The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2007 advisory.

    - regset: Return -EFAULT, not -EIO, on host-side memory fault (H. Peter Anvin)       CVE-2012-1097
    - regset: Prevent null pointer reference on readonly regsets (H. Peter Anvin)       CVE-2012-1097
    - cifs: fix dentry refcount leak when opening a FIFO on lookup (Jeff Layton)       CVE-2012-1090

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0481 advisory.

    - Revert: [fs] NFSv4: include bitmap in nfsv4 get acl data (Sachin Prabhu) [753231 753232] {CVE-2011-4131}
    - [kernel] regset: Return -EFAULT, not -EIO, on host-side memory fault (Jerome Marchand) [799212 799213]     {CVE-2012-1097}
    - [kernel] regset: Prevent null pointer reference on readonly regsets (Jerome Marchand) [799212 799213]     {CVE-2012-1097}
    - [block] Fix io_context leak after failure of clone with CLONE_IO (Vivek Goyal) [796846 791125]     {CVE-2012-0879}
    - [block] Fix io_context leak after clone with CLONE_IO (Vivek Goyal) [796846 791125] {CVE-2012-0879}
    - [fs] cifs: fix dentry refcount leak when opening a FIFO on lookup (Sachin Prabhu) [798298 781893]     {CVE-2012-1090}
    - [fs] NFSv4: include bitmap in nfsv4 get acl data (Sachin Prabhu) [753231 753232] {CVE-2011-4131}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP1 kernel has been updated to the 2.6.32.59 stable release to fix a lot of bugs and security issues.

The following security issues have been fixed :

  - A use after free bug in hugetlb support could be used by     local attackers to crash the system. (CVE-2012-2133)

  - A NULL pointer dereference bug in the regsets proc file     could be used by local attackers to perhaps crash the     system. With mmap_min_addr is set and enabled,     exploitation is unlikely. (CVE-2012-1097)

  - A reference counting issue in CLONE_IO could be used by     local attackers to cause a denial of service (out of     memory). (CVE-2012-0879)

  - A file handle leak in CIFS code could be used by local     attackers to crash the system. (CVE-2012-1090)

  - Large nested epoll chains could be used by local     attackers to cause a denial of service (excessive CPU     consumption). (CVE-2011-1083)

  - When using KVM, programming a PIT timer without a     irqchip configuration, can be used to crash the kvm     guest. This likely can be done only by a privileged     guest user. (CVE-2011-4622)

  - A KVM 32bit guest crash in 'syscall' opcode handling was     fixed that could be caused by local attackers.
    (CVE-2012-0045)

  - Fixed a oops in jbd/jbd2 that could be caused by     specific filesystem access patterns. The following     non-security issues have been fixed:. (CVE-2011-4086)

X86 :

  - x86: fix the initialization of physnode_map.
    (bnc#748112)

  - x86: Allow bootmem reserves at greater than 8G node     offset within a node. (bnc#740895)

  - x86, tsc: Fix SMI induced variation in     quick_pit_calibrate(). (bnc#751322)

  - x86, efi: Work around broken firmware. (bnc#714507)     BONDING :

  - bonding: update speed/duplex for NETDEV_CHANGE.
    (bnc#752634)

  - bonding: comparing a u8 with -1 is always false.
    (bnc#752634)

  - bonding: start slaves with link down for ARP monitor.
    (bnc#752634)

  - bonding: send gratuitous ARP for all addresses     (bnc#752491). XFS :

  - xfs: Fix excessive inode syncing when project quota is     exceeded. (bnc#756448)

  - xfs: Fix oops on IO error during     xlog_recover_process_iunlinks() (bnc#716850). SCSI :

  - scsi/ses: Handle non-unique element descriptors.
    (bnc#749342, bnc#617344)

  - scsi/sd: mark busy sd majors as allocated (bug#744658).

  - scsi: Check for invalid sdev in scsi_prep_state_check()     (bnc#734300). MD/RAID :

  - md: fix possible corruption of array metadata on     shutdown.

  - md: ensure changes to write-mostly are reflected in     metadata. (bnc#755178)

  - md: do not set md arrays to readonly on shutdown     (bnc#740180, bnc#713148, bnc#734900). XEN :

  - smpboot: adjust ordering of operations.

  - x86-64: provide a memset() that can deal with 4Gb or     above at a time. (bnc#738528)

  - blkfront: properly fail packet requests. (bnc#745929)

  - Update Xen patches to 2.6.32.57.

  - xenbus: Reject replies with payload >     XENSTORE_PAYLOAD_MAX.

  - xenbus_dev: add missing error checks to watch handling.

  - Refresh other Xen patches. (bnc#652942, bnc#668194,     bnc#688079)

  - fix Xen-specific kABI issue in Linux 2.6.19. NFS :

  - NFSD: Fill in WCC data for REMOVE, RMDIR, MKNOD, and     MKDIR. (bnc#751880)

  - nfs: Include SYNC flag when comparing mount options with     NOAC flag. (bnc#745422)

  - NFS returns EIO for EDQUOT and others. (bnc#747028)

  - lockd: fix arg parsing for grace_period and timeout.
    (bnc#733761)

  - nfs: allow nfs4leasetime to be set before starting     servers. (bnc#733761)

  - nfs: handle d_revalidate of dot correctly (bnc#731809).
    S/390 :

  - ctcmpc: use correct idal word list for ctcmpc     (bnc#750171,LTC#79264).

