The create_pit_timer function in arch/x86/kvm/i8254.c in KVM 83, and possibly other versions, does not properly handle when Programmable Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt controller (irqchip) is not available, which allows local users to cause a denial of service (NULL pointer dereference) by starting a timer.

A buffer overflow flaw was found in the way the Linux kernel's XFS file system implementation handled links with overly long path names.
A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk. (CVE-2011-4077 , Moderate)

Flaws in ghash_update() and ghash_final() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-4081 , Moderate)

A flaw was found in the Linux kernel's Journaling Block Device (JBD).
A local, unprivileged user could use this flaw to crash the system by mounting a specially crafted ext3 or ext4 disk. (CVE-2011-4132 , Moderate)

It was found that the kvm_vm_ioctl_assign_device() function in the KVM (Kernel-based Virtual Machine) subsystem of a Linux kernel did not check if the user requesting device assignment was privileged or not.
A local, unprivileged user on the host could assign unused PCI devices, or even devices that were in use and whose resources were not properly claimed by the respective drivers, which could result in the host crashing. (CVE-2011-4347 , Moderate)

Two flaws were found in the way the Linux kernel's __sys_sendmsg() function, when invoked via the sendmmsg() system call, accessed user-space memory. A local, unprivileged user could use these flaws to cause a denial of service. (CVE-2011-4594 , Moderate)

A previous update introduced an integer overflow flaw in the Linux kernel. On PowerPC systems, a local, unprivileged user could use this flaw to cause a denial of service. (CVE-2011-4611 , Moderate)

A flaw was found in the way the KVM subsystem of a Linux kernel handled PIT (Programmable Interval Timer) IRQs (interrupt requests) when there was no virtual interrupt controller set up. A local, unprivileged user on the host could force this situation to occur, resulting in the host crashing. (CVE-2011-4622 , Moderate)

A flaw was found in the way the Linux kernel's XFS file system implementation handled on-disk Access Control Lists (ACLs). A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk.
(CVE-2012-0038 , Moderate)

A flaw was found in the way the Linux kernel's KVM hypervisor implementation emulated the syscall instruction for 32-bit guests. An unprivileged guest user could trigger this flaw to crash the guest.
(CVE-2012-0045 , Moderate)

A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query() function. An attacker able to send certain IGMP (Internet Group Management Protocol) packets to a target system could use this flaw to cause a denial of service. (CVE-2012-0207 , Moderate)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2003 advisory.

    - [fs] xfs: Fix possible memory corruption in xfs_readlink (Carlos Maiolino) {CVE-2011-4077}
    - crypto: ghash - Avoid null pointer dereference if no key is set (Nick Bowler) {CVE-2011-4081}
    - jbd/jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan) {CVE-2011-4132}
    - KVM: Device assignment permission checks (Joe Jin) {CVE-2011-4347}
    - KVM: x86: Prevent starting PIT timers in the absence of irqchip support (Jan Kiszka) {CVE-2011-4622}
    - xfs: validate acl count (Joe Jin) {CVE-2012-0038}
    - KVM: x86: fix missing checks in syscall emulation (Joe Jin) {CVE-2012-0045}
    - KVM: x86: extend 'struct x86_emulate_ops' with 'get_cpuid' (Joe Jin) {CVE-2012-0045}
    - igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Ben Hutchings) {CVE-2012-0207}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0350 advisory.

    - [fs] xfs: Fix missing xfs_iunlock() on error recovery path in xfs_readlink() (Carlos Maiolino) [749161     694702] {CVE-2011-4077}
    - [fs] xfs: Fix memory corruption in xfs_readlink (Carlos Maiolino) [749161 694702] {CVE-2011-4077}
    - [net] igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Jiri Pirko) [772870 772871]     {CVE-2012-0207}
    - [fs] xfs: validate acl count (Eric Sandeen) [773282 773283] {CVE-2012-0038}
    - [virt] kvm: x86: fix missing checks in syscall emulation (Marcelo Tosatti) [773390 773391]     {CVE-2012-0045}
    - [virt] kvm: x86: extend 'struct x86_emulate_ops' with 'get_cpuid' (Marcelo Tosatti) [773390 773391]     {CVE-2012-0045}
    - [kernel] crypto: ghash - Avoid null pointer dereference if no key is set (Jiri Benc) [749481 749482]     {CVE-2011-4081}
    - [fs] jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan) [753344 693981] {CVE-2011-4132}
    - [net] fix unsafe pointer access in sendmmsg (Jiri Benc) [761668 760798] {CVE-2011-4594}
    - [perf] powerpc: Handle events that raise an exception without overflowing (Steve Best) [767917 755737]     {CVE-2011-4611}
    - [virt] x86: Prevent starting PIT timers in the absence of irqchip support (Marcelo Tosatti) [769634     769550] {CVE-2011-4622}
    - [virt] KVM: Device assignment permission checks (Alex Williamson) [756092 756093] {CVE-2011-4347}
    - [virt] KVM: Remove ability to assign a device without iommu support (Alex Williamson) [756092 756093]     {CVE-2011-4347}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0051 advisory.

