Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Apache Tomcat 
  - Apache Tomcat Manager
  - cURL 
  - Java Runtime Environment (JRE)
  - Kernel 
  - Microsoft SQL Express
  - OpenSSL
  - pam_krb5

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2013-0039 for details.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0504 advisory.

    - [fs] gfs2: fix permissions checking for setflags ioctl (Steven Whitehouse) [595580 595399]     {CVE-2010-1641}
    - [misc] keys: do not find already freed keyrings (Vitaly Mayatskikh) [585099 585100] {CVE-2010-1437}
    - [misc] futex: handle futex value corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [misc] futex: handle user space corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [misc] futex: fix fault handling in futex_lock_pi (Jerome Marchand) [563093 480396] {CVE-2010-0622}
    - [net] sctp: fix skb_over_panic w/too many unknown params (Neil Horman) [584657 584658] {CVE-2010-1173}
    - [mm] keep get_unmapped_area_prot functional (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] switch do_brk to get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] take arch_mmap_check into get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] get rid of open-coding in ia64_brk (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] unify sys_mmap* functions (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] kill ancient cruft in s390 compat mmap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix pgoff in have to relocate case of mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix the arch checks in MREMAP_FIXED case (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] fix checks for expand-in-place mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] add new vma_expandable helper function (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] move MREMAP_FIXED into its own header (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [mm] move locating vma code and checks on it (Danny Feng) [556709 556710] {CVE-2010-0291}
    - [net] tipc: fix various oopses in uninitialized code (Neil Horman) [578058 558693] {CVE-2010-1187}
    - [fs] vfs: fix LOOKUP_FOLLOW on automount symlinks (Jeff Layton) [567815 567816] {CVE-2010-1088}
    - [nfs] fix an oops when truncating a file (Jeff Layton) [567194 567195] {CVE-2010-1087}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2010:0474 :

Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a NULL pointer dereference flaw was found in the Linux kernel NFSv4 implementation. Several of the NFSv4 file locking functions failed to check whether a file had been opened on the server before performing locking operations on it. A local, unprivileged user on a system with an NFSv4 share mounted could possibly use this flaw to cause a kernel panic (denial of service) or escalate their privileges.
(CVE-2009-3726, Important)

* a flaw was found in the sctp_process_unk_param() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to an SCTP listening port on a target system, causing a kernel panic (denial of service). (CVE-2010-1173, Important)

* a race condition between finding a keyring by name and destroying a freed keyring was found in the Linux kernel key management facility. A local, unprivileged user could use this flaw to cause a kernel panic (denial of service) or escalate their privileges. (CVE-2010-1437, Important)

Red Hat would like to thank Simon Vallet for responsibly reporting CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173.

Bug fixes :

* RHBA-2007:0791 introduced a regression in the Journaling Block Device (JBD). Under certain circumstances, removing a large file (such as 300 MB or more) did not result in inactive memory being freed, leading to the system having a large amount of inactive memory. Now, the memory is correctly freed. (BZ#589155)

* the timer_interrupt() routine did not scale lost real ticks to logical ticks correctly, possibly causing time drift for 64-bit Red Hat Enterprise Linux 4 KVM (Kernel-based Virtual Machine) guests that were booted with the 'divider=x' kernel parameter set to a value greater than 1. 'warning: many lost ticks' messages may have been logged on the affected guest systems. (BZ#590551)

* a bug could have prevented NFSv3 clients from having the most up-to-date file attributes for files on a given NFSv3 file system. In cases where a file type changed, such as if a file was removed and replaced with a directory of the same name, the NFSv3 client may not have noticed this change until stat(2) was called (for example, by running 'ls -l'). (BZ#596372)

* RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X subsystem.
These could have caused a system deadlock on some systems where the BIOS set the default Maximum Memory Read Byte Count (MMRBC) to 4096, and that also use the Intel PRO/1000 Linux driver, e1000. Errors such as 'e1000: eth[x]: e1000_clean_tx_irq: Detected Tx Unit Hang' were logged. (BZ#596374)

* an out of memory condition in a KVM guest, using the virtio-net network driver and also under heavy network stress, could have resulted in that guest being unable to receive network traffic. Users had to manually remove and re-add the virtio_net module and restart the network service before networking worked as expected. Such memory conditions no longer prevent KVM guests receiving network traffic.
(BZ#597310)

* when an SFQ qdisc that limited the queue size to two packets was added to a network interface, sending traffic through that interface resulted in a kernel crash. Such a qdisc no longer results in a kernel crash. (BZ#597312)

* when an NFS client opened a file with the O_TRUNC flag set, it received a valid stateid, but did not use that stateid to perform the SETATTR call. Such cases were rejected by Red Hat Enterprise Linux 4 NFS servers with an 'NFS4ERR_BAD_STATEID' error, possibly preventing some NFS clients from writing files to an NFS file system. (BZ#597314)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

This update fixes the following security issues :

