Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not properly handled and causes the skb structure to be freed.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0178 advisory.

  - Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote     attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that     triggers a certain state change in the absence of an aggregation session. (CVE-2009-4027)

  - The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-     assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed     ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex     value). (CVE-2009-4307)

  - The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in     the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files     that are setgid without group-execute permission, which allows local users to cause a denial of service     (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this     file's permissions. (CVE-2010-0727)

  - Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when     IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service     (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not     properly handled and causes the skb structure to be freed. (CVE-2010-1188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the Linux Kernel in the     do_anonymous_page() function due to improper separation     of the stack and the heap. An attacker can exploit this     to execute arbitrary code. (CVE-2010-2240)

  - A packet filter bypass exists in the Linux Kernel e1000     driver due to processing trailing payload data as a     complete frame. A remote attacker can exploit this to     bypass packet filters via a large packet with a crafted     payload. (CVE-2009-4536)

  - A use-after-free error exists in the Linux Kernel when     IPV6_RECVPKTINFO is set on a listening socket. A remote     attacker can exploit this, via a SYN packet while the     socket is in a listening (TCP_LISTEN) state, to cause a     kernel panic, resulting in a denial of service     condition. (CVE-2010-1188)

  - An array index error exists in the Linux Kernel in the     gdth_read_event() function. A local attacker can exploit     this, via a negative event index in an IOCTL request, to     cause a denial of service condition. (CVE-2009-3080)

  - A race condition exists in the VMware Host Guest File     System (HGFS) that allows guest operating system users     to gain privileges by mounting a filesystem on top of an     arbitrary directory. (CVE-2011-1787)

  - A flaw exists in the VMware Host Guest File System     (HGFS) that allows a Solaris or FreeBSD guest operating     system user to modify arbitrary guest operating system     files. (CVE-2011-2145)

  - A flaw exists in the VMware Host Guest File System     (HGFS) that allows guest operating system users to     disclose host operating system files and directories.
    (CVE-2011-2146)

  - A flaw exists in the bundled Tom Sawyer GET Extension     Factory that allows a remote attacker to cause a denial     of service condition or the execution of arbitrary code     via a crafted HTML document. (CVE-2011-2217)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

From Red Hat Security Advisory 2010:0394 :

Updated kernel packages that fix multiple security issues, several bugs, and add three enhancements are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* RHSA-2009:1024 introduced a flaw in the ptrace implementation on Itanium systems. ptrace_check_attach() was not called during certain ptrace() requests. Under certain circumstances, a local, unprivileged user could use this flaw to call ptrace() on a process they do not own, giving them control over that process. (CVE-2010-0729, Important)

* a flaw was found in the kernel's Unidirectional Lightweight Encapsulation (ULE) implementation. A remote attacker could send a specially crafted ISO MPEG-2 Transport Stream (TS) frame to a target system, resulting in a denial of service. (CVE-2010-1086, Important)

* a use-after-free flaw was found in tcp_rcv_state_process() in the kernel's TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic. (CVE-2010-1188, Important)

* a divide-by-zero flaw was found in azx_position_ok() in the Intel High Definition Audio driver, snd-hda-intel. A local, unprivileged user could trigger this flaw to cause a denial of service.
(CVE-2010-1085, Moderate)

* an information leak flaw was found in the kernel's USB implementation. Certain USB errors could result in an uninitialized kernel buffer being sent to user-space. An attacker with physical access to a target system could use this flaw to cause an information leak. (CVE-2010-1083, Low)

Red Hat would like to thank Ang Way Chuang for reporting CVE-2010-1086.

Bug fixes :

* a regression prevented the Broadcom BCM5761 network device from working when in the first (top) PCI-E slot of Hewlett-Packard (HP) Z600 systems. Note: The card worked in the 2nd or 3rd PCI-E slot.
(BZ#567205)

* the Xen hypervisor supports 168 GB of RAM for 32-bit guests. The physical address range was set incorrectly, however, causing 32-bit, para-virtualized Red Hat Enterprise Linux 4.8 guests to crash when launched on AMD64 or Intel 64 hosts that have more than 64 GB of RAM.
(BZ#574392)

* RHSA-2009:1024 introduced a regression, causing diskdump to fail on systems with certain adapters using the qla2xxx driver. (BZ#577234)

* a race condition caused TX to stop in a guest using the virtio_net driver. (BZ#580089)

* on some systems, using the 'arp_validate=3' bonding option caused both links to show as 'down' even though the arp_target was responding to ARP requests sent by the bonding driver. (BZ#580842)