    - Resolves: bz#772079       (EMBARGOED CVE-2012-0029 qemu-kvm: e1000: process_tx_desc legacy mode packets heap overflow     [rhel-5.7.z])
    - Resolves: bz#770100       (CVE-2011-4622 kernel: kvm: pit timer with no irqchip crashes the system [rhel-5.7.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP1 kernel has been updated to the 2.6.32.59 stable release to fix a lot of bugs and security issues.

The following security issues have been fixed :

  - A use after free bug in hugetlb support could be used by     local attackers to crash the system. (CVE-2012-2133)

  - A NULL pointer dereference bug in the regsets proc file     could be used by local attackers to perhaps crash the     system. With mmap_min_addr is set and enabled,     exploitation is unlikely. (CVE-2012-1097)

  - A reference counting issue in CLONE_IO could be used by     local attackers to cause a denial of service (out of     memory). (CVE-2012-0879)

  - A file handle leak in CIFS code could be used by local     attackers to crash the system. (CVE-2012-1090)

  - Large nested epoll chains could be used by local     attackers to cause a denial of service (excessive CPU     consumption). (CVE-2011-1083)

  - When using KVM, programming a PIT timer without a     irqchip configuration, can be used to crash the kvm     guest. This likely can be done only by a privileged     guest user. (CVE-2011-4622)

  - A KVM 32bit guest crash in 'syscall' opcode handling was     fixed that could be caused by local attackers.
    (CVE-2012-0045)

  - Fixed a oops in jbd/jbd2 that could be caused by     specific filesystem access patterns. The following     non-security issues have been fixed:. (CVE-2011-4086)

X86 :

  - x86: fix the initialization of physnode_map.
    (bnc#748112)

  - x86: Allow bootmem reserves at greater than 8G node     offset within a node. (bnc#740895)

  - x86, tsc: Fix SMI induced variation in     quick_pit_calibrate(). (bnc#751322)

  - x86, efi: Work around broken firmware. (bnc#714507)     BONDING :

  - bonding: update speed/duplex for NETDEV_CHANGE.
    (bnc#752634)

  - bonding: comparing a u8 with -1 is always false.
    (bnc#752634)

  - bonding: start slaves with link down for ARP monitor.
    (bnc#752634)

  - bonding: send gratuitous ARP for all addresses     (bnc#752491). XFS :

  - xfs: Fix excessive inode syncing when project quota is     exceeded. (bnc#756448)

  - xfs: Fix oops on IO error during     xlog_recover_process_iunlinks() (bnc#716850). SCSI :

  - scsi/ses: Handle non-unique element descriptors.
    (bnc#749342, bnc#617344)

  - scsi/sd: mark busy sd majors as allocated (bug#744658).

  - scsi: Check for invalid sdev in scsi_prep_state_check()     (bnc#734300). MD/RAID :

  - md: fix possible corruption of array metadata on     shutdown.

  - md: ensure changes to write-mostly are reflected in     metadata. (bnc#755178)

  - md: do not set md arrays to readonly on shutdown     (bnc#740180, bnc#713148, bnc#734900). XEN :

  - smpboot: adjust ordering of operations.

  - x86-64: provide a memset() that can deal with 4Gb or     above at a time. (bnc#738528)

  - blkfront: properly fail packet requests. (bnc#745929)

  - Update Xen patches to 2.6.32.57.

  - xenbus: Reject replies with payload >     XENSTORE_PAYLOAD_MAX.

  - xenbus_dev: add missing error checks to watch handling.