  - multiple flaws were found in the mmap and mremap     implementations. A local user could use these flaws to     cause a local denial of service or escalate their     privileges. (CVE-2010-0291, Important)

  - a NULL pointer dereference flaw was found in the Fast     Userspace Mutexes (futexes) implementation. The unlock     code path did not check if the futex value associated     with pi_state->owner had been modified. A local user     could use this flaw to modify the futex value, possibly     leading to a denial of service or privilege escalation     when the pi_state->owner pointer is dereferenced.
    (CVE-2010-0622, Important)

  - a NULL pointer dereference flaw was found in the Linux     kernel Network File System (NFS) implementation. A local     user on a system that has an NFS-mounted file system     could use this flaw to cause a denial of service or     escalate their privileges on that system.
    (CVE-2010-1087, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a flaw was found in the Linux kernel Transparent     Inter-Process Communication protocol (TIPC)     implementation. If a client application, on a local     system where the tipc module is not yet in network mode,     attempted to send a message to a remote TIPC node, it     would dereference a NULL pointer on the local system,     causing a kernel panic (denial of service).
    (CVE-2010-1187, Important)

  - a buffer overflow flaw was found in the Linux kernel     Global File System 2 (GFS2) implementation. In certain     cases, a quota could be written past the end of a memory     page, causing memory corruption, leaving the quota     stored on disk in an invalid state. A user with write     access to a GFS2 file system could trigger this flaw to     cause a kernel crash (denial of service) or escalate     their privileges on the GFS2 server. This issue can only     be triggered if the GFS2 file system is mounted with the     'quota=on' or 'quota=account' mount option.
    (CVE-2010-1436, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local user could use this     flaw to cause a kernel panic (denial of service) or     escalate their privileges. (CVE-2010-1437, Important)

  - a flaw was found in the link_path_walk() function in the     Linux kernel. Using the file descriptor returned by the     open() function with the O_NOFOLLOW flag on a     subordinate NFS-mounted file system, could result in a     NULL pointer dereference, causing a denial of service or     privilege escalation. (CVE-2010-1088, Moderate)

  - a missing permission check was found in the     gfs2_set_flags() function in the Linux kernel GFS2     implementation. A local user could use this flaw to     change certain file attributes of files, on a GFS2 file     system, that they do not own. (CVE-2010-1641, Low)

Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting CVE-2010-1641.

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

Security fixes :

  - a NULL pointer dereference flaw was found in the Linux     kernel NFSv4 implementation. Several of the NFSv4 file     locking functions failed to check whether a file had     been opened on the server before performing locking     operations on it. A local, unprivileged user on a system     with an NFSv4 share mounted could possibly use this flaw     to cause a kernel panic (denial of service) or escalate     their privileges. (CVE-2009-3726, Important)

  - a flaw was found in the sctp_process_unk_param()     function in the Linux kernel Stream Control Transmission     Protocol (SCTP) implementation. A remote attacker could     send a specially crafted SCTP packet to an SCTP     listening port on a target system, causing a kernel     panic (denial of service). (CVE-2010-1173, Important)

  - a race condition between finding a keyring by name and     destroying a freed keyring was found in the Linux kernel     key management facility. A local, unprivileged user     could use this flaw to cause a kernel panic (denial of     service) or escalate their privileges. (CVE-2010-1437,     Important)

Red Hat would like to thank Simon Vallet for responsibly reporting CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173.

Bug fixes :

  - RHBA-2007:0791 introduced a regression in the Journaling     Block Device (JBD). Under certain circumstances,     removing a large file (such as 300 MB or more) did not     result in inactive memory being freed, leading to the     system having a large amount of inactive memory. Now,     the memory is correctly freed. (BZ#589155)

  - the timer_interrupt() routine did not scale lost real     ticks to logical ticks correctly, possibly causing time     drift for 64-bit Scientific Linux 4 KVM (Kernel-based     Virtual Machine) guests that were booted with the     'divider=x' kernel parameter set to a value greater than     1. 'warning: many lost ticks' messages may have been     logged on the affected guest systems. (BZ#590551)

  - a bug could have prevented NFSv3 clients from having the     most up-to-date file attributes for files on a given     NFSv3 file system. In cases where a file type changed,     such as if a file was removed and replaced with a     directory of the same name, the NFSv3 client may not     have noticed this change until stat(2) was called (for     example, by running 'ls -l'). (BZ#596372)

  - RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X     subsystem. These could have caused a system deadlock on     some systems where the BIOS set the default Maximum     Memory Read Byte Count (MMRBC) to 4096, and that also     use the Intel PRO/1000 Linux driver, e1000. Errors such     as 'e1000: eth[x]: e1000_clean_tx_irq: Detected Tx Unit     Hang' were logged. (BZ#596374)