* in some circumstances, when a Red Hat Enterprise Linux client connected to a re-booted Windows-based NFS server, server-side filehandle-to-inode mapping changes caused a kernel panic.
'bad_inode_ops' handling was changed to prevent this. Note:
filehandle-to-inode mapping changes may still cause errors, but not panics. (BZ#582908)

* when installing a Red Hat Enterprise Linux 4 guest via PXE, hard-coded fixed-size scatterlists could conflict with host requests, causing the guest's kernel to panic. With this update, dynamically allocated scatterlists are used, resolving this issue. (BZ#582911)

Enhancements :

* kernel support for connlimit. Note: iptables errata update RHBA-2010:0395 is also required for connlimit to work correctly.
(BZ#563223)

* support for the Intel architectural performance monitoring subsystem (arch_perfmon). On supported CPUs, arch_perfmon offers means to mark performance events and options for configuring and counting these events. (BZ#582913)

* kernel support for OProfile sampling of Intel microarchitecture (Nehalem) CPUs. This update alone does not address OProfile support for such CPUs. A future oprofile package update will allow OProfile to work on Intel Nehalem CPUs. (BZ#582241)

Users should upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.
The system must be rebooted for this update to take effect.

Updated kernel packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 5.3 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* a use-after-free flaw was found in the tcp_rcv_state_process() function in the Linux kernel TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic (denial of service). (CVE-2010-1188, Important)

This update also fixes the following bugs :

* a memory leak occurred when reading files on an NFS file system that was mounted with the 'noac' option, causing memory to slowly be consumed. Unmounting the file system did not free the memory. With this update, the memory is correctly freed, which resolves this issue.
(BZ#588221)

* the RHSA-2009:0225 update fixed a bug where, in some cases, on systems with the kdump service enabled, pressing Alt+SysRq+C to trigger a crash resulted in a system hang; therefore, the system did not restart and boot the dump-capture kernel as expected; no vmcore file was logged; and the following message was displayed on the console :

BUG: warning at arch/[arch]/kernel/crash.c:[xxx]/nmi_shootdown_cpus() (Not tainted)

The RHSA-2009:0225 update resolved this issue by not calling printk() during a crash. It was later discovered that this fix did not resolve the issue in all cases, since there was one condition where printk() was still being called: at a warning condition inside the mdelay() call.

This update replaces mdelay() calls with udelay(), where such a warning condition does not exist, which fully resolves this issue, allowing Alt+SysRq+C to work as expected. (BZ#588211)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel packages that fix one security issue and add one enhancement are now available for Red Hat Enterprise Linux 4.7 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issue :

* a use-after-free flaw was found in the tcp_rcv_state_process() function in the Linux kernel TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic (denial of service). (CVE-2010-1188, Important)

This update also adds the following enhancement :

* kernel support for the iptables connlimit module. This module can be used to help mitigate some types of denial of service attacks. Note:
This update alone does not address connlimit support. A future iptables package update will allow connlimit to work correctly.
(BZ#563222)

Users should upgrade to these updated packages, which contain backported patches to correct this issue and add this enhancement. The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.4 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a race condition was found in the mac80211 implementation, a framework used for writing drivers for wireless devices. An attacker could trigger this flaw by sending a Delete Block ACK (DELBA) packet to a target system, resulting in a remote denial of service. Note:
This issue only affected users on 802.11n networks, and that also use the iwlagn driver with Intel wireless hardware. (CVE-2009-4027, Important)

* a use-after-free flaw was found in the tcp_rcv_state_process() function in the Linux kernel TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic (denial of service). (CVE-2010-1188, Important)

* a flaw was found in the gfs2_lock() implementation. The GFS2 locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS2 file system mounted could use this flaw to cause a kernel panic (denial of service). (CVE-2010-0727, Moderate)

* a divide-by-zero flaw was found in the ext4 file system code. A local attacker could use this flaw to cause a denial of service by mounting a specially crafted ext4 file system. (CVE-2009-4307, Low)

Bug fixes :

* if a program that calls posix_fadvise() were compiled on x86, and then run on a 64-bit system, that program could experience various problems, including performance issues and the call to posix_fadvise() failing, causing the program to not run as expected or even abort.
With this update, when such programs attempt to call posix_fadvise() on 64-bit systems, sys32_fadvise64() is called instead, which resolves this issue. This update also fixes other 32-bit system calls that were mistakenly called on 64-bit systems (including systems running the kernel-xen kernel). (BZ#569597)