  - Refresh other Xen patches. (bnc#652942, bnc#668194,     bnc#688079)

  - fix Xen-specific kABI issue in Linux 2.6.19. NFS :

  - NFSD: Fill in WCC data for REMOVE, RMDIR, MKNOD, and     MKDIR. (bnc#751880)

  - nfs: Include SYNC flag when comparing mount options with     NOAC flag. (bnc#745422)

  - NFS returns EIO for EDQUOT and others. (bnc#747028)

  - lockd: fix arg parsing for grace_period and timeout.
    (bnc#733761)

  - nfs: allow nfs4leasetime to be set before starting     servers. (bnc#733761)

  - nfs: handle d_revalidate of dot correctly (bnc#731809).
    S/390 :

  - ctcmpc: use correct idal word list for ctcmpc     (bnc#750171,LTC#79264).

  - qeth: synchronize discipline module loading     (bnc#747430,LTC#78788).

  - qdio: avoid race leading to stall when tolerating CQ     (bnc#737326,LTC#76599).

  - kernel: no storage key operations for invalid page table     entries (bnc#737326,LTC#77697). OTHER :

  - tlan: add cast needed for proper 64 bit operation.
    (bnc#756840)

  - dl2k: Tighten ioctl permissions. (bnc#758813)

  - tg3: Fix RSS ring refill race condition. (bnc#757917)

  - usbhid: fix error handling of not enough bandwidth.
    (bnc#704280)

  - pagecache limit: Fix the shmem deadlock. (bnc#755537)

  - tty_audit: fix tty_audit_add_data live lock on audit     disabled. (bnc#721366)

  - ixgbe: driver sets all WOL flags upon initialization so     that machine is powered on as soon at it is switched     off. (bnc#693639)

  - PCI: Set device power state to PCI_D0 for device without     native PM support. (bnc#752972)

  - dlm: Do not allocate a fd for peeloff. (bnc#729247)

  - sctp: Export sctp_do_peeloff. (bnc#729247)

  - epoll: Do not limit non-nested epoll paths. (bnc#676204)

  - mlx4: Limit MSI-X vector allocation. (bnc#624072)

  - mlx4: Changing interrupt scheme. (bnc#624072)

  - mlx4_en: Assigning TX irq per ring. (bnc#624072)

  - mlx4_en: Restoring RX buffer pointer in case of failure.
    (bnc#624072)

  - mlx4_en: using new mlx4 interrupt scheme. (bnc#624072)

  - igb: Fix for Alt MAC Address feature on 82580 and later     devices. (bnc#746980)

  - igb: Power down link when interface is down.
    (bnc#745699)

  - igb: use correct bits to identify if managability is     enabled. (bnc#743209)

  - intel_agp: Do not oops with zero stolen memory.
    (bnc#738679)

  - agp: fix scratch page cleanup. (bnc#738679)

  - hugetlb: add generic definition of NUMA_NO_NODE.
    (bnc#751844)

  - sched: Fix proc_sched_set_task(). (bnc#717994)

  - PM: Print a warning if firmware is requested when tasks     are frozen. (bnc#749886)

  - PM / Sleep: Fix freezer failures due to racy     usermodehelper_is_disabled(). (bnc#749886)

  - PM / Sleep: Fix read_unlock_usermodehelper() call.
    (bnc#749886)

  - firmware loader: allow builtin firmware load even if     usermodehelper is disabled. (bnc#749886)

  - PM / Hibernate: Enable usermodehelpers in     software_resume() error path. (bnc#744163)

  - ipv6: Allow inet6_dump_addr() to handle more than 64     addresses. (bnc#748279)

  - ipv6: fix refcnt problem related to POSTDAD state.
    (bnc#743619)

  - be2net: change to show correct physical link status.
    (bnc#727834)

  - be2net: changes to properly provide phy details.
    (bnc#727834)

  - aio: fix race between io_destroy() and io_submit().
    (bnc#747445 / bnc#611264)

  - intel-iommu: Check for identity mapping candidate using     system dma mask. (bnc#700449)

  - intel-iommu: Dont cache iova above 32bit. (bnc#700449)

  - intel-iommu: Add domain check in     domain_remove_one_dev_info. (bnc#700449)

  - intel-iommu: Provide option to enable 64-bit IOMMU pass     through mode. (bnc#700449)

  - intel-iommu: Remove Host Bridge devices from identity     mapping. (bnc#700449)

  - intel-iommu: Speed up processing of the identity_mapping     function. (bnc#700449)

  - intel-iommu: Use coherent DMA mask when requested.
    (bnc#700449)

  - 1: Fix accounting of softirq time when idle.
    (bnc#719793)

  - driver-core: fix race between device_register and     driver_register. (bnc#742358)

  - dcache: patches.fixes/large-hash-dcache_init-fix.patch:
    Fix oops when initializing large hash on > 16TB machine.
    (bnc#742210)

  - kdump: Save PG_compound or PG_head value in VMCOREINFO.
    (bnc#738503)

  - Update config files: disable NET_9P_RDMA. (bnc#720374)

  - cdc-wdm: fix race leading leading to memory corruption.
    (bnc#759544)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0051 advisory.