  - an out of memory condition in a KVM guest, using the     virtio-net network driver and also under heavy network     stress, could have resulted in that guest being unable     to receive network traffic. Users had to manually remove     and re-add the virtio_net module and restart the network     service before networking worked as expected. Such     memory conditions no longer prevent KVM guests receiving     network traffic. (BZ#597310)

  - when an SFQ qdisc that limited the queue size to two     packets was added to a network interface, sending     traffic through that interface resulted in a kernel     crash. Such a qdisc no longer results in a kernel crash.
    (BZ#597312)

  - when an NFS client opened a file with the O_TRUNC flag     set, it received a valid stateid, but did not use that     stateid to perform the SETATTR call. Such cases were     rejected by Red Hat Enterprise Linux 4 NFS servers with     an 'NFS4ERR_BAD_STATEID' error, possibly preventing some     NFS clients from writing files to an NFS file system.
    (BZ#597314)

The system must be rebooted for this update to take effect.

a. vCenter Server and vCenter Update Manager update Microsoft    SQL Server 2005 Express Edition to Service Pack 3

   Microsoft SQL Server 2005 Express Edition (SQL Express)    distributed with vCenter Server 4.1 Update 1 and vCenter Update    Manager 4.1 Update 1 is upgraded from  SQL Express Service Pack 2    to SQL Express Service Pack 3, to address multiple security    issues that exist in the earlier releases of Microsoft SQL Express.

   Customers using other database solutions need not update for    these issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086,    CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL    Express Service Pack 3.

b. vCenter Apache Tomcat Management Application Credential Disclosure

   The Apache Tomcat Manager application configuration file contains    logon credentials that can be read by unprivileged local users.

   The issue is resolved by removing the Manager application in    vCenter 4.1 Update 1.

   If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon    credentials are not present in the configuration file after the    update.

   VMware would like to thank Claudio Criscione of Secure Networking    for reporting this issue to us.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2010-2928 to this issue.

c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version    1.6.0_21

   Oracle (Sun) JRE update to version 1.6.0_21, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082,    CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088,    CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092,    CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837,    CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841,    CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845,    CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849,    CVE-2010-0850.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following name to the security issue fixed in    Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886.

d. vCenter Update Manager Oracle (Sun) JRE is updated to version   1.5.0_26

   Oracle (Sun) JRE update to version 1.5.0_26, which addresses    multiple security issues that existed in earlier releases of    Oracle (Sun) JRE.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566,    CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573,    CVE-2010-3565,CVE-2010-3568, CVE-2010-3569,  CVE-2009-3555,    CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562,    CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572,    CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541,    CVE-2010-3574.

e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28

   Apache Tomcat updated to version 6.0.28, which addresses multiple    security issues that existed in earlier releases of Apache Tomcat

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i    and CVE-2009-3548.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the following names to the security issues fixed in    Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157.

f. vCenter Server third-party component OpenSSL updated to version    0.9.8n

   The version of the OpenSSL library in vCenter Server is updated to    0.9.8n.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0740 and CVE-2010-0433 to the    issues addressed in this version of OpenSSL.

g. ESX third-party component OpenSSL updated to version 0.9.8p

   The version of the ESX OpenSSL library is updated to 0.9.8p.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3864 and CVE-2010-2939 to the    issues addressed in this update.

h. ESXi third-party component cURL updated

   The version of cURL library in ESXi is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to the issues addressed in    this update.

i. ESX third-party component pam_krb5 updated

   The version of pam_krb5 library is updated.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2008-3825 and CVE-2009-1384 to the    issues addressed in the update.

j. ESX third-party update for Service Console kernel

   The Service Console kernel is updated to include kernel version    2.6.18-194.11.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070,    CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524,    CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308,    CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086,    CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291,    CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437,    CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and    CVE-2010-3081 to the issues addressed in the update.

   Notes :
   - The update also addresses the 64-bit compatibility mode    stack pointer underflow issue identified by CVE-2010-3081. This    issue was patched in an ESX 4.1 patch prior to the release of    ESX 4.1 Update 1 and in a previous ESX 4.0 patch release.
   - The update also addresses CVE-2010-2240 for ESX 4.0.

The SUSE Linux Enterprise 11 kernel was updated to 2.6.27.48, fixing various bugs and security issues :

  - The do_gfs2_set_flags() function in fs/gfs2/file.c of     the Linux kernel does not verify the ownership of a     file, which allows local users to bypass intended access     restrictions via a SETFLAGS ioctl request.
    (CVE-2010-1641)

  - The nfs_wait_on_request() function in fs/nfs/pagelist.c     of the Linux kernel allows attackers to cause a denial     of service (Oops) via unknown vectors related to     truncating a file and an operation that is not     interruptible. (CVE-2010-1087)

  - When strict overcommit is enabled, mm/shmem.c does not     properly handle the export of shmemfs objects by knfsd,     which allows attackers to cause a denial of service     (NULL pointer dereference and knfsd crash) or possibly     have unspecified other impact via unknown vectors.
    (CVE-2010-1643)