* on some systems able to set a P-State limit via the BIOS, it was not possible to set the limit to a higher frequency if the system was rebooted while a low limit was set:
'/sys/devices/system/cpu/cpu[x]/cpufreq/scaling_max_freq' would retain the low limit in these situations. With this update, limits are correctly set, even after being changed after a system reboot.
(BZ#569727)

* certain Intel ICH hardware (using the e1000e driver) has an NFS filtering capability that did not work as expected, causing memory corruption, which could lead to kernel panics, or other unexpected behavior. In a reported case, a panic occurred when running NFS connection tests. This update resolves this issue by disabling the filtering capability. (BZ#569797)

* if 'open(/proc/[PID]/[xxxx])' was called at the same time the process was exiting, the call would fail with an EINVAL error (an incorrect error for this situation). With this update, the correct error, ENOENT, is returned in this situation. (BZ#571362)

* multiqueue is used for transmitting data, but a single queue transmit ON/OFF scheme was used. This led to a race condition on systems with the bnx2x driver in situations where one queue became full, but not stopped, and the other queue enabled transmission. With this update, only a single queue is used. (BZ#576951)

* the '/proc/sys/vm/mmap_min_addr' tunable helps prevent unprivileged users from creating new memory mappings below the minimum address. The sysctl value for mmap_min_addr could be changed by a process or user that has an effective user ID (euid) of 0, even if the process or user does not have the CAP_SYS_RAWIO capability. This update adds a capability check for the CAP_SYS_RAWIO capability before allowing the mmap_min_addr value to be changed. (BZ#577206)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Security fixes :

  - Kernel update 2.6.9-89.EL introduced a flaw in the     ptrace implementation on Itanium systems.
    ptrace_check_attach() was not called during certain     ptrace() requests. Under certain circumstances, a local,     unprivileged user could use this flaw to call ptrace()     on a process they do not own, giving them control over     that process. (CVE-2010-0729, Important)

  - a flaw was found in the kernel's Unidirectional     Lightweight Encapsulation (ULE) implementation. A remote     attacker could send a specially crafted ISO MPEG-2     Transport Stream (TS) frame to a target system,     resulting in a denial of service. (CVE-2010-1086,     Important)

  - a use-after-free flaw was found in     tcp_rcv_state_process() in the kernel's TCP/IP protocol     suite implementation. If a system using IPv6 had the     IPV6_RECVPKTINFO option set on a listening socket, a     remote attacker could send an IPv6 packet to that     system, causing a kernel panic. (CVE-2010-1188,     Important)

  - a divide-by-zero flaw was found in azx_position_ok() in     the Intel High Definition Audio driver, snd-hda-intel. A     local, unprivileged user could trigger this flaw to     cause a denial of service. (CVE-2010-1085, Moderate)

  - an information leak flaw was found in the kernel's USB     implementation. Certain USB errors could result in an     uninitialized kernel buffer being sent to user-space. An     attacker with physical access to a target system could     use this flaw to cause an information leak.
    (CVE-2010-1083, Low)

Bug fixes :

  - a regression prevented the Broadcom BCM5761 network     device from working when in the first (top) PCI-E slot     of Hewlett-Packard (HP) Z600 systems. Note: The card     worked in the 2nd or 3rd PCI-E slot. (BZ#567205)

  - the Xen hypervisor supports 168 GB of RAM for 32-bit     guests. The physical address range was set incorrectly,     however, causing 32-bit, para-virtualized Scientific     Linux 4.8 guests to crash when launched on AMD64 or     Intel 64 hosts that have more than 64 GB of RAM.
    (BZ#574392)

  - Kernel update 2.6.9-89.EL introduced a regression,     causing diskdump to fail on systems with certain     adapters using the qla2xxx driver. (BZ#577234)

  - a race condition caused TX to stop in a guest using the     virtio_net driver. (BZ#580089)

  - on some systems, using the 'arp_validate=3' bonding     option caused both links to show as 'down' even though     the arp_target was responding to ARP requests sent by     the bonding driver. (BZ#580842)

  - in some circumstances, when a Scientific Linux client     connected to a re-booted Windows-based NFS server,     server-side filehandle-to-inode mapping changes caused a     kernel panic. 'bad_inode_ops' handling was changed to     prevent this. Note: filehandle-to-inode mapping changes     may still cause errors, but not panics. (BZ#582908)

  - when installing a Scientific Linux 4 guest via PXE,     hard-coded fixed-size scatterlists could conflict with     host requests, causing the guest's kernel to panic. With     this update, dynamically allocated scatterlists are     used, resolving this issue. (BZ#582911)

Enhancements :

  - kernel support for connlimit. Note: iptables errata     update RHBA-2010:0395 is also required for connlimit to     work correctly. (BZ#563223)