  - kernel: kvm: pit timer with no irqchip crashes the system (CVE-2011-4622)

  - qemu: e1000: process_tx_desc legacy mode packets heap overflow (CVE-2012-0029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A buffer overflow flaw was found in the way the Linux     kernel's XFS file system implementation handled links     with overly long path names. A local, unprivileged user     could use this flaw to cause a denial of service or     escalate their privileges by mounting a specially     crafted disk. (CVE-2011-4077, Moderate)

  - Flaws in ghash_update() and ghash_final() could allow a     local, unprivileged user to cause a denial of service.
    (CVE-2011-4081, Moderate)

  - A flaw was found in the Linux kernel's Journaling Block     Device (JBD). A local, unprivileged user could use this     flaw to crash the system by mounting a specially crafted     ext3 or ext4 disk. (CVE-2011-4132, Moderate)

  - It was found that the kvm_vm_ioctl_assign_device()     function in the KVM (Kernel-based Virtual Machine)     subsystem of a Linux kernel did not check if the user     requesting device assignment was privileged or not. A     local, unprivileged user on the host could assign unused     PCI devices, or even devices that were in use and whose     resources were not properly claimed by the respective     drivers, which could result in the host crashing.
    (CVE-2011-4347, Moderate)

  - Two flaws were found in the way the Linux kernel's
    __sys_sendmsg() function, when invoked via the     sendmmsg() system call, accessed user-space memory. A     local, unprivileged user could use these flaws to cause     a denial of service. (CVE-2011-4594, Moderate)

  - A flaw was found in the way the KVM subsystem of a Linux     kernel handled PIT (Programmable Interval Timer) IRQs     (interrupt requests) when there was no virtual interrupt     controller set up. A local, unprivileged user on the     host could force this situation to occur, resulting in     the host crashing. (CVE-2011-4622, Moderate)

  - A flaw was found in the way the Linux kernel's XFS file     system implementation handled on-disk Access Control     Lists (ACLs). A local, unprivileged user could use this     flaw to cause a denial of service or escalate their     privileges by mounting a specially crafted disk.
    (CVE-2012-0038, Moderate)

  - A flaw was found in the way the Linux kernel's KVM     hypervisor implementation emulated the syscall     instruction for 32-bit guests. An unprivileged guest     user could trigger this flaw to crash the guest.
    (CVE-2012-0045, Moderate)

  - A divide-by-zero flaw was found in the Linux kernel's     igmp_heard_query() function. An attacker able to send     certain IGMP (Internet Group Management Protocol)     packets to a target system could use this flaw to cause     a denial of service. (CVE-2012-0207, Moderate)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Scientific Linux kernel.

A heap overflow flaw was found in the way QEMU-KVM emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network interface is configured to use the e1000 emulated driver could use this flaw to crash the host or, possibly, escalate their privileges on the host. (CVE-2012-0029)

A flaw was found in the way the KVM subsystem of a Linux kernel handled PIT (Programmable Interval Timer) IRQs (interrupt requests) when there was no virtual interrupt controller set up. A malicious user in the kvm group on the host could force this situation to occur, resulting in the host crashing. (CVE-2011-4622)

All KVM users should upgrade to these updated packages, which contain backported patches to correct these issues. Note: The procedure in the Solution section must be performed before this update will take effect.

