The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash) via vectors involving (1) a loopback (aka loop) transmit operation or (2) an InfiniBand (aka ib) transmit operation.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0542 advisory.

    - [net] limit socket backlog add operation to prevent possible DoS (Jiri Pirko) [694396] {CVE-2010-4251}
    - [scsi] mpt2sas: prevent heap overflows and unchecked (Tomas Henzl) [694023] {CVE-2011-1494     CVE-2011-1495}
    - [fs] epoll: prevent creating circular epoll structures (Don Howard) [681683] {CVE-2011-1082}
    - [fs] nfs: Ensure that NFS4 acl requests don't use slab in skb fraglist (Neil Horman) [682645]     {CVE-2011-1090}
    - [fs] partitions: Validate map_count in Mac partition tables (Danny Feng) [679286] {CVE-2011-1010}
    - [fs] Fix corrupted OSF partition table parsing (Danny Feng) [688025] {CVE-2011-1163}
    - [net] sctp: fix the INIT/INIT-ACK chunk length calculation (Thomas Graf) [690743] {CVE-2011-1573}
    - [net] CAN: Use inode instead of kernel address for /proc file (Danny Feng) [664561] {CVE-2010-4565}
    - [fs] inotify: fix double free/corruption of stuct user (Eric Paris) [656832] {CVE-2010-4250}
    - [net] bonding: fix incorrect tx queue offset (Andy Gospodarek) [695548] {CVE-2011-1581}
    - [tracing] t_start: reset FTRACE_ITER_HASH in case of seek/pread (Jiri Olsa) [631626] {CVE-2010-3079}
    - [net] ipv6: netfilter: ip6_tables: fix infoleak to userspace (Jiri Pirko) [689351] {CVE-2011-1172}
    - [net] netfilter: ip_tables: fix infoleak to userspace (Jiri Pirko) [689334] {CVE-2011-1171}
    - [net] netfilter: arp_tables: fix infoleak to userspace (Jiri Pirko) [689325] {CVE-2011-1170}
    - [drm] radeon/kms: check AA resolve registers on r300 + regression fix (Dave Airlie) [680002]     {CVE-2011-1016}
    - [net] fix ebtables stack infoleak (Eugene Teo) [681323] {CVE-2011-1080}
    - [drm] fix unsigned vs signed comparison issue in modeset ctl ioctl (Don Howard) [679928] {CVE-2011-1013}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2016 advisory.

    - kernel: Fix unlimited socket backlog DoS {CVE-2010-4251}
    - rds: prevent BUG_ON triggering on congestion map updates {CVE-2011-1023}
    - epoll: prevent creating circular epoll structures {CVE-2011-1082}
    - fs: fix corrupted OSF partition table parsing {CVE-2011-1163}
    - fs: Increase OSF partition limit from 8 to 18 {CVE-2011-1163}
    - netfilter: arp_tables: fix infoleak to userspace {CVE-2011-1170}
    - netfilter: ip_tables: fix infoleak to userspace {CVE-2011-1171}
    - ipv6: netfilter: ip6_tables: fix infoleak to userspace {CVE-2011-1172}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - Multiple buffer overflow flaws were found in the Linux     kernel's Management Module Support for Message Passing     Technology (MPT) based controllers. A local,     unprivileged user could use these flaws to cause a     denial of service, an information leak, or escalate     their privileges. (CVE-2011-1494, CVE-2011-1495,     Important)

  - A flaw was found in the Linux kernel's Ethernet bonding     driver implementation. Packets coming in from network     devices that have more than 16 receive queues to a     bonding interface could cause a denial of service.
    (CVE-2011-1581, Important)

  - A flaw was found in the Linux kernel's networking     subsystem. If the number of packets received exceeded     the receiver's buffer limit, they were queued in a     backlog, consuming memory, instead of being discarded. A     remote attacker could abuse this flaw to cause a denial     of service (out-of-memory condition). (CVE-2010-4251,     Moderate)

