The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.

Updated kernel-rt packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise MRG 2.2.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the way Netlink messages without SCM_CREDENTIALS (used for authentication) data set were handled. When not explicitly set, the data was sent but with all values set to 0, including the process ID and user ID, causing the Netlink message to appear as if it were sent with root privileges. A local, unprivileged user could use this flaw to send spoofed Netlink messages to an application, possibly resulting in the application performing privileged operations if it relied on SCM_CREDENTIALS data for the authentication of Netlink messages. (CVE-2012-3520, Important)

* A race condition was found in the way asynchronous I/O and fallocate() interacted when using the ext4 file system. A local, unprivileged user could use this flaw to expose random data from an extent whose data blocks have not yet been written, and thus contain data from a deleted file. (CVE-2012-4508, Important)

* A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2012-2133, Moderate)

* A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511, Moderate)

* A divide-by-zero flaw was found in the TCP Illinois congestion control algorithm implementation in the Linux kernel. If the TCP Illinois congestion control algorithm were in use (the sysctl net.ipv4.tcp_congestion_control variable set to 'illinois'), a local, unprivileged user could trigger this flaw and cause a denial of service. (CVE-2012-4565, Moderate)

* An information leak flaw was found in the uname() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space by setting the UNAME26 personality and then calling the uname() system call.
(CVE-2012-0957, Low)

* Buffer overflow flaws were found in the udf_load_logicalvol() function in the Universal Disk Format (UDF) file system implementation in the Linux kernel. An attacker with physical access to a system could use these flaws to cause a denial of service or escalate their privileges. (CVE-2012-3400, Low)

* A flaw was found in the way the msg_namelen variable in the rds_recvmsg() function of the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation was initialized. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space.
(CVE-2012-3430, Low)

Red Hat would like to thank Pablo Neira Ayuso for reporting CVE-2012-3520; Theodore Ts'o for reporting CVE-2012-4508; Shachar Raindel for reporting CVE-2012-2133; and Kees Cook for reporting CVE-2012-0957. Upstream acknowledges Dmitry Monakhov as the original reporter of CVE-2012-4508. The CVE-2012-4565 issue was discovered by Rodrigo Freire of Red Hat, and the CVE-2012-3430 issue was discovered by the Red Hat InfiniBand team.

This update also fixes multiple bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.2.33-rt50, and correct these issues. The system must be rebooted for this update to take effect.

The Linux kernel was updated to fix various bugs and security issues :

CVE-2013-0871: Race condition in the ptrace functionality in the Linux kernel allowed local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.

CVE-2013-0160: Avoid a side channel attack on /dev/ptmx (keyboard input timing).

CVE-2012-5374: Fixed a local denial of service in the BTRFS hashing code.

CVE-2013-0309: arch/x86/include/asm/pgtable.h in the Linux kernel, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.

CVE-2013-0268: The msr_open function in arch/x86/kernel/msr.c in the Linux kernel allowed local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.

CVE-2012-0957: The override_release function in kernel/sys.c in the Linux kernel allowed local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.

CVE-2013-0216: The Xen netback functionality in the Linux kernel allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.

CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages.
NOTE: some of these details are obtained from third-party information.

CVE-2012-4530: The load_script function in fs/binfmt_script.c in the Linux kernel did not properly handle recursion, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application.

CVE-2012-4508: Race condition in fs/ext4/extents.c in the Linux kernel allowed local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.

CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver in the Linux kernel allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.

CVE-2012-2745: The copy_creds function in kernel/cred.c in the Linux kernel provided an invalid replacement session keyring to a child process, which allowed local users to cause a denial of service (panic) via a crafted application that uses the fork system call.

CVE-2012-3375: The epoll_ctl system call in fs/eventpoll.c in the Linux kernel did not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allowed local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency.

CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.

A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2012-2133 , Moderate)

A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511 , Moderate)

It was found that when running a 32-bit binary that uses a large number of shared libraries, one of the libraries would always be loaded at a predictable address in memory. An attacker could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature. (CVE-2012-1568 , Low)

Buffer overflow flaws were found in the udf_load_logicalvol() function in the Universal Disk Format (UDF) file system implementation in the Linux kernel. An attacker with physical access to a system could use these flaws to cause a denial of service or escalate their privileges.
(CVE-2012-3400 , Low)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2507 advisory.

  - arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used,     does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service     (system crash) via a crafted application. (CVE-2013-0309)

  - The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call. (CVE-2013-0310)

  - The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly     handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging     KVM guest OS privileges. (CVE-2013-0311)

  - The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen     paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows     guest OS users to gain guest OS privileges via a crafted application. (CVE-2013-0228)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP2 kernel was updated to 3.0.58, fixing various bugs and security issues.

The updates contains the following feature enhancement :

  - Enable various md/raid10 and DASD enhancements.

  - Make is possible for RAID10 to cope with DASD devices     being slow for various reasons - the affected device     will be temporarily removed from the array.

  - Added support for reshaping of RAID10 arrays, mdadm     changes will be published to support the changes. The     following security issues were fixed :

  - A division by zero in the TCP Illinois algorithm.
    (CVE-2012-4565)

  - The uname26 personality leaked kernel memory     information. (CVE-2012-0957)

  - Kernel stack content disclosure via binfmt_script     load_script(). (CVE-2012-4530) The following     non-security issues were fixed :

  - BTRFS :

  - btrfs: reset path lock state to zero.

  - btrfs: fix off-by-one in lseek.

  - btrfs: fix btrfs_cont_expand() freeing IS_ERR em.

  - btrfs: update timestamps on truncate().

  - btrfs: put csums on the right ordered extent.

  - btrfs: use existing align macros in btrfs_allocate()

  - btrfs: fix off-by-one error of the reserved size of     btrfs_allocate()

  - btrfs: add fiemaps flag check

  - btrfs: fix permissions of empty files not affected by     umask

  - btrfs: do not auto defrag a file when doing directIO

  - btrfs: fix wrong return value of btrfs_truncate_page()

  - btrfs: Notify udev when removing device

  - btrfs: fix permissions of empty files not affected by     umask

  - btrfs: fix hash overflow handling

  - btrfs: do not delete a subvolume which is in a R/O     subvolume

  - btrfs: remove call to btrfs_wait_ordered_extents to     avoid potential deadlock.

  - btrfs: update the checks for mixed block groups with big     metadata blocks

  - btrfs: Fix use-after-free in __btrfs_end_transaction

  - btrfs: use commit root when loading free space cache.

  - btrfs: avoid setting ->d_op twice (FATE#306586     bnc#731387).

  - btrfs: fix race in reada (FATE#306586).

  - btrfs: do not add both copies of DUP to reada extent     tree

  - btrfs: do not mount when we have a sectorsize unequal to     PAGE_SIZE

  - btrfs: add missing unlocks to transaction abort paths

  - btrfs: avoid sleeping in verify_parent_transid while     atomic

  - btrfs: disallow unequal data/metadata blocksize for     mixed block groups

  - btrfs: enhance superblock sanity checks. (bnc#749651)

  - btrfs: sanitizing ->fs_info, parts 1-5.

  - btrfs: make open_ctree() return int.

  - btrfs: kill pointless reassignment of ->s_fs_info in     btrfs_fill_super().

  - btrfs: merge free_fs_info() calls on fill_super     failures.

  - btrfs: make free_fs_info() call ->kill_sb()     unconditional.

  - btrfs: consolidate failure exits in btrfs_mount() a bit.

  - btrfs: let ->s_fs_info point to fs_info, not root...

  - btrfs: take allocation of ->tree_root into open_ctree().

  - Update DASD blk_timeout patches after review by IBM :

  - dasd: Abort all requests from ioctl

  - dasd: Disable block timeouts per default

  - dasd: Reduce amount of messages for specific errors

  - dasd: Rename ioctls

  - dasd: check blk_noretry_request in dasd_times_out()

  - dasd: lock ccw queue in dasd_times_out()

  - dasd: make DASD_FLAG_TIMEOUT setting more robust

  - dasd: rename flag to abortall

  - LPFC :

  - Update lpfc version for 8.3.5.48.3p driver release.

  - lpfc 8.3.32: Correct successful aborts returning error     status.

  - lpfc 8.3.34: Correct lock handling to eliminate reset     escalation on I/O abort.