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A buffer overflow flaw was found in the way the Linux kernel's XFS file system implementation handled links with overly long path names.
A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk. (CVE-2011-4077, Moderate)

* Flaws in ghash_update() and ghash_final() could allow a local, unprivileged user to cause a denial of service. (CVE-2011-4081, Moderate)

* A flaw was found in the Linux kernel's Journaling Block Device (JBD). A local, unprivileged user could use this flaw to crash the system by mounting a specially crafted ext3 or ext4 disk.
(CVE-2011-4132, Moderate)

* It was found that the kvm_vm_ioctl_assign_device() function in the KVM (Kernel-based Virtual Machine) subsystem of a Linux kernel did not check if the user requesting device assignment was privileged or not.
A local, unprivileged user on the host could assign unused PCI devices, or even devices that were in use and whose resources were not properly claimed by the respective drivers, which could result in the host crashing. (CVE-2011-4347, Moderate)

* Two flaws were found in the way the Linux kernel's __sys_sendmsg() function, when invoked via the sendmmsg() system call, accessed user-space memory. A local, unprivileged user could use these flaws to cause a denial of service. (CVE-2011-4594, Moderate)

* The RHSA-2011:1530 kernel update introduced an integer overflow flaw in the Linux kernel. On PowerPC systems, a local, unprivileged user could use this flaw to cause a denial of service. (CVE-2011-4611, Moderate)

* A flaw was found in the way the KVM subsystem of a Linux kernel handled PIT (Programmable Interval Timer) IRQs (interrupt requests) when there was no virtual interrupt controller set up. A local, unprivileged user on the host could force this situation to occur, resulting in the host crashing. (CVE-2011-4622, Moderate)

* A flaw was found in the way the Linux kernel's XFS file system implementation handled on-disk Access Control Lists (ACLs). A local, unprivileged user could use this flaw to cause a denial of service or escalate their privileges by mounting a specially crafted disk.
(CVE-2012-0038, Moderate)

* A flaw was found in the way the Linux kernel's KVM hypervisor implementation emulated the syscall instruction for 32-bit guests. An unprivileged guest user could trigger this flaw to crash the guest.
(CVE-2012-0045, Moderate)

* A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query() function. An attacker able to send certain IGMP (Internet Group Management Protocol) packets to a target system could use this flaw to cause a denial of service. (CVE-2012-0207, Moderate)

Red Hat would like to thank Nick Bowler for reporting CVE-2011-4081;
Sasha Levin for reporting CVE-2011-4347; Tetsuo Handa for reporting CVE-2011-4594; Maynard Johnson for reporting CVE-2011-4611; Wang Xi for reporting CVE-2012-0038; Stephan Barwolf for reporting CVE-2012-0045; and Simon McVittie for reporting CVE-2012-0207.
Upstream acknowledges Mathieu Desnoyers as the original reporter of CVE-2011-4594.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs noted in the Technical Notes. The system must be rebooted for this update to take effect.

Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. (CVE-2011-4127)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. (CVE-2011-1927)

A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. (CVE-2011-0716)

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service.
(CVE-2011-3353)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The linux kernel did not properly account for PTE pages when deciding which task to kill in out of memory conditions. A local, unprivileged could exploit this flaw to cause a denial of service. (CVE-2011-2498)

A flaw was discovered in the TOMOYO LSM's handling of mount system calls. An unprivileged user could oops the system causing a denial of service. (CVE-2011-2518)

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service.
(CVE-2011-3353)

A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system.
(CVE-2011-4097)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044)

A flaw was found in the linux kernels IPv4 IGMP query processing. A remote attacker could exploit this to cause a denial of service.
(CVE-2012-0207).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system.
(CVE-2011-4097)

Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. (CVE-2011-4127)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Andy Whitcroft discovered a that the Overlayfs filesystem was not doing the extended permission checks needed by cgroups and Linux Security Modules (LSMs). A local user could exploit this to by-pass security policy and access files that should not be accessible.
(CVE-2012-0055)

A flaw was found in the linux kernels IPv4 IGMP query processing. A remote attacker could exploit this to cause a denial of service.
(CVE-2012-0207)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0350 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A buffer overflow flaw was found in the way the Linux kernel's XFS file     system implementation handled links with overly long path names. A local,     unprivileged user could use this flaw to cause a denial of service or     escalate their privileges by mounting a specially-crafted disk.
    (CVE-2011-4077, Moderate)

    * Flaws in ghash_update() and ghash_final() could allow a local,     unprivileged user to cause a denial of service. (CVE-2011-4081, Moderate)

    * A flaw was found in the Linux kernel's Journaling Block Device (JBD). A     local, unprivileged user could use this flaw to crash the system by     mounting a specially-crafted ext3 or ext4 disk. (CVE-2011-4132, Moderate)