  - A flaw was found in the Linux kernel's Transparent Huge     Pages (THP) implementation. A local, unprivileged user     could abuse this flaw to allow the user stack (when it     is using huge pages) to grow and cause a denial of     service. (CVE-2011-0999, Moderate)

  - A flaw was found in the transmit methods (xmit) for the     loopback and InfiniBand transports in the Linux kernel's     Reliable Datagram Sockets (RDS) implementation. A local,     unprivileged user could use this flaw to cause a denial     of service. (CVE-2011-1023, Moderate)

  - A flaw in the Linux kernel's Event Poll (epoll)     implementation could allow a local, unprivileged user to     cause a denial of service. (CVE-2011-1082, Moderate)

  - An inconsistency was found in the interaction between     the Linux kernel's method for allocating NFSv4 (Network     File System version 4) ACL data and the method by which     it was freed. This inconsistency led to a kernel panic     which could be triggered by a local, unprivileged user     with files owned by said user on an NFSv4 share.
    (CVE-2011-1090, Moderate)

  - A missing validation check was found in the Linux     kernel's mac_partition() implementation, used for     supporting file systems created on Mac OS operating     systems. A local attacker could use this flaw to cause a     denial of service by mounting a disk that contains     specially crafted partitions. (CVE-2011-1010, Low)

  - A buffer overflow flaw in the DEC Alpha OSF partition     implementation in the Linux kernel could allow a local     attacker to cause an information leak by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1163, Low)

  - Missing validations of null-terminated string data     structure elements in the do_replace(),     compat_do_replace(), do_ipt_get_ctl(),     do_ip6t_get_ctl(), and do_arpt_get_ctl() functions could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1170,     CVE-2011-1171, CVE-2011-1172, Low)

This update also fixes several hundred bugs and adds enhancements.

The system must be rebooted for this update to take effect.

This update fixes the following reports for OFED :

  - 704914: Fixed NFS client over TCP hangs due to packet     loss.

  - 693243: Fixed issue with building lustre against     ofed-devel.

  - 706175: Fix crash on accessing /proc/net/sdpstats

  - 722030: Cannot load ib_ipath

  - 703752: Prevent BUG_ON triggering on congestion

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0542 advisory.

  - kvm: arch/x86/kvm/x86.c: reading uninitialized stack memory (CVE-2010-3881)

  - kernel: unlimited socket backlog DoS (CVE-2010-4251, CVE-2010-4805)

  - kernel: thp: prevent hugepages during args/env copying into the user stack (CVE-2011-0999)

  - kernel: fs/partitions: Validate map_count in Mac partition tables (CVE-2011-1010)

  - kernel: BUG_ON() in rds_send_xmit() (CVE-2011-1023)

  - kernel: potential kernel deadlock when creating circular epoll file structures (CVE-2011-1082)

  - kernel: nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (CVE-2011-1090)

  - kernel: fs/partitions: Corrupted OSF partition table infoleak (CVE-2011-1163)

  - kernel: ipv4: netfilter: arp_tables: fix infoleak to userspace (CVE-2011-1170)

  - kernel: ipv4: netfilter: ip_tables: fix infoleak to userspace (CVE-2011-1171)

  - kernel: ipv6: netfilter: ip6_tables: fix infoleak to userspace (CVE-2011-1172)

  - kernel: drivers/scsi/mpt2sas: prevent heap overflows (CVE-2011-1494, CVE-2011-1495)

  - kernel: bonding: Incorrect TX queue offset (CVE-2011-1581)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
181049	Oracle Linux 6 : kernel (ELSA-2011-0542)	Nessus	Oracle Linux Local Security Checks	high
68417	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2016)	Nessus	Oracle Linux Local Security Checks	high
61041	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57123	SuSE 11.1 Security Update : OFED (SAT Patch Number 5384)	Nessus	SuSE Local Security Checks	medium
54590	RHEL 6 : Red Hat Enterprise Linux 6.1 kernel (RHSA-2011:0542)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-1023

medium

Tenable Plugins

high

high

medium

medium

high