  - support for the Intel architectural performance     monitoring subsystem (arch_perfmon). On supported CPUs,     arch_perfmon offers means to mark performance events and     options for configuring and counting these events.
    (BZ#582913)

  - kernel support for OProfile sampling of Intel     microarchitecture (Nehalem) CPUs. This update alone does     not address OProfile support for such CPUs. A future     oprofile package update will allow OProfile to work on     Intel Nehalem CPUs. (BZ#582241)

The system must be rebooted for this update to take effect.

a. VMware vmkernel third-party e1000(e) Driver Packet Filter Bypass

    There is an issue in the e1000(e) Linux driver for Intel PRO/1000     adapters that allows a remote attacker to bypass packet filters.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the name CVE-2009-4536 to this issue.

b. ESX third-party update for Service Console kernel

    This update for the console OS kernel package resolves four     security issues.

    1) IPv4 Remote Denial of Service

        An remote attacker can achieve a denial of service via an         issue in the kernel IPv4 code.

        The Common Vulnerabilities and Exposures project            (cve.mitre.org) has assigned the name CVE-2010-1188 to            this issue.

    2) SCSI Driver Denial of Service / Possible Privilege Escalation

        A local attacker can achieve a denial of service and         possibly a privilege escalation via a vulnerability in         the Linux SCSI drivers.

        The Common Vulnerabilities and Exposures project         (cve.mitre.org) has assigned the name CVE-2009-3080 to         this issue.

    3) Kernel Memory Management Arbitrary Code Execution

        A context-dependent attacker can execute arbitrary code         via a vulnerability in a kernel memory handling function.

        The Common Vulnerabilities and Exposures project         (cve.mitre.org) has assigned the name CVE-2010-2240 to         this issue.

    4) e1000 Driver Packet Filter Bypass

        There is an issue in the Service Console e1000 Linux         driver for Intel PRO/1000 adapters that allows a remote         attacker to bypass packet filters.

        The Common Vulnerabilities and Exposures project         (cve.mitre.org) has assigned the name CVE-2009-4536 to         this issue.

c. Multiple vulnerabilities in mount.vmhgfs

    This patch provides a fix for the following three security     issues in the VMware Host Guest File System (HGFS). None of     these issues affect Windows based Guest Operating Systems.

    1) Mount.vmhgfs Information Disclosure

        Information disclosure via a vulnerability that allows an         attacker with access to the Guest to determine if a path         exists in the Host filesystem and whether it is a file or         directory regardless of permissions.

        The Common Vulnerabilities and Exposures project         (cve.mitre.org) has assigned the name CVE-2011-2146 to         this issue.

    2) Mount.vmhgfs Race Condition

        Privilege escalation via a race condition that allows an         attacker with access to the guest to mount on arbitrary         directories in the Guest filesystem and achieve privilege         escalation if they can control the contents of the         mounted directory.

        The Common Vulnerabilities and Exposures project         (cve.mitre.org) has assigned the name CVE-2011-1787 to         this issue.

    3) Mount.vmhgfs Privilege Escalation

        Privilege escalation via a procedural error that allows         an attacker with access to the guest operating system to         gain write access to an arbitrary file in the Guest         filesystem.  This issue only affects Solaris and FreeBSD         Guest Operating Systems.

        The Common Vulnerabilities and Exposures project         (cve.mitre.org) has assigned the name CVE-2011-2145 to         this issue.

    VMware would like to thank Dan Rosenberg for reporting these     issues.

d. VI Client ActiveX vulnerabilities

    VI Client COM objects can be instantiated in Internet Explorer     which may cause memory corruption. An attacker who succeeded in     making the VI Client user visit a malicious Web site could     execute code on the user's system within the security context of     that user.

    VMware would like to thank Elazar Broad and iDefense for     reporting this issue to us.

    The Common Vulnerabilities and Exposures Project (cve.mitre.org)     has assigned the name CVE-2011-2217 to this issue.

    Affected versions.

    The vSphere Client which comes with vSphere 4.0 and vSphere 4.1     is not affected. This is any build of vSphere Client Version     4.0.0 and vSphere Client Version 4.1.0.

    VI Clients bundled with VMware Infrastructure 3 that are not     affected are :
    - VI Client 2.0.2 Build 230598 and higher
    - VI Client 2.5 Build 204931 and higher

    The issue can be remediated by replacing an affected VI Client     with the VI Client bundled with VirtualCenter 2.5 Update 6 or     VirtualCenter 2.5 Update 6a.

This update fixes various security issues and some bugs in the SUSE Linux Enterprise 9 kernel.