    * It was found that the kvm_vm_ioctl_assign_device() function in the KVM     (Kernel-based Virtual Machine) subsystem of a Linux kernel did not check if     the user requesting device assignment was privileged or not. A local,     unprivileged user on the host could assign unused PCI devices, or even     devices that were in use and whose resources were not properly claimed by     the respective drivers, which could result in the host crashing.
    (CVE-2011-4347, Moderate)

    * Two flaws were found in the way the Linux kernel's __sys_sendmsg()     function, when invoked via the sendmmsg() system call, accessed user-space     memory. A local, unprivileged user could use these flaws to cause a denial     of service. (CVE-2011-4594, Moderate)

    * The RHSA-2011:1530 kernel update introduced an integer overflow flaw in     the Linux kernel. On PowerPC systems, a local, unprivileged user could use     this flaw to cause a denial of service. (CVE-2011-4611, Moderate)

    * A flaw was found in the way the KVM subsystem of a Linux kernel handled     PIT (Programmable Interval Timer) IRQs (interrupt requests) when there was     no virtual interrupt controller set up. A local, unprivileged user on the     host could force this situation to occur, resulting in the host crashing.
    (CVE-2011-4622, Moderate)

    * A flaw was found in the way the Linux kernel's XFS file system     implementation handled on-disk Access Control Lists (ACLs). A local,     unprivileged user could use this flaw to cause a denial of service or     escalate their privileges by mounting a specially-crafted disk.
    (CVE-2012-0038, Moderate)

    * A flaw was found in the way the Linux kernel's KVM hypervisor     implementation emulated the syscall instruction for 32-bit guests. An     unprivileged guest user could trigger this flaw to crash the guest.
    (CVE-2012-0045, Moderate)

    * A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query()     function. An attacker able to send certain IGMP (Internet Group Management     Protocol) packets to a target system could use this flaw to cause a denial     of service. (CVE-2012-0207, Moderate)

    Red Hat would like to thank Nick Bowler for reporting CVE-2011-4081; Sasha     Levin for reporting CVE-2011-4347; Tetsuo Handa for reporting     CVE-2011-4594; Maynard Johnson for reporting CVE-2011-4611; Wang Xi for     reporting CVE-2012-0038; Stephan Brwolf for reporting CVE-2012-0045; and     Simon McVittie for reporting CVE-2012-0207. Upstream acknowledges Mathieu     Desnoyers as the original reporter of CVE-2011-4594.

    This update also fixes several bugs. Documentation for these changes will     be available shortly from the Technical Notes document linked to in the     References section.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues, and fix the bugs noted in the Technical     Notes. The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system.
(CVE-2011-4097)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Andy Whitcroft discovered a that the Overlayfs filesystem was not doing the extended permission checks needed by cgroups and Linux Security Modules (LSMs). A local user could exploit this to by-pass security policy and access files that should not be accessible.
(CVE-2012-0055)

A flaw was found in the linux kernels IPv4 IGMP query processing. A remote attacker could exploit this to cause a denial of service.
(CVE-2012-0207).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service.
(CVE-2011-3353)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kvm packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Red Hat Enterprise Linux kernel.

A heap overflow flaw was found in the way QEMU-KVM emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network interface is configured to use the e1000 emulated driver could use this flaw to crash the host or, possibly, escalate their privileges on the host. (CVE-2012-0029)

A flaw was found in the way the KVM subsystem of a Linux kernel handled PIT (Programmable Interval Timer) IRQs (interrupt requests) when there was no virtual interrupt controller set up. A malicious user in the kvm group on the host could force this situation to occur, resulting in the host crashing. (CVE-2011-4622)

Red Hat would like to thank Nicolae Mogoreanu for reporting CVE-2012-0029.

All KVM users should upgrade to these updated packages, which contain backported patches to correct these issues. Note: The procedure in the Solution section must be performed before this update will take effect.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-2183     Andrea Righi reported an issue in KSM, a memory-saving     de-duplication feature. By exploiting a race with     exiting tasks, local users can cause a kernel oops,     resulting in a denial of service.

  - CVE-2011-2213     Dan Rosenberg discovered an issue in the INET socket     monitoring interface. Local users could cause a denial     of service by injecting code and causing the kernel to     execute an infinite loop.

  - CVE-2011-2898     Eric Dumazet reported an information leak in the raw     packet socket implementation.

  - CVE-2011-3353     Han-Wen Nienhuys reported a local denial of service     issue in the FUSE (Filesystem in Userspace) support in     the Linux kernel. Local users could cause a buffer     overflow, leading to a kernel oops and resulting in a     denial of service.

