The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - COS kernel
  - libxml2

An updated rhev-hypervisor5 package that fixes several security issues and various bugs is now available.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The rhev-hypervisor5 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions.

A heap overflow flaw was found in the way QEMU-KVM emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network interface is configured to use the e1000 emulated driver could use this flaw to crash the host or, possibly, escalate their privileges on the host. (CVE-2012-0029)

A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query() function. An attacker able to send certain IGMP (Internet Group Management Protocol) packets to a target system could use this flaw to cause a denial of service. (CVE-2012-0207)

A double free flaw was discovered in the policy checking code in OpenSSL. A remote attacker could use this flaw to crash an application that uses OpenSSL by providing an X.509 certificate that has specially crafted policy extension data. (CVE-2011-4109)

An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. (CVE-2011-4576)

It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2011-4619)

Red Hat would like to thank Nicolae Mogoreanu for reporting CVE-2012-0029, and Simon McVittie for reporting CVE-2012-0207.

This updated package provides updated components that include fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers :

CVE-2006-1168 and CVE-2011-2716 (busybox issues)

CVE-2009-5029, CVE-2009-5064, CVE-2010-0830 and CVE-2011-1089 (glibc issues)

CVE-2011-1083, CVE-2011-3638, CVE-2011-4086, CVE-2011-4127 and CVE-2012-0028 (kernel issues)

CVE-2011-1526 (krb5 issue)

CVE-2011-4347 (kvm issue)

CVE-2010-4008, CVE-2011-0216, CVE-2011-2834, CVE-2011-3905, CVE-2011-3919 and CVE-2011-1944 (libxml2 issues)

CVE-2011-1749 (nfs-utils issue)

CVE-2011-4108 (openssl issue)

CVE-2011-0010 (sudo issue)

CVE-2011-1675 and CVE-2011-1677 (util-linux issues)

CVE-2010-0424 (vixie-cron issue)

This updated rhev-hypervisor5 package fixes various bugs.
Documentation of these changes will be available shortly in the Technical Notes document :

https://docs.redhat.com/docs/en-US/ Red_Hat_Enterprise_Virtualization_for_Servers/2.2/html/Technical_Notes / index.html

Users of Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which fixes these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0107 advisory.

    - [misc] Move exit_robust_list to mm_release, null lists on cleanup (Laszlo Ersek) [771774 750283]     {CVE-2012-0028}
    - [scsi] fix 32-on-64 block device ioctls (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
    - [dm] do not forward ioctls from logical volumes to the underlying device (Paolo Bonzini) [752385 752386]     {CVE-2011-4127}
    - [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752385 752386]     {CVE-2011-4127}
    - [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
    - [fs] ext4: fix BUG_ON() in ext4_ext_insert_extent() (Lukas Czerner) [747943 747946] {CVE-2011-3638}
    - [fs] jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer (Eric Sandeen) [783477 783284]     {CVE-2011-4086}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0358 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * Using PCI passthrough without interrupt remapping support allowed Xen     hypervisor guests to generate MSI interrupts and thus potentially inject     traps. A privileged guest user could use this flaw to crash the host or     possibly escalate their privileges on the host. The fix for this issue can     prevent PCI passthrough working and guests starting. Refer to Red Hat     Bugzilla bug 715555 for details. (CVE-2011-1898, Important)

    * IPv6 fragment identification value generation could allow a remote     attacker to disrupt a target system's networking, preventing legitimate     users from accessing its services. (CVE-2011-2699, Important)

    * Using the SG_IO ioctl to issue SCSI requests to partitions or LVM volumes     resulted in the requests being passed to the underlying block device. If a     privileged user only had access to a single partition or LVM volume, they     could use this flaw to bypass those restrictions and gain read and write     access (and be able to issue other SCSI commands) to the entire block     device. Refer to Red Hat Knowledgebase article 67869, linked to in the     References, for further details about this issue. (CVE-2011-4127,     Important)

    * A flaw was found in the way the Linux kernel handled robust list pointers     of user-space held futexes across exec() calls. A local, unprivileged user     could use this flaw to cause a denial of service or, eventually, escalate     their privileges. (CVE-2012-0028, Important)

    * A missing boundary check was found in the Linux kernel's HFS file system     implementation. A local attacker could use this flaw to cause a denial of     service or escalate their privileges by mounting a specially-crafted disk.
    (CVE-2011-4330, Moderate)

    Red Hat would like to thank Fernando Gont for reporting CVE-2011-2699, and     Clement Lecigne for reporting CVE-2011-4330.

    This update also fixes the following bugs:

    * Previously, all timers for a Xen fully-virtualized domain were based on     the time stamp counter (TSC) of the underlying physical CPU. This could     cause observed time to go backwards on some hosts. This update moves all     timers except HPET to the Xen monotonic system time, which fixes the bug as     long as the HPET is removed from the configuration of the domain.
    (BZ#773359)

    * Previously, tests of the Microsoft Server Virtualization Validation     Program (SVVP) detected unreliability of the emulated HPET (High     Performance Event Timer) on some hosts. Now, HPET can be configured as a     per-domain configuration option; if it is disabled, the guest chooses a     more reliable timer source. Disabling HPET is suggested for Windows guests,     as well as fully-virtualized Linux guests that show occasional time went     backwards errors in the console. (BZ#773360)

    * SG_IO ioctls were not implemented correctly in the Red Hat Enterprise     Linux 5 virtio-blk driver. Sending an SG_IO ioctl request to a virtio-blk     disk caused the sending thread to enter an uninterruptible sleep state (D     state). With this update, SG_IO ioctls are rejected by the virtio-blk     driver; the ioctl system call simply returns an ENOTTY (Inappropriate     ioctl for device) error and the thread continues normally. (BZ#784658)

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues. The system must be rebooted for this     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - Using the SG_IO ioctl to issue SCSI requests to     partitions or LVM volumes resulted in the requests being     passed to the underlying block device. If a privileged     user only had access to a single partition or LVM     volume, they could use this flaw to bypass those     restrictions and gain read and write access (and be able     to issue other SCSI commands) to the entire block     device. (CVE-2011-4127, Important)

  - A flaw was found in the way the Linux kernel handled     robust list pointers of user-space held futexes across     exec() calls. A local, unprivileged user could use this     flaw to cause a denial of service or, eventually,     escalate their privileges. (CVE-2012-0028, Important)

  - A flaw was found in the Linux kernel in the way     splitting two extents in     ext4_ext_convert_to_initialized() worked. A local,     unprivileged user with the ability to mount and unmount     ext4 file systems could use this flaw to cause a denial     of service. (CVE-2011-3638, Moderate)

  - A flaw was found in the way the Linux kernel's     journal_unmap_buffer() function handled buffer head     states. On systems that have an ext4 file system with a     journal mounted, a local, unprivileged user could use     this flaw to cause a denial of service. (CVE-2011-4086,     Moderate)

  - A divide-by-zero flaw was found in the Linux kernel's     igmp_heard_query() function. An attacker able to send     certain IGMP (Internet Group Management Protocol)     packets to a target system could use this flaw to cause     a denial of service. (CVE-2012-0207, Moderate)

This update also fixes the following bugs :

  - When a host was in recovery mode and a SCSI scan     operation was initiated, the scan operation failed and     provided no error output. This bug has been fixed and     the SCSI layer now waits for recovery of the host to     complete scan operations for devices.

  - SG_IO ioctls were not implemented correctly in the     previous virtio-blk driver. Sending an SG_IO ioctl     request to a virtio-blk disk caused the sending thread     to enter an uninterruptible sleep state ('D' state).
    With this update, SG_IO ioctls are rejected by the     virtio-blk driver: the ioctl system call will simply     return an ENOTTY ('Inappropriate ioctl for device')     error and the thread will continue normally.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

a. ESX third-party update for Service Console kernel

   The ESX Service Console Operating System (COS) kernel is updated    which addresses several security issues in the COS kernel.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-3191, CVE-2011-4348 and CVE-2012-0028 to    these issues.

b. Updated ESX Service Console package libxml2

   The ESX Console Operating System (COS) libxml2 rpms are updated to    the following versions libxml2-2.6.26-2.1.12.el5_7.2 and    libxml2-python-2.6.26-2.1.12.el5_7.2 which addresses several    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-4008, CVE-2011-0216, CVE-2011-1944,    CVE-2011-2834, CVE-2011-3905, CVE-2011-3919 to these issues.

Dan Rosenberg reported errors in the OSS (Open Sound System) MIDI interface. A local attacker on non-x86 systems might be able to cause a denial of service. (CVE-2011-1476)

Dan Rosenberg reported errors in the kernel's OSS (Open Sound System) driver for Yamaha FM synthesizer chips. A local user can exploit this to cause memory corruption, causing a denial of service or privilege escalation. (CVE-2011-1477)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

A flaw was discovered in the Linux kernel's NFSv4 (Network File System version 4) file system. A local, unprivileged user could use this flaw to cause a denial of service by creating a file in a NFSv4 filesystem.
(CVE-2011-4324)

A flaw was found in how the linux kernel handles user-space held futexs. An unprivileged user could exploit this flaw to cause a denial of service or possibly elevate privileges. (CVE-2012-0028).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues and two bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* Using the SG_IO ioctl to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged user only had access to a single partition or LVM volume, they could use this flaw to bypass those restrictions and gain read and write access (and be able to issue other SCSI commands) to the entire block device. Refer to Red Hat Knowledgebase article DOC-67874, linked to in the References, for further details about this issue. (CVE-2011-4127, Important)

* A flaw was found in the way the Linux kernel handled robust list pointers of user-space held futexes across exec() calls. A local, unprivileged user could use this flaw to cause a denial of service or, eventually, escalate their privileges. (CVE-2012-0028, Important)

* A flaw was found in the Linux kernel in the way splitting two extents in ext4_ext_convert_to_initialized() worked. A local, unprivileged user with the ability to mount and unmount ext4 file systems could use this flaw to cause a denial of service.
(CVE-2011-3638, Moderate)

* A flaw was found in the way the Linux kernel's journal_unmap_buffer() function handled buffer head states. On systems that have an ext4 file system with a journal mounted, a local, unprivileged user could use this flaw to cause a denial of service.
(CVE-2011-4086, Moderate)

* A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query() function. An attacker able to send certain IGMP (Internet Group Management Protocol) packets to a target system could use this flaw to cause a denial of service. (CVE-2012-0207, Moderate)

Red Hat would like to thank Zheng Liu for reporting CVE-2011-3638, and Simon McVittie for reporting CVE-2012-0207.

This update also fixes the following bugs :

* When a host was in recovery mode and a SCSI scan operation was initiated, the scan operation failed and provided no error output.
This bug has been fixed and the SCSI layer now waits for recovery of the host to complete scan operations for devices. (BZ#772162)

* SG_IO ioctls were not implemented correctly in the Red Hat Enterprise Linux 5 virtio-blk driver. Sending an SG_IO ioctl request to a virtio-blk disk caused the sending thread to enter an uninterruptible sleep state ('D' state). With this update, SG_IO ioctls are rejected by the virtio-blk driver: the ioctl system call will simply return an ENOTTY ('Inappropriate ioctl for device') error and the thread will continue normally. (BZ#773322)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0107 advisory.

  - kernel: ext4: ext4_ext_insert_extent() kernel oops (CVE-2011-3638)

  - kernel: jbd2: unmapped buffer with _Unwritten or _Delay flags set can lead to DoS (CVE-2011-4086)

  - kernel: possible privilege escalation via SG_IO ioctl (CVE-2011-4127)

  - kernel: futex: clear robust_list on execve (CVE-2012-0028)

  - kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries (CVE-2012-0207)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-0107.

ID	Name	Product	Family	Severity
89109	VMware ESX Service Console Multiple Vulnerabilities (VMSA-2012-0008) (remote check)	Nessus	Misc.	critical
79283	RHEL 5 : rhev-hypervisor5 (RHSA-2012:0168)	Nessus	Red Hat Local Security Checks	high
68454	Oracle Linux 5 : kernel (ELSA-2012-0107)	Nessus	Oracle Linux Local Security Checks	high
64030	RHEL 5 : kernel (RHSA-2012:0358)	Nessus	Red Hat Local Security Checks	high
61241	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120209)	Nessus	Scientific Linux Local Security Checks	high
58903	VMSA-2012-0008 : VMware ESX updates to ESX Service Console	Nessus	VMware ESX Local Security Checks	high
58271	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1390-1)	Nessus	Ubuntu Local Security Checks	high
57922	CentOS 5 : kernel (CESA-2012:0107)	Nessus	CentOS Local Security Checks	high
57885	RHEL 5 : kernel (RHSA-2012:0107)	Nessus	Red Hat Local Security Checks	high
801512	CentOS RHSA-2012-0107 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-0028

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high