The following security issues were fixed :

  - A crafted NFS write request might have caused a buffer     overwrite, potentially causing a kernel crash.
    (CVE-2010-2521)

  - The x86_64 copy_to_user implementation might have leaked     kernel memory depending on specific user buffer setups.
    (CVE-2008-0598)

  - drivers/net/r8169.c in the r8169 driver in the Linux     kernel did not properly check the size of an Ethernet     frame that exceeds the MTU, which allows remote     attackers to (1) cause a denial of service (temporary     network outage) via a packet with a crafted size, in     conjunction with certain packets containing A characters     and certain packets containing E characters; or (2)     cause a denial of service (system crash) via a packet     with a crafted size, in conjunction with certain packets     containing '\0' characters, related to the value of the     status register and erroneous behavior associated with     the RxMaxSize register. NOTE: this vulnerability exists     because of an incorrect fix for CVE-2009-1389.
    (CVE-2009-4537)

  - Use-after-free vulnerability in net/ipv4/tcp_input.c in     the Linux kernel 2.6 when IPV6_RECVPKTINFO is set on a     listening socket, allowed remote attackers to cause a     denial of service (kernel panic) via a SYN packet while     the socket is in a listening (TCP_LISTEN) state, which     is not properly handled causes the skb structure to be     freed. (CVE-2010-1188)

  - The (1) real_lookup and (2) __lookup_hash functions in     fs/namei.c in the vfs implementation in the Linux kernel     did not prevent creation of a child dentry for a deleted     (aka S_DEAD) directory, which allowed local users to     cause a denial of service ('overflow' of the UBIFS     orphan area) via a series of attempted file creations     within deleted directories. (CVE-2008-3275)

  - The nfs_lock function in fs/nfs/file.c in the Linux     kernel did not properly remove POSIX locks on files that     are setgid without group-execute permission, which     allows local users to cause a denial of service (BUG and     system crash) by locking a file on an NFS filesystem and     then changing this files permissions, a related issue to     CVE-2010-0727. (CVE-2007-6733)

  - The do_coredump function in fs/exec.c in Linux kernel     did not change the UID of a core dump file if it exists     before a root process creates a core dump in the same     location, which might have allowed local users to obtain     sensitive information. (CVE-2007-6206)

  - fs/namei.c in the Linux kernel did not always follow NFS     automount 'symlinks,' which allowed attackers to have an     unknown impact, related to LOOKUP_FOLLOW.
    (CVE-2010-1088)

  - Stack-based buffer overflow in the hfs subsystem in the     Linux kernel allowed remote attackers to have an     unspecified impact via a crafted Hierarchical File     System (HFS) filesystem, related to the hfs_readdir     function in fs/hfs/dir.c. (CVE-2009-4020)

  - The processcompl_compat function in     drivers/usb/core/devio.c in Linux kernel did not clear     the transfer buffer before returning to userspace when a     USB command fails, which might have made it easier for     physically proximate attackers to obtain sensitive     information (kernel memory). (CVE-2010-1083)

USN-947-1 fixed vulnerabilities in the Linux kernel. Fixes for CVE-2010-0419 caused failures when using KVM in certain situations.
This update reverts that fix until a better solution can be found.

We apologize for the inconvenience.

It was discovered that the Linux kernel did not correctly handle memory protection of the Virtual Dynamic Shared Object page when running a 32-bit application on a 64-bit kernel. A local attacker could exploit this to cause a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2009-4271)

It was discovered that the r8169 network driver did not correctly check the size of Ethernet frames. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2009-4537)

Wei Yongjun discovered that SCTP did not correctly validate certain chunks. A remote attacker could send specially crafted traffic to monopolize CPU resources, leading to a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2010-0008)

It was discovered that KVM did not correctly limit certain privileged IO accesses on x86. Processes in the guest OS with access to IO regions could gain further privileges within the guest OS. (Did not affect Ubuntu 6.06 LTS.) (CVE-2010-0298, CVE-2010-0306, CVE-2010-0419)

Evgeniy Polyakov discovered that IPv6 did not correctly handle certain TUN packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(Only affected Ubuntu 8.04 LTS.) (CVE-2010-0437)

Sachin Prabhu discovered that GFS2 did not correctly handle certain locks. A local attacker with write access to a GFS2 filesystem could exploit this to crash the system, leading to a denial of service. (CVE-2010-0727)

Jamie Strandboge discovered that network virtio in KVM did not correctly handle certain high-traffic conditions. A remote attacker could exploit this by sending specially crafted traffic to a guest OS, causing the guest to crash, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0741)

Marcus Meissner discovered that the USB subsystem did not correctly handle certain error conditions. A local attacker with access to a USB device could exploit this to read recently used kernel memory, leading to a loss of privacy and potentially root privilege escalation. (CVE-2010-1083)

Neil Brown discovered that the Bluetooth subsystem did not correctly handle large amounts of traffic. A physically proximate remote attacker could exploit this by sending specially crafted traffic that would consume all available system memory, leading to a denial of service. (Ubuntu 6.06 LTS and 10.04 LTS were not affected.) (CVE-2010-1084)

Jody Bruchon discovered that the sound driver for the AMD780V did not correctly handle certain conditions. A local attacker with access to this hardward could exploit the flaw to cause a system crash, leading to a denial of service.
(CVE-2010-1085)

Ang Way Chuang discovered that the DVB driver did not correctly handle certain MPEG2-TS frames. An attacker could exploit this by delivering specially crafted frames to monopolize CPU resources, leading to a denial of service.
(Ubuntu 10.04 LTS was not affected.) (CVE-2010-1086)

Trond Myklebust discovered that NFS did not correctly handle truncation under certain conditions. A local attacker with write access to an NFS share could exploit this to crash the system, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1087)

Al Viro discovered that automount of NFS did not correctly handle symlinks under certain conditions. A local attacker could exploit this to crash the system, leading to a denial of service. (Ubuntu 6.06 LTS and Ubuntu 10.04 LTS were not affected.) (CVE-2010-1088)

Matt McCutchen discovered that ReiserFS did not correctly protect xattr files in the .reiserfs_priv directory. A local attacker could exploit this to gain root privileges or crash the system, leading to a denial of service. (CVE-2010-1146)

Eugene Teo discovered that CIFS did not correctly validate arguments when creating new files. A local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges if mmap_min_addr was not set. (CVE-2010-1148)

Catalin Marinas and Tetsuo Handa discovered that the TTY layer did not correctly release process IDs. A local attacker could exploit this to consume kernel resources, leading to a denial of service. (CVE-2010-1162)

Neil Horman discovered that TIPC did not correctly check its internal state. A local attacker could send specially crafted packets via AF_TIPC that would cause the system to crash, leading to a denial of service. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1187)

Masayuki Nakagawa discovered that IPv6 did not correctly handle certain settings when listening. If a socket were listening with the IPV6_RECVPKTINFO flag, a remote attacker could send specially crafted traffic that would cause the system to crash, leading to a denial of service. (Only Ubuntu 6.06 LTS was affected.) (CVE-2010-1188)

Oleg Nesterov discovered that the Out-Of-Memory handler did not correctly handle certain arrangements of processes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-1488).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Linux kernel did not correctly handle memory protection of the Virtual Dynamic Shared Object page when running a 32-bit application on a 64-bit kernel. A local attacker could exploit this to cause a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2009-4271)

It was discovered that the r8169 network driver did not correctly check the size of Ethernet frames. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2009-4537)

Wei Yongjun discovered that SCTP did not correctly validate certain chunks. A remote attacker could send specially crafted traffic to monopolize CPU resources, leading to a denial of service. (Only affected Ubuntu 6.06 LTS.) (CVE-2010-0008)

It was discovered that KVM did not correctly limit certain privileged IO accesses on x86. Processes in the guest OS with access to IO regions could gain further privileges within the guest OS. (Did not affect Ubuntu 6.06 LTS.) (CVE-2010-0298, CVE-2010-0306, CVE-2010-0419)

Evgeniy Polyakov discovered that IPv6 did not correctly handle certain TUN packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0437)

Sachin Prabhu discovered that GFS2 did not correctly handle certain locks. A local attacker with write access to a GFS2 filesystem could exploit this to crash the system, leading to a denial of service.
(CVE-2010-0727)

Jamie Strandboge discovered that network virtio in KVM did not correctly handle certain high-traffic conditions. A remote attacker could exploit this by sending specially crafted traffic to a guest OS, causing the guest to crash, leading to a denial of service. (Only affected Ubuntu 8.04 LTS.) (CVE-2010-0741)

Marcus Meissner discovered that the USB subsystem did not correctly handle certain error conditions. A local attacker with access to a USB device could exploit this to read recently used kernel memory, leading to a loss of privacy and potentially root privilege escalation.
(CVE-2010-1083)

Neil Brown discovered that the Bluetooth subsystem did not correctly handle large amounts of traffic. A physically proximate remote attacker could exploit this by sending specially crafted traffic that would consume all available system memory, leading to a denial of service. (Ubuntu 6.06 LTS and 10.04 LTS were not affected.) (CVE-2010-1084)

Jody Bruchon discovered that the sound driver for the AMD780V did not correctly handle certain conditions. A local attacker with access to this hardward could exploit the flaw to cause a system crash, leading to a denial of service. (CVE-2010-1085)

Ang Way Chuang discovered that the DVB driver did not correctly handle certain MPEG2-TS frames. An attacker could exploit this by delivering specially crafted frames to monopolize CPU resources, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1086)

Trond Myklebust discovered that NFS did not correctly handle truncation under certain conditions. A local attacker with write access to an NFS share could exploit this to crash the system, leading to a denial of service. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1087)

Al Viro discovered that automount of NFS did not correctly handle symlinks under certain conditions. A local attacker could exploit this to crash the system, leading to a denial of service. (Ubuntu 6.06 LTS and Ubuntu 10.04 LTS were not affected.) (CVE-2010-1088)

Matt McCutchen discovered that ReiserFS did not correctly protect xattr files in the .reiserfs_priv directory. A local attacker could exploit this to gain root privileges or crash the system, leading to a denial of service. (CVE-2010-1146)

Eugene Teo discovered that CIFS did not correctly validate arguments when creating new files. A local attacker could exploit this to crash the system, leading to a denial of service, or possibly gain root privileges if mmap_min_addr was not set. (CVE-2010-1148)

Catalin Marinas and Tetsuo Handa discovered that the TTY layer did not correctly release process IDs. A local attacker could exploit this to consume kernel resources, leading to a denial of service.
(CVE-2010-1162)

Neil Horman discovered that TIPC did not correctly check its internal state. A local attacker could send specially crafted packets via AF_TIPC that would cause the system to crash, leading to a denial of service. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1187)

Masayuki Nakagawa discovered that IPv6 did not correctly handle certain settings when listening. If a socket were listening with the IPV6_RECVPKTINFO flag, a remote attacker could send specially crafted traffic that would cause the system to crash, leading to a denial of service. (Only Ubuntu 6.06 LTS was affected.) (CVE-2010-1188)

Oleg Nesterov discovered that the Out-Of-Memory handler did not correctly handle certain arrangements of processes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-1488).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues, several bugs, and add three enhancements are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* RHSA-2009:1024 introduced a flaw in the ptrace implementation on Itanium systems. ptrace_check_attach() was not called during certain ptrace() requests. Under certain circumstances, a local, unprivileged user could use this flaw to call ptrace() on a process they do not own, giving them control over that process. (CVE-2010-0729, Important)

* a flaw was found in the kernel's Unidirectional Lightweight Encapsulation (ULE) implementation. A remote attacker could send a specially crafted ISO MPEG-2 Transport Stream (TS) frame to a target system, resulting in a denial of service. (CVE-2010-1086, Important)

* a use-after-free flaw was found in tcp_rcv_state_process() in the kernel's TCP/IP protocol suite implementation. If a system using IPv6 had the IPV6_RECVPKTINFO option set on a listening socket, a remote attacker could send an IPv6 packet to that system, causing a kernel panic. (CVE-2010-1188, Important)

* a divide-by-zero flaw was found in azx_position_ok() in the Intel High Definition Audio driver, snd-hda-intel. A local, unprivileged user could trigger this flaw to cause a denial of service.
(CVE-2010-1085, Moderate)

* an information leak flaw was found in the kernel's USB implementation. Certain USB errors could result in an uninitialized kernel buffer being sent to user-space. An attacker with physical access to a target system could use this flaw to cause an information leak. (CVE-2010-1083, Low)

Red Hat would like to thank Ang Way Chuang for reporting CVE-2010-1086.

Bug fixes :

* a regression prevented the Broadcom BCM5761 network device from working when in the first (top) PCI-E slot of Hewlett-Packard (HP) Z600 systems. Note: The card worked in the 2nd or 3rd PCI-E slot.
(BZ#567205)

* the Xen hypervisor supports 168 GB of RAM for 32-bit guests. The physical address range was set incorrectly, however, causing 32-bit, para-virtualized Red Hat Enterprise Linux 4.8 guests to crash when launched on AMD64 or Intel 64 hosts that have more than 64 GB of RAM.
(BZ#574392)

* RHSA-2009:1024 introduced a regression, causing diskdump to fail on systems with certain adapters using the qla2xxx driver. (BZ#577234)

* a race condition caused TX to stop in a guest using the virtio_net driver. (BZ#580089)

* on some systems, using the 'arp_validate=3' bonding option caused both links to show as 'down' even though the arp_target was responding to ARP requests sent by the bonding driver. (BZ#580842)