  - qeth: synchronize discipline module loading     (bnc#747430,LTC#78788).

  - qdio: avoid race leading to stall when tolerating CQ     (bnc#737326,LTC#76599).

  - kernel: no storage key operations for invalid page table     entries (bnc#737326,LTC#77697). OTHER :

  - tlan: add cast needed for proper 64 bit operation.
    (bnc#756840)

  - dl2k: Tighten ioctl permissions. (bnc#758813)

  - tg3: Fix RSS ring refill race condition. (bnc#757917)

  - usbhid: fix error handling of not enough bandwidth.
    (bnc#704280)

  - pagecache limit: Fix the shmem deadlock. (bnc#755537)

  - tty_audit: fix tty_audit_add_data live lock on audit     disabled. (bnc#721366)

  - ixgbe: driver sets all WOL flags upon initialization so     that machine is powered on as soon at it is switched     off. (bnc#693639)

  - PCI: Set device power state to PCI_D0 for device without     native PM support. (bnc#752972)

  - dlm: Do not allocate a fd for peeloff. (bnc#729247)

  - sctp: Export sctp_do_peeloff. (bnc#729247)

  - epoll: Do not limit non-nested epoll paths. (bnc#676204)

  - mlx4: Limit MSI-X vector allocation. (bnc#624072)

  - mlx4: Changing interrupt scheme. (bnc#624072)

  - mlx4_en: Assigning TX irq per ring. (bnc#624072)

  - mlx4_en: Restoring RX buffer pointer in case of failure.
    (bnc#624072)

  - mlx4_en: using new mlx4 interrupt scheme. (bnc#624072)

  - igb: Fix for Alt MAC Address feature on 82580 and later     devices. (bnc#746980)

  - igb: Power down link when interface is down.
    (bnc#745699)

  - igb: use correct bits to identify if managability is     enabled. (bnc#743209)

  - intel_agp: Do not oops with zero stolen memory.
    (bnc#738679)

  - agp: fix scratch page cleanup. (bnc#738679)

  - hugetlb: add generic definition of NUMA_NO_NODE.
    (bnc#751844)

  - sched: Fix proc_sched_set_task(). (bnc#717994)

  - PM: Print a warning if firmware is requested when tasks     are frozen. (bnc#749886)

  - PM / Sleep: Fix freezer failures due to racy     usermodehelper_is_disabled(). (bnc#749886)

  - PM / Sleep: Fix read_unlock_usermodehelper() call.
    (bnc#749886)

  - firmware loader: allow builtin firmware load even if     usermodehelper is disabled. (bnc#749886)

  - PM / Hibernate: Enable usermodehelpers in     software_resume() error path. (bnc#744163)

  - ipv6: Allow inet6_dump_addr() to handle more than 64     addresses. (bnc#748279)

  - ipv6: fix refcnt problem related to POSTDAD state.
    (bnc#743619)

  - be2net: change to show correct physical link status.
    (bnc#727834)

  - be2net: changes to properly provide phy details.
    (bnc#727834)

  - aio: fix race between io_destroy() and io_submit().
    (bnc#747445 / bnc#611264)

  - intel-iommu: Check for identity mapping candidate using     system dma mask. (bnc#700449)

  - intel-iommu: Dont cache iova above 32bit. (bnc#700449)

  - intel-iommu: Add domain check in     domain_remove_one_dev_info. (bnc#700449)

  - intel-iommu: Provide option to enable 64-bit IOMMU pass     through mode. (bnc#700449)

  - intel-iommu: Remove Host Bridge devices from identity     mapping. (bnc#700449)

  - intel-iommu: Speed up processing of the identity_mapping     function. (bnc#700449)

  - intel-iommu: Use coherent DMA mask when requested.
    (bnc#700449)

  - 1: Fix accounting of softirq time when idle.
    (bnc#719793)

  - driver-core: fix race between device_register and     driver_register. (bnc#742358)

  - dcache: patches.fixes/large-hash-dcache_init-fix.patch:
    Fix oops when initializing large hash on > 16TB machine.
    (bnc#742210)

  - kdump: Save PG_compound or PG_head value in VMCOREINFO.
    (bnc#738503)

  - Update config files: disable NET_9P_RDMA. (bnc#720374)

  - cdc-wdm: fix race leading leading to memory corruption.
    (bnc#759544)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - Numerous reference count leaks were found in the Linux     kernel's block layer I/O context handling     implementation. This could allow a local, unprivileged     user to cause a denial of service. (CVE-2012-0879,     Moderate)

  - A flaw was found in the Linux kernel's cifs_lookup()     implementation. POSIX open during lookup should only be     supported for regular files. When non-regular files (for     example, a named (FIFO) pipe or other special files) are     opened on lookup, it could cause a denial of service.
    (CVE-2012-1090, Moderate)

  - It was found that the Linux kernel's register set     (regset) common infrastructure implementation did not     check if the required get and set handlers were     initialized. A local, unprivileged user could use this     flaw to cause a denial of service by performing a     register set operation with a ptrace() PTRACE_SETREGSET     or PTRACE_GETREGSET request. (CVE-2012-1097, Moderate)

This update also fixes several bugs and adds various enhancements. The system must be rebooted for this update to take effect.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-4086     Eric Sandeen reported an issue in the journaling layer     for ext4 filesystems (jbd2). Local users can cause     buffers to be accessed after they have been torn down,     resulting in a denial of service (DoS) due to a system     crash.