  - A race condition in the find_keyring_by_name() function     in security/keys/keyring.c of the Linux kernel allows     local users to cause a denial of service (memory     corruption and system crash) or possibly have     unspecified other impact via keyctl session commands     that trigger access to a dead keyring that is undergoing     deletion by the key_cleanup() function. (CVE-2010-1437)

  - arch/1/mm/fsl_booke_mmu.c in KGDB in the Linux kernel,     when running on PowerPC, does not properly perform a     security check for access to a kernel page, which allows     local users to overwrite arbitrary kernel memory.
    (CVE-2010-1446)

  - The release_one_tty() function in drivers/char/tty_io.c     of the Linux kernel omits certain required calls to the     put_pid() function, which has an unspecified impact and     local attack vectors. (CVE-2010-1162)

  - The r8169 driver of the Linux kernel does not properly     check the size of an Ethernet frame that exceeds the     MTU, which allows remote attackers to cause a denial of     service (temporary network outage) via a packet with a     crafted size, in conjunction with certain packets     containing A characters and certain packets containing E     characters; or cause a denial of service (system crash)     via a packet with a crafted size, in conjunction with     certain packets containing '0' characters, related to     the value of the status register and erroneous behavior     associated with the RxMaxSize register. This     vulnerability exists due to an incorrect fix for     CVE-2009-1389. (CVE-2009-4537)

For a list of non-security related fixes please refer to the kernel RPM changelog.

a. Service Console OS update for COS kernel

   This patch updates the service console kernel to fix multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0415, CVE-2010-0307,    CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1437, and    CVE-2010-1088 to these issues.

b. Likewise package updates

   Updates to the likewisekrb5, likewiseopenldap, likewiseopen,    and pamkrb5 packages address several security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-0844, CVE-2009-0845,    CVE-2009-0846, CVE-2009-4212, and CVE-2010-1321 to these issues.

This openSUSE 11.2 kernel was updated to 2.6.31.14, fixing several security issues and bugs.

A lot of ext4 filesystem stability fixes were also added.

Following security issues have been fixed: CVE-2010-3301: Mismatch between 32bit and 64bit register usage in the system call entry path could be used by local attackers to gain root privileges. This problem only affects x86_64 kernels.

CVE-2010-3081: Incorrect buffer handling in the biarch-compat buffer handling could be used by local attackers to gain root privileges.
This problem affects foremost x86_64, or potentially other biarch platforms, like PowerPC and S390x.

CVE-2010-3084: A buffer overflow in the ETHTOOL_GRXCLSRLALL code could be used to crash the kernel or potentially execute code.

CVE-2010-2955: A kernel information leak via the WEXT ioctl was fixed.

CVE-2010-2960: The keyctl_session_to_parent function in security/keys/keyctl.c in the Linux kernel expects that a certain parent session keyring exists, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a KEYCTL_SESSION_TO_PARENT argument to the keyctl function.

CVE-2010-3080: A double free in an alsa error path was fixed, which could lead to kernel crashes.

CVE-2010-3079: Fixed a ftrace NULL pointer dereference problem which could lead to kernel crashes.

CVE-2010-3298: Fixed a kernel information leak in the net/usb/hso driver.

CVE-2010-3296: Fixed a kernel information leak in the cxgb3 driver.

CVE-2010-3297: Fixed a kernel information leak in the net/eql driver.

CVE-2010-3078: Fixed a kernel information leak in the xfs filesystem.
CVE-2010-2942: Fixed a kernel information leak in the net scheduler code.

CVE-2010-2954: The irda_bind function in net/irda/af_irda.c in the Linux kernel did not properly handle failure of the irda_open_tsap function, which allowed local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via multiple unsuccessful calls to bind on an AF_IRDA (aka PF_IRDA) socket.

CVE-2010-2226: The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel did not properly check the file descriptors passed to the SWAPEXT ioctl, which allowed local users to leverage write access and obtain read access by swapping one file into another file.

CVE-2010-2946: The 'os2' xattr namespace on the jfs filesystem could be used to bypass xattr namespace rules.

CVE-2010-2959: Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel allowed attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.

CVE-2010-3015: Integer overflow in the ext4_ext_get_blocks function in fs/ext4/extents.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) via a write operation on the last block of a large file, followed by a sync operation.

CVE-2010-2492: Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel might have allowed local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.

CVE-2010-2248: fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel allowed remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions.

CVE-2010-2803: The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel allowed local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.

CVE-2010-2478: A potential buffer overflow in the ETHTOOL_GRXCLSRLALL ethtool code was fixed which could be used by local attackers to crash the kernel or potentially execute code.

CVE-2010-2524: The DNS resolution functionality in the CIFS implementation in the Linux kernel, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allowed local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a 'cache stuffing' issue and MS-DFS referrals.

CVE-2010-2798: The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel used an incorrect size value in calculations associated with sentinel directory entries, which allowed local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c.

CVE-2010-2537: The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls allowed a local user to overwrite append-only files.

CVE-2010-2538: The BTRFS_IOC_CLONE_RANGE ioctl was subject to an integer overflow in specifying offsets to copy from a file, which potentially allowed a local user to read sensitive filesystem data.

CVE-2010-2521: Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel allowed remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.

CVE-2010-2066: The mext_check_arguments function in fs/ext4/move_extent.c in the Linux kernel allowed local users to overwrite an append-only file via a MOVE_EXT ioctl call that specifies this file as a donor.

CVE-2010-2495: The pppol2tp_xmit function in drivers/net/pppol2tp.c in the L2TP implementation in the Linux kernel did not properly validate certain values associated with an interface, which allowed attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors related to a routing change.

CVE-2010-2071: The btrfs_xattr_set_acl function in fs/btrfs/acl.c in btrfs in the Linux kernel did not check file ownership before setting an ACL, which allowed local users to bypass file permissions by setting arbitrary ACLs, as demonstrated using setfacl.

CVE-2010-1641: The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel did not verify the ownership of a file, which allowed local users to bypass intended access restrictions via a SETFLAGS ioctl request.

CVE-2010-1087: The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x allowed attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible.

CVE-2010-1636: The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the btrfs functionality in the Linux kernel did not ensure that a cloned file descriptor has been opened for reading, which allowed local users to read sensitive information from a write-only file descriptor.

CVE-2010-1437: Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.

CVE-2010-1148: The cifs_create function in fs/cifs/dir.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request to a server that supports UNIX extensions.

CVE-2010-1162: The release_one_tty function in drivers/char/tty_io.c in the Linux kernel omitted certain required calls to the put_pid function, which has unspecified impact and local attack vectors.

CVE-2010-1146: The Linux kernel, when a ReiserFS filesystem exists, did not restrict read or write access to the .reiserfs_priv directory, which allowed local users to gain privileges by modifying (1) extended attributes or (2) ACLs, as demonstrated by deleting a file under .reiserfs_priv/xattrs/.

CVE-2009-4537: drivers/net/r8169.c in the r8169 driver in the Linux kernel did not properly check the size of an Ethernet frame that exceeds the MTU, which allowed remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.

Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* a NULL pointer dereference flaw was found in the Linux kernel NFSv4 implementation. Several of the NFSv4 file locking functions failed to check whether a file had been opened on the server before performing locking operations on it. A local, unprivileged user on a system with an NFSv4 share mounted could possibly use this flaw to cause a kernel panic (denial of service) or escalate their privileges.
(CVE-2009-3726, Important)

* a flaw was found in the sctp_process_unk_param() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to an SCTP listening port on a target system, causing a kernel panic (denial of service). (CVE-2010-1173, Important)

* a race condition between finding a keyring by name and destroying a freed keyring was found in the Linux kernel key management facility. A local, unprivileged user could use this flaw to cause a kernel panic (denial of service) or escalate their privileges. (CVE-2010-1437, Important)

Red Hat would like to thank Simon Vallet for responsibly reporting CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173.

Bug fixes :

* RHBA-2007:0791 introduced a regression in the Journaling Block Device (JBD). Under certain circumstances, removing a large file (such as 300 MB or more) did not result in inactive memory being freed, leading to the system having a large amount of inactive memory. Now, the memory is correctly freed. (BZ#589155)

* the timer_interrupt() routine did not scale lost real ticks to logical ticks correctly, possibly causing time drift for 64-bit Red Hat Enterprise Linux 4 KVM (Kernel-based Virtual Machine) guests that were booted with the 'divider=x' kernel parameter set to a value greater than 1. 'warning: many lost ticks' messages may have been logged on the affected guest systems. (BZ#590551)

* a bug could have prevented NFSv3 clients from having the most up-to-date file attributes for files on a given NFSv3 file system. In cases where a file type changed, such as if a file was removed and replaced with a directory of the same name, the NFSv3 client may not have noticed this change until stat(2) was called (for example, by running 'ls -l'). (BZ#596372)

* RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X subsystem.
These could have caused a system deadlock on some systems where the BIOS set the default Maximum Memory Read Byte Count (MMRBC) to 4096, and that also use the Intel PRO/1000 Linux driver, e1000. Errors such as 'e1000: eth[x]: e1000_clean_tx_irq: Detected Tx Unit Hang' were logged. (BZ#596374)

* an out of memory condition in a KVM guest, using the virtio-net network driver and also under heavy network stress, could have resulted in that guest being unable to receive network traffic. Users had to manually remove and re-add the virtio_net module and restart the network service before networking worked as expected. Such memory conditions no longer prevent KVM guests receiving network traffic.
(BZ#597310)

* when an SFQ qdisc that limited the queue size to two packets was added to a network interface, sending traffic through that interface resulted in a kernel crash. Such a qdisc no longer results in a kernel crash. (BZ#597312)