* in some circumstances, when a Red Hat Enterprise Linux client connected to a re-booted Windows-based NFS server, server-side filehandle-to-inode mapping changes caused a kernel panic.
'bad_inode_ops' handling was changed to prevent this. Note:
filehandle-to-inode mapping changes may still cause errors, but not panics. (BZ#582908)

* when installing a Red Hat Enterprise Linux 4 guest via PXE, hard-coded fixed-size scatterlists could conflict with host requests, causing the guest's kernel to panic. With this update, dynamically allocated scatterlists are used, resolving this issue. (BZ#582911)

Enhancements :

* kernel support for connlimit. Note: iptables errata update RHBA-2010:0395 is also required for connlimit to work correctly.
(BZ#563223)

* support for the Intel architectural performance monitoring subsystem (arch_perfmon). On supported CPUs, arch_perfmon offers means to mark performance events and options for configuring and counting these events. (BZ#582913)

* kernel support for OProfile sampling of Intel microarchitecture (Nehalem) CPUs. This update alone does not address OProfile support for such CPUs. A future oprofile package update will allow OProfile to work on Intel Nehalem CPUs. (BZ#582241)

Users should upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.
The system must be rebooted for this update to take effect.

Updated kernel packages that fix three security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the fifth regular update.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* a race condition was found in the mac80211 implementation, a framework used for writing drivers for wireless devices. An attacker could trigger this flaw by sending a Delete Block ACK (DELBA) packet to a target system, resulting in a remote denial of service. Note:
This issue only affected users on 802.11n networks, and that also use the iwlagn driver with Intel wireless hardware. (CVE-2009-4027, Important)

* a flaw was found in the gfs2_lock() implementation. The GFS2 locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS2 file system mounted could use this flaw to cause a kernel panic. (CVE-2010-0727, Moderate)

* a divide-by-zero flaw was found in the ext4 file system code. A local attacker could use this flaw to cause a denial of service by mounting a specially crafted ext4 file system. (CVE-2009-4307, Low)

These updated packages also include several hundred bug fixes for and enhancements to the Linux kernel. Space precludes documenting each of these changes in this advisory and users are directed to the Red Hat Enterprise Linux 5.5 Release Notes for information on the most significant of these changes :

http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.5/html/ Release_Notes/

Also, for details concerning every bug fixed in and every enhancement added to the kernel for this release, refer to the kernel chapter in the Red Hat Enterprise Linux 5.5 Technical Notes :

http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.5/html/ Technical_Notes/kernel.html

All Red Hat Enterprise Linux 5 users are advised to install these updated packages, which address these vulnerabilities as well as fixing the bugs and adding the enhancements noted in the Red Hat Enterprise Linux 5.5 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2010-0394.

ID	Name	Product	Family	Severity
180620	Oracle Linux 5 : Oracle / Enterprise / Linux / 5.5 / kernel (ELSA-2010-0178)	Nessus	Oracle Linux Local Security Checks	medium
89678	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0009) (remote check)	Nessus	Misc.	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
68036	Oracle Linux 4 : kernel (ELSA-2010-0394)	Nessus	Oracle Linux Local Security Checks	high
63934	RHEL 5 : kernel (RHSA-2010:0439)	Nessus	Red Hat Local Security Checks	high
63933	RHEL 4 : kernel (RHSA-2010:0424)	Nessus	Red Hat Local Security Checks	high
63932	RHEL 5 : kernel (RHSA-2010:0380)	Nessus	Red Hat Local Security Checks	high
60787	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
54968	VMSA-2011-0009 : VMware hosted product updates, ESX patches and VI Client update resolve multiple security issues	Nessus	VMware ESX Local Security Checks	high
48901	SuSE9 Security Update : Linux kernel (YOU Patch Number 12636)	Nessus	SuSE Local Security Checks	critical
46811	Ubuntu 10.04 LTS : linux regression (USN-947-2)	Nessus	Ubuntu Local Security Checks	high
46810	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : linux, linux-source-2.6.15 vulnerabilities (USN-947-1)	Nessus	Ubuntu Local Security Checks	high
46306	RHEL 4 : kernel (RHSA-2010:0394)	Nessus	Red Hat Local Security Checks	high
46282	RHEL 5 : kernel (RHSA-2010:0178)	Nessus	Red Hat Local Security Checks	high
46256	CentOS 4 : kernel (CESA-2010:0394)	Nessus	CentOS Local Security Checks	high
801489	CentOS RHSA-2010-0394 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2010-1188

medium

Tenable Plugins

medium

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high