  - CVE-2011-4077     Carlos Maiolino reported an issue in the XFS filesystem.
    A local user with the ability to mount a filesystem     could corrupt memory resulting in a denial of service or     possibly gain elevated privileges.

  - CVE-2011-4110     David Howells reported an issue in the kernel's access     key retention system which allow local users to cause a     kernel oops leading to a denial of service.

  - CVE-2011-4127     Paolo Bonzini of Red Hat reported an issue in the ioctl     passthrough support for SCSI devices. Users with     permission to access restricted portions of a device     (e.g. a partition or a logical volume) can obtain access     to the entire device by way of the SG_IO ioctl. This     could be exploited by a local user or privileged VM     guest to achieve a privilege escalation.

  - CVE-2011-4611     Maynard Johnson reported an issue with the perf support     on POWER7 systems that allows local users to cause a     denial of service.

  - CVE-2011-4622     Jan Kiszka reported an issue in the KVM PIT timer     support. Local users with the permission to use KVM can     cause a denial of service by starting a PIT timer     without first setting up the irqchip.

  - CVE-2011-4914     Ben Hutchings reported various bounds checking issues     within the ROSE protocol support in the kernel. Remote     users could possibly use this to gain access to     sensitive memory or cause a denial of service.

- Update to Linux 3.1.9 stable release

    - Fixes CVE-2011-4347, CVE-2011-4622, CVE-2012-0045

    - Other assorted other fixes. This should fix       suspend/resume bugs that are found in 3.1.5/3.1.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Linux 3.1.7 and assorted bugfixes. Should fix suspend/resume regression found in 3.1.5/3.1.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-0350.

ID	Name	Product	Family	Severity
69662	Amazon Linux AMI : kernel (ALAS-2012-55)	Nessus	Amazon Linux Local Security Checks	high
68669	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2003)	Nessus	Oracle Linux Local Security Checks	high
68491	Oracle Linux 6 : kernel (ELSA-2012-0350)	Nessus	Oracle Linux Local Security Checks	high
68434	Oracle Linux 5 : kvm (ELSA-2012-0051)	Nessus	Oracle Linux Local Security Checks	medium
64173	SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 6227 / 6229 / 6230)	Nessus	SuSE Local Security Checks	high
64021	RHEL 5 : kvm (RHSA-2012:0051)	Nessus	Red Hat Local Security Checks	medium
61277	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120306)	Nessus	Scientific Linux Local Security Checks	high
61222	Scientific Linux Security Update : kvm on SL5.x x86_64 (20120123)	Nessus	Scientific Linux Local Security Checks	high
58275	CentOS 6 : kernel (CESA-2012:0350)	Nessus	CentOS Local Security Checks	high
58270	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1389-1)	Nessus	Ubuntu Local Security Checks	high
58269	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1388-1)	Nessus	Ubuntu Local Security Checks	high
58268	Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1387-1)	Nessus	Ubuntu Local Security Checks	high
58267	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1386-1)	Nessus	Ubuntu Local Security Checks	medium
58265	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1384-1)	Nessus	Ubuntu Local Security Checks	high
58261	RHEL 6 : kernel (RHSA-2012:0350)	Nessus	Red Hat Local Security Checks	high
57937	Ubuntu 11.10 : linux vulnerabilities (USN-1363-1)	Nessus	Ubuntu Local Security Checks	high
57936	Ubuntu 11.04 : linux vulnerabilities (USN-1362-1)	Nessus	Ubuntu Local Security Checks	high
57935	Ubuntu 10.10 : linux vulnerabilities (USN-1361-1)	Nessus	Ubuntu Local Security Checks	high
57668	CentOS 5 : kvm (CESA-2012:0051)	Nessus	CentOS Local Security Checks	high
57583	Debian DSA-2389-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	medium
57549	Fedora 15 : kernel-2.6.41.9-1.fc15 (2012-0492)	Nessus	Fedora Local Security Checks	medium
57453	Fedora 16 : kernel-3.1.7-1.fc16 (2012-0145)	Nessus	Fedora Local Security Checks	medium
801513	CentOS RHSA-2012-0350 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2011-4622

medium

Tenable Plugins

high

high

high

medium

high

medium

high

high

high

high

high

high

medium

high

high

high

high

high

high

medium

medium

medium

high