* when an NFS client opened a file with the O_TRUNC flag set, it received a valid stateid, but did not use that stateid to perform the SETATTR call. Such cases were rejected by Red Hat Enterprise Linux 4 NFS servers with an 'NFS4ERR_BAD_STATEID' error, possibly preventing some NFS clients from writing files to an NFS file system. (BZ#597314)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Junjiro R. Okajima discovered that knfsd did not correctly handle strict overcommit. A local attacker could exploit this to crash knfsd, leading to a denial of service. (Only Ubuntu 6.06 LTS and 8.04 LTS were affected.) (CVE-2008-7256, CVE-2010-1643)

Chris Guo, Jukka Taimisto, and Olli Jarva discovered that SCTP did not correctly handle invalid parameters. A remote attacker could send specially crafted traffic that could crash the system, leading to a denial of service. (CVE-2010-1173)

Mario Mikocevic discovered that GFS2 did not correctly handle certain quota structures. A local attacker could exploit this to crash the system, leading to a denial of service. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1436)

Toshiyuki Okajima discovered that the kernel keyring did not correctly handle dead keyrings. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-1437)

Brad Spengler discovered that Sparc did not correctly implement non-executable stacks. This made userspace applications vulnerable to exploits that would have been otherwise blocked due to non-executable memory protections. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1451)

Dan Rosenberg discovered that the btrfs clone function did not correctly validate permissions. A local attacker could exploit this to read sensitive information, leading to a loss of privacy. (Only Ubuntu 9.10 was affected.) (CVE-2010-1636)

Dan Rosenberg discovered that GFS2 set_flags function did not correctly validate permissions. A local attacker could exploit this to gain access to files, leading to a loss of privacy and potential privilege escalation. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1641)

Shi Weihua discovered that btrfs xattr_set_acl function did not correctly validate permissions. A local attacker could exploit this to gain access to files, leading to a loss of privacy and potential privilege escalation. (Only Ubuntu 9.10 and 10.04 LTS were affected.) (CVE-2010-2071)

Andre Osterhues discovered that eCryptfs did not correctly calculate hash values. A local attacker with certain uids could exploit this to crash the system or potentially gain root privileges. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-2492).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* multiple flaws were found in the mmap and mremap implementations. A local user could use these flaws to cause a local denial of service or escalate their privileges. (CVE-2010-0291, Important)

* a NULL pointer dereference flaw was found in the Fast Userspace Mutexes (futexes) implementation. The unlock code path did not check if the futex value associated with pi_state->owner had been modified.
A local user could use this flaw to modify the futex value, possibly leading to a denial of service or privilege escalation when the pi_state->owner pointer is dereferenced. (CVE-2010-0622, Important)

* a NULL pointer dereference flaw was found in the Linux kernel Network File System (NFS) implementation. A local user on a system that has an NFS-mounted file system could use this flaw to cause a denial of service or escalate their privileges on that system.
(CVE-2010-1087, Important)

* a flaw was found in the sctp_process_unk_param() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet to an SCTP listening port on a target system, causing a kernel panic (denial of service). (CVE-2010-1173, Important)

* a flaw was found in the Linux kernel Transparent Inter-Process Communication protocol (TIPC) implementation. If a client application, on a local system where the tipc module is not yet in network mode, attempted to send a message to a remote TIPC node, it would dereference a NULL pointer on the local system, causing a kernel panic (denial of service). (CVE-2010-1187, Important)

* a buffer overflow flaw was found in the Linux kernel Global File System 2 (GFS2) implementation. In certain cases, a quota could be written past the end of a memory page, causing memory corruption, leaving the quota stored on disk in an invalid state. A user with write access to a GFS2 file system could trigger this flaw to cause a kernel crash (denial of service) or escalate their privileges on the GFS2 server. This issue can only be triggered if the GFS2 file system is mounted with the 'quota=on' or 'quota=account' mount option.
(CVE-2010-1436, Important)

* a race condition between finding a keyring by name and destroying a freed keyring was found in the Linux kernel key management facility. A local user could use this flaw to cause a kernel panic (denial of service) or escalate their privileges. (CVE-2010-1437, Important)

* a flaw was found in the link_path_walk() function in the Linux kernel. Using the file descriptor returned by the open() function with the O_NOFOLLOW flag on a subordinate NFS-mounted file system, could result in a NULL pointer dereference, causing a denial of service or privilege escalation. (CVE-2010-1088, Moderate)

* a missing permission check was found in the gfs2_set_flags() function in the Linux kernel GFS2 implementation. A local user could use this flaw to change certain file attributes of files, on a GFS2 file system, that they do not own. (CVE-2010-1641, Low)

Red Hat would like to thank Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia Siemens Networks, and Wind River on behalf of their customer, for responsibly reporting CVE-2010-1173; Mario Mikocevic for responsibly reporting CVE-2010-1436; and Dan Rosenberg for responsibly reporting CVE-2010-1641.

