rebooted for this update to take effect.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2010-0394.

ID	Name	Product	Family	Severity
89680	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)	Nessus	Misc.	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
68106	Oracle Linux 5 : kernel (ELSA-2010-0723)	Nessus	Oracle Linux Local Security Checks	high
68036	Oracle Linux 4 : kernel (ELSA-2010-0394)	Nessus	Oracle Linux Local Security Checks	high
67080	CentOS 5 : kernel (CESA-2010:0723)	Nessus	CentOS Local Security Checks	high
60787	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
59148	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7015)	Nessus	SuSE Local Security Checks	high
56508	VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console	Nessus	VMware ESX Local Security Checks	high
49746	RHEL 5 : kernel (RHSA-2010:0723)	Nessus	Red Hat Local Security Checks	high
48901	SuSE9 Security Update : Linux kernel (YOU Patch Number 12636)	Nessus	SuSE Local Security Checks	critical
46811	Ubuntu 10.04 LTS : linux regression (USN-947-2)	Nessus	Ubuntu Local Security Checks	high
46810	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : linux, linux-source-2.6.15 vulnerabilities (USN-947-1)	Nessus	Ubuntu Local Security Checks	high
46725	Debian DSA-2053-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	high
46306	RHEL 4 : kernel (RHSA-2010:0394)	Nessus	Red Hat Local Security Checks	high
46256	CentOS 4 : kernel (CESA-2010:0394)	Nessus	CentOS Local Security Checks	high
46252	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7011)	Nessus	SuSE Local Security Checks	high
801489	CentOS RHSA-2010-0394 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2010-1083

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high