  - CVE-2012-0879     Louis Rilling reported two reference counting issues in     the CLONE_IO feature of the kernel. Local users can     prevent io context structures from being freed,     resulting in a denial of service.

  - CVE-2012-1601     Michael Ellerman reported an issue in the KVM subsystem.
    Local users could cause a denial of service (NULL     pointer dereference) by creating VCPUs before a call to     KVM_CREATE_IRQCHIP.

  - CVE-2012-2123     Steve Grubb reported an issue in fcaps, a     filesystem-based capabilities system. Personality flags     set using this mechanism, such as the disabling of     address space randomization, may persist across suid     calls.

  - CVE-2012-2133     Shachar Raindel discovered a use-after-free bug in the     hugepages quota implementation. Local users with     permission to use hugepages via the hugetlbfs     implementation may be able to cause a denial of service     (system crash).

Updated kernel packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* Numerous reference count leaks were found in the Linux kernel's block layer I/O context handling implementation. This could allow a local, unprivileged user to cause a denial of service. (CVE-2012-0879, Moderate)

* A flaw was found in the Linux kernel's cifs_lookup() implementation.
POSIX open during lookup should only be supported for regular files.
When non-regular files (for example, a named (FIFO) pipe or other special files) are opened on lookup, it could cause a denial of service. (CVE-2012-1090, Moderate)

* It was found that the Linux kernel's register set (regset) common infrastructure implementation did not check if the required get and set handlers were initialized. A local, unprivileged user could use this flaw to cause a denial of service by performing a register set operation with a ptrace() PTRACE_SETREGSET or PTRACE_GETREGSET request. (CVE-2012-1097, Moderate)

Red Hat would like to thank H. Peter Anvin for reporting CVE-2012-1097.

This update also fixes several bugs and adds various enhancements.
Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues, and fix the bugs and add the enhancements noted in the Technical Notes. The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0481 advisory.

  - kernel: sysctl: restrict write access to dmesg_restrict (CVE-2011-4080)

  - kernel: block: CLONE_IO io_context refcounting issues (CVE-2012-0879)

  - kernel: cifs: dentry refcount leak when opening a FIFO on lookup leads to panic on unmount (CVE-2012-1090)

  - kernel: regset: Prevent null pointer reference on readonly regsets (CVE-2012-1097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Louis Rilling discovered a flaw in Linux kernel's clone command when CLONE_IO is specified. An unprivileged local user could exploit this to cause a denial of service.

Louis Rilling discovered a flaw in Linux kernel's clone command when CLONE_IO is specified. An unprivileged local user could exploit this to cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. (CVE-2011-4127)

A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. (CVE-2011-4622)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. (CVE-2012-2100).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS system is missing a security update which has been documented in Red Hat advisory RHSA-2012-0481.

ID	Name	Product	Family	Severity
68670	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2007)	Nessus	Oracle Linux Local Security Checks	high
68515	Oracle Linux 6 : kernel (ELSA-2012-0481)	Nessus	Oracle Linux Local Security Checks	high
64173	SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 6227 / 6229 / 6230)	Nessus	SuSE Local Security Checks	high
61302	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120417)	Nessus	Scientific Linux Local Security Checks	high
59070	Debian DSA-2469-1 : linux-2.6 - privilege escalation/denial of service	Nessus	Debian Local Security Checks	high
58803	CentOS 6 : kernel (CESA-2012:0481)	Nessus	CentOS Local Security Checks	high
58773	RHEL 6 : kernel (RHSA-2012:0481)	Nessus	Red Hat Local Security Checks	high
58590	Ubuntu 10.10 : linux-mvl-dove vulnerability (USN-1415-1)	Nessus	Ubuntu Local Security Checks	medium
58499	Ubuntu 10.04 LTS : linux vulnerability (USN-1411-1)	Nessus	Ubuntu Local Security Checks	medium
58498	Ubuntu 10.04 LTS : linux-ec2 vulnerability (USN-1410-1)	Nessus	Ubuntu Local Security Checks	medium
58496	USN-1408-1 : linux-fsl-imx51 vulnerability	Nessus	Ubuntu Local Security Checks	medium
58270	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1389-1)	Nessus	Ubuntu Local Security Checks	high
801515	CentOS RHSA-2012-0481 Security Check	Log Correlation Engine	Generic	high

Detections

Analytics

CVE-2012-0879

medium

Tenable Plugins

high

high

high

high

high

high

high

medium

medium

medium

medium

high

high