This update also fixes several bugs. Documentation for these bug fixes will be available shortly from http://www.redhat.com/docs/en-US/errata/RHSA-2010-0504/Kernel_Security
_Update/ index.html

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.48 fixing various bugs and security issues.

CVE-2010-1641: The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request.

CVE-2010-1087: The nfs_wait_on_request function in fs/nfs/pagelist.c in the Linux kernel allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible. 

CVE-2010-1643: mm/shmem.c in the Linux kernel, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors.

CVE-2010-1437: Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.

CVE-2010-1446: arch/powerpc/mm/fsl_booke_mmu.c in KGDB in the Linux kernel, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl booke.

CVE-2010-1162: The release_one_tty function in drivers/char/tty_io.c in the Linux kernel omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.

CVE-2009-4537: drivers/net/r8169.c in the r8169 driver in the Linux kernel does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.

Update to kernel 2.6.32.14:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.13 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.14 Multiple iwlwifi bugfixes from Fedora 13. Fix thinkpad backlight controls.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to kernel 2.6.33.5:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.33.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0474 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    Security fixes:

    * a NULL pointer dereference flaw was found in the Linux kernel NFSv4     implementation. Several of the NFSv4 file locking functions failed to check     whether a file had been opened on the server before performing locking     operations on it. A local, unprivileged user on a system with an NFSv4     share mounted could possibly use this flaw to cause a kernel panic (denial     of service) or escalate their privileges. (CVE-2009-3726, Important)

    * a flaw was found in the sctp_process_unk_param() function in the Linux     kernel Stream Control Transmission Protocol (SCTP) implementation. A remote     attacker could send a specially-crafted SCTP packet to an SCTP listening     port on a target system, causing a kernel panic (denial of service).
    (CVE-2010-1173, Important)

    * a race condition between finding a keyring by name and destroying a freed     keyring was found in the Linux kernel key management facility. A local,     unprivileged user could use this flaw to cause a kernel panic (denial of     service) or escalate their privileges. (CVE-2010-1437, Important)

    Red Hat would like to thank Simon Vallet for responsibly reporting     CVE-2009-3726; and Jukka Taimisto and Olli Jarva of Codenomicon Ltd, Nokia     Siemens Networks, and Wind River on behalf of their customer, for     responsibly reporting CVE-2010-1173.

    Bug fixes:

    * RHBA-2007:0791 introduced a regression in the Journaling Block Device     (JBD). Under certain circumstances, removing a large file (such as 300 MB     or more) did not result in inactive memory being freed, leading to the     system having a large amount of inactive memory. Now, the memory is     correctly freed. (BZ#589155)

    * the timer_interrupt() routine did not scale lost real ticks to logical     ticks correctly, possibly causing time drift for 64-bit Red Hat Enterprise     Linux 4 KVM (Kernel-based Virtual Machine) guests that were booted with the     divider=x kernel parameter set to a value greater than 1. warning: many     lost ticks messages may have been logged on the affected guest systems.
    (BZ#590551)

    * a bug could have prevented NFSv3 clients from having the most up-to-date     file attributes for files on a given NFSv3 file system. In cases where a     file type changed, such as if a file was removed and replaced with a     directory of the same name, the NFSv3 client may not have noticed this     change until stat(2) was called (for example, by running ls -l).
    (BZ#596372)

    * RHBA-2007:0791 introduced bugs in the Linux kernel PCI-X subsystem. These     could have caused a system deadlock on some systems where the BIOS set the     default Maximum Memory Read Byte Count (MMRBC) to 4096, and that also use     the Intel PRO/1000 Linux driver, e1000. Errors such as e1000: eth[x]:
    e1000_clean_tx_irq: Detected Tx Unit Hang were logged. (BZ#596374)

    * an out of memory condition in a KVM guest, using the virtio-net network     driver and also under heavy network stress, could have resulted in     that guest being unable to receive network traffic. Users had to manually     remove and re-add the virtio_net module and restart the network service     before networking worked as expected. Such memory conditions no longer     prevent KVM guests receiving network traffic. (BZ#597310)

    * when an SFQ qdisc that limited the queue size to two packets was added to     a network interface, sending traffic through that interface resulted in a     kernel crash. Such a qdisc no longer results in a kernel crash. (BZ#597312)

    * when an NFS client opened a file with the O_TRUNC flag set, it received     a valid stateid, but did not use that stateid to perform the SETATTR call.
    Such cases were rejected by Red Hat Enterprise Linux 4 NFS servers with an     NFS4ERR_BAD_STATEID error, possibly preventing some NFS clients from     writing files to an NFS file system. (BZ#597314)

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues. The system must be rebooted for this     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4537     Fabian Yamaguchi reported a missing check for Ethernet     frames larger than the MTU in the r8169 driver. This may     allow users on the local network to crash a system,     resulting in a denial of service.