  - lpfc 8.3.34: Streamline fcp underrun message printing.

  - DRM/i915 :

  - drm/i915: EBUSY status handling added to     i915_gem_fault().

  - drm/i915: Only clear the GPU domains upon a successful     finish.

  - drm/i915: always use RPNSWREQ for turbo change requests.

  - drm/i915: do not call modeset_init_hw in i915_reset.

  - drm/i915: do not hang userspace when the gpu reset is     stuck.

  - drm/i915: do not trylock in the gpu reset code.

  - drm/i915: re-init modeset hw state after gpu reset.

  - HyperV :

  - x86: Hyper-V: register clocksource only if its     advertised.

  - Other :

  - xfrm: fix freed block size calculation in     xfrm_policy_fini().

  - bonding: in balance-rr mode, set curr_active_slave only     if it is up.

  - kernel: broken interrupt statistics (LTC#87893).

  - kernel: sched_clock() overflow (LTC#87978).

  - mm: call sleep_on_page_killable from
    __wait_on_page_locked_killable.

  - TTY: do not reset masters packet mode.

  - patches.suse/kbuild-record-built-in-o: Avoid using     printf(1) in Makefile.build

  - rpm/built-in-where.mk: Do not rely on the *.parts file     to be newline-separated.

  - NFS: Allow sec=none mounts in certain cases.

  - NFS: fix recent breakage to NFS error handling.

  - bridge: Pull ip header into skb->data before looking     into ip header.

  - dm mpath: allow ioctls to trigger pg init.

  - dm mpath: only retry ioctl when no paths if     queue_if_no_path set.

  - radix-tree: fix preload vector size.

  - sched, rt: Unthrottle rt runqueues in
    __disable_runtime().

  - sched/rt: Fix SCHED_RR across cgroups.

  - sched/rt: Do not throttle when PI boosting.

  - sched/rt: Keep period timer ticking when rt throttling     is active.

  - sched/rt: Prevent idle task boosting.

  - mm: limit mmu_gather batching to fix soft lockups on     !CONFIG_PREEMPT.

  - kabi fixup for mm: limit mmu_gather batching to fix soft     lockups on !CONFIG_PREEMPT.

  - Refresh Xen patches after update to 3.0.57.

  - aio: make kiocb->private NUll in init_sync_kiocb().

  - qeth: Fix retry logic in hardsetup. (LTC#87080)

  - netiucv: reinsert dev_alloc_name for device naming.
    (LTC#87086)

  - qeth: set new mac even if old mac is gone (2).
    (LTC#87138)

  - ocfs2: use spinlock irqsave for downconvert lock.patch.

  - af_netlink: force credentials passing.

  - af_unix: dont send SCM_CREDENTIALS by default.

  - sunrpc: increase maximum slots to use.

  - bio: bio allocation failure due to bio_get_nr_vecs().

  - bio: do not overflow in bio_get_nr_vecs().

  - md: close race between removing and adding a device.

  - thp, memcg: split hugepage for memcg oom on cow.

  - bonding: delete migrated IP addresses from the rlb hash     table.

  - xfs: Fix re-use of EWOULDBLOCK during read on dm-mirror.

  - qla2xxx: Determine the number of outstanding commands     based on available resources.

  - qla2xxx: Ramp down queue depth for attached SCSI     devices.

  - autofs4: fix lockdep splat in autofs.

  - ipv6: tcp: fix panic in SYN processing.

  - add splash=black option to bootsplash code, to keep a     black background, useful for remote access to VMs.

USN-1704-1 fixed vulnerabilities in the Linux kernel. Due to an unrelated regression inotify/fanotify stopped working after upgrading.
This update fixes the problem.

We apologize for the inconvenience.