  - CVE-2010-0727     Sachin Prabhu reported an issue in the GFS2 filesystem.
    Local users can trigger a BUG() altering the permissions     on a locked file, resulting in a denial of service.

  - CVE-2010-1083     Linus Torvalds reported an issue in the USB subsystem,     which may allow local users to obtain portions of     sensitive kernel memory.

  - CVE-2010-1084     Neil Brown reported an issue in the Bluetooth subsystem     that may permit remote attackers to overwrite memory     through the creation of large numbers of sockets,     resulting in a denial of service.

  - CVE-2010-1086     Ang Way Chuang reported an issue in the DVB subsystem     for Digital TV adapters. By creating a specially-encoded     MPEG2-TS frame, a remote attacker could cause the     receiver to enter an endless loop, resulting in a denial     of service.

  - CVE-2010-1087     Trond Myklebust reported an issue in the NFS filesystem.
    A local user may cause an oops by sending a fatal signal     during a file truncation operation, resulting in a     denial of service.

  - CVE-2010-1088     Al Viro reported an issue where automount symlinks may     not be followed when LOOKUP_FOLLOW is not set. This has     an unknown security impact.

  - CVE-2010-1162     Catalin Marinas reported an issue in the tty subsystem     that allows local attackers to cause a kernel memory     leak, possibly resulting in a denial of service.

  - CVE-2010-1173     Chris Guo from Nokia China and Jukka Taimisto and Olli     Jarva from Codenomicon Ltd reported an issue in the SCTP     subsystem that allows a remote attacker to cause a     denial of service using a malformed init package.

  - CVE-2010-1187     Neil Hormon reported an issue in the TIPC subsystem.
    Local users can cause a denial of service by way of a     NULL pointer dereference by sending datagrams through     AF_TIPC before entering network mode.

  - CVE-2010-1437     Toshiyuki Okajima reported a race condition in the     keyring subsystem. Local users can cause memory     corruption via keyctl commands that access a keyring in     the process of being deleted, resulting in a denial of     service.

  - CVE-2010-1446     Wufei reported an issue with kgdb on the PowerPC     architecture, allowing local users to write to kernel     memory. Note: this issue does not affect binary kernels     provided by Debian. The fix is provided for the benefit     of users who build their own kernels from Debian source.

  - CVE-2010-1451     Brad Spengler reported an issue on the SPARC     architecture that allows local users to execute     non-executable pages.

This update also includes fixes a regression introduced by a previous update. See the referenced Debian bug page for details.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2010-0504.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2010-0474.

ID	Name	Product	Family	Severity
89674	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)	Nessus	Misc.	high
79507	OracleVM 2.2 : kernel (OVMSA-2013-0039)	Nessus	OracleVM Local Security Checks	high
68056	Oracle Linux 5 : kernel (ELSA-2010-0504)	Nessus	Oracle Linux Local Security Checks	high
68049	Oracle Linux 4 : kernel (ELSA-2010-0474)	Nessus	Oracle Linux Local Security Checks	high
60810	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60802	Scientific Linux Security Update : kernel on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51971	VMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX	Nessus	VMware ESX Local Security Checks	high
50922	SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 2682 / 2687 / 2689)	Nessus	SuSE Local Security Checks	high
50611	VMSA-2010-0016 : VMware ESXi and ESX third-party updates for Service Console and Likewise components	Nessus	VMware ESX Local Security Checks	critical
49671	openSUSE Security Update : kernel (openSUSE-SU-2010:0664-1)	Nessus	SuSE Local Security Checks	critical
48408	CentOS 4 : kernel (CESA-2010:0474)	Nessus	CentOS Local Security Checks	high
48253	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : linux, linux-{source-2.6.15,ec2,mvl-dove,ti-omap} vulnerabilities (USN-966-1)	Nessus	Ubuntu Local Security Checks	high
47870	RHEL 5 : kernel (RHSA-2010:0504)	Nessus	Red Hat Local Security Checks	high
47774	openSUSE Security Update : kernel (openSUSE-SU-2010:0397-1)	Nessus	SuSE Local Security Checks	high
47702	CentOS 5 : kernel (CESA-2010:0504)	Nessus	CentOS Local Security Checks	high
47526	Fedora 12 : kernel-2.6.32.14-127.fc12 (2010-9209)	Nessus	Fedora Local Security Checks	low
47525	Fedora 13 : kernel-2.6.33.5-112.fc13 (2010-9183)	Nessus	Fedora Local Security Checks	low
47026	RHEL 4 : kernel (RHSA-2010:0474)	Nessus	Red Hat Local Security Checks	high
46725	Debian DSA-2053-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	high
801492	CentOS RHSA-2010-0504 Security Check	Log Correlation Engine	Generic	high
801491	CentOS RHSA-2010-0474 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2010-1437

high

Tenable Plugins

high

high

high

high

high

high

high

high

critical

critical

high

high

high

high

high

low

low

high

high

high

high