Brad Spengler discovered a flaw in the Linux kernel's uname system call. An unprivileged user could exploit this flaw to read kernel stack memory. (CVE-2012-0957)

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE feature. On hosts, using qemu userspace, without the XSAVE feature an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem that can expose stale data. An unprivileged user could exploit this flaw to cause an information leak.
(CVE-2012-4508)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents. (CVE-2012-4530)

Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois congestion control algorithm. A local attacker could use this to cause a denial of service. (CVE-2012-4565)

A flaw was discovered in the Linux kernel's handling of new hot-plugged memory. An unprivileged local user could exploit this flaw to cause a denial of service by crashing the system. (CVE-2012-5517)

Florian Weimer discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating source addresses of netlink packets. An untrusted local user can cause a denial of service by causing hypervkvpd to exit. (CVE-2012-5532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brad Spengler discovered a flaw in the Linux kernel's uname system call. An unprivileged user could exploit this flaw to read kernel stack memory. (CVE-2012-0957)

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual machine) subsystem's handling of the XSAVE feature. On hosts, using qemu userspace, without the XSAVE feature an unprivileged local attacker could exploit this flaw to crash the system. (CVE-2012-4461)

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem that can expose stale data. An unprivileged user could exploit this flaw to cause an information leak. (CVE-2012-4508)

A flaw was discovered in the Linux kernel's handling of script execution when module loading is enabled. A local attacker could exploit this flaw to cause a leak of kernel stack contents.
(CVE-2012-4530)

Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois congestion control algorithm. A local attacker could use this to cause a denial of service. (CVE-2012-4565)

A flaw was discovered in the Linux kernel's handling of new hot-plugged memory. An unprivileged local user could exploit this flaw to cause a denial of service by crashing the system. (CVE-2012-5517)

Florian Weimer discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating source addresses of netlink packets. An untrusted local user can cause a denial of service by causing hypervkvpd to exit. (CVE-2012-5532).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brad Spengler discovered a flaw in the Linux kernel's uname system call. An unprivileged user could exploit this flaw to read kernel stack memory. (CVE-2012-0957)

Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois congestion control algorithm. A local attacker could use this to cause a denial of service. (CVE-2012-4565).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brad Spengler discovered a flaw in the Linux kernel's uname system call. An unprivileged user could exploit this flaw to read kernel stack memory. (CVE-2012-0957)

Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois congestion control algorithm. A local attacker could use this to cause a denial of service. (CVE-2012-4565)

The Linux 3.6.3 stable update contains a large number of bug fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Linux 3.6.5 stable update contains a large number of important bugfixes and security fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Linux 3.6.3. Various fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76653	RHEL 6 : MRG (RHSA-2012:1491)	Nessus	Red Hat Local Security Checks	high
74914	openSUSE Security Update : kernel (openSUSE-SU-2013:0396-1)	Nessus	SuSE Local Security Checks	high
69632	Amazon Linux AMI : kernel (ALAS-2012-142)	Nessus	Amazon Linux Local Security Checks	high
68847	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2013-2507)	Nessus	Oracle Linux Local Security Checks	high
64500	SuSE 11.2 Security Update : Linux Kernel (SAT Patch Numbers 7273 / 7276 / 7277)	Nessus	SuSE Local Security Checks	medium
64436	Ubuntu 12.04 LTS : linux-lts-quantal - Linux kernel hardware enablement from Quantal regression (USN-1704-2)	Nessus	Ubuntu Local Security Checks	medium
63669	Ubuntu 12.04 LTS : linux-lts-quantal - Linux kernel hardware enablement from Quantal vulnerabilities (USN-1704-1)	Nessus	Ubuntu Local Security Checks	medium
63124	Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1652-1)	Nessus	Ubuntu Local Security Checks	medium
63121	USN-1649-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	medium
63120	Ubuntu 11.10 : linux vulnerabilities (USN-1648-1)	Nessus	Ubuntu Local Security Checks	medium
63119	USN-1647-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	medium
63118	Ubuntu 12.10 : linux vulnerabilities (USN-1646-1)	Nessus	Ubuntu Local Security Checks	medium
63117	USN-1645-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	medium
63116	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1644-1)	Nessus	Ubuntu Local Security Checks	medium
62864	Fedora 18 : kernel-3.6.3-3.fc18 (2012-16787)	Nessus	Fedora Local Security Checks	medium
62831	Fedora 16 : kernel-3.6.5-2.fc16 (2012-17479)	Nessus	Fedora Local Security Checks	medium
62730	Fedora 17 : kernel-3.6.3-1.fc17 (2012-16669)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-0957

medium

Tenable Plugins

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium