fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1080 advisory.

    Red Hat OpenStack 3.0 includes a custom Red Hat Enterprise Linux 6.4     kernel. These custom kernel packages include support for network     namespaces, this support is required to facilitate advanced OpenStack     Networking deployments.

    This update fixes the following security issues:

    * A flaw was found in the tcp_read_sock() function in the Linux kernel's     IPv4 TCP/IP protocol suite implementation in the way socket buffers (skb)     were handled. A local, unprivileged user could trigger this issue via a     call to splice(), leading to a denial of service. (CVE-2013-2128,     Moderate)

    * Information leak flaws in the Linux kernel could allow a local,     unprivileged user to leak kernel memory to user-space. (CVE-2012-6548,     CVE-2013-2634, CVE-2013-2635, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225,     Low)

    * An information leak was found in the Linux kernel's POSIX signals     implementation. A local, unprivileged user could use this flaw to bypass     the Address Space Layout Randomization (ASLR) security feature.
    (CVE-2013-0914, Low)

    * A format string flaw was found in the ext3_msg() function in the Linux     kernel's ext3 file system implementation. A local user who is able to mount     an ext3 file system could use this flaw to cause a denial of service or,     potentially, escalate their privileges. (CVE-2013-1848, Low)

    * A format string flaw was found in the b43_do_request_fw() function in the     Linux kernel's b43 driver implementation. A local user who is able to     specify the fwpostfix b43 module parameter could use this flaw to cause a     denial of service or, potentially, escalate their privileges.
    (CVE-2013-2852, Low)

    * A NULL pointer dereference flaw was found in the Linux kernel's ftrace     and function tracer implementations. A local user who has the CAP_SYS_ADMIN     capability could use this flaw to cause a denial of service.
    (CVE-2013-3301, Low)

    Red Hat would like to thank Kees Cook for reporting CVE-2013-2852.

    More information on the Red Hat Enterprise Linux 6.4 kernel packages upon     which these custom kernel packages are based is available in     RHSA-2013:1051:

    https://rhn.redhat.com/errata/RHSA-2013-1051.html

    All Red Hat OpenStack 3.0 users deploying the OpenStack Networking service     are advised to install these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1026 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A buffer overflow flaw was found in the way UTF-8 characters were     converted to UTF-16 in the utf8s_to_utf16s() function of the Linux kernel's     FAT file system implementation. A local user able to mount a FAT file     system with the utf8=1 option could use this flaw to crash the system or,     potentially, to escalate their privileges. (CVE-2013-1773, Important)

    * A flaw was found in the way KVM (Kernel-based Virtual Machine) handled     guest time updates when the buffer the guest registered by writing to the     MSR_KVM_SYSTEM_TIME machine state register (MSR) crossed a page boundary. A     privileged guest user could use this flaw to crash the host or,     potentially, escalate their privileges, allowing them to execute arbitrary     code at the host kernel level. (CVE-2013-1796, Important)

    * A potential use-after-free flaw was found in the way KVM handled guest     time updates when the GPA (guest physical address) the guest registered by     writing to the MSR_KVM_SYSTEM_TIME machine state register (MSR) fell into a     movable or removable memory region of the hosting user-space process (by     default, QEMU-KVM) on the host. If that memory region is deregistered from     KVM using KVM_SET_USER_MEMORY_REGION and the allocated virtual memory     reused, a privileged guest user could potentially use this flaw to escalate     their privileges on the host. (CVE-2013-1797, Important)

    * A flaw was found in the way KVM emulated IOAPIC (I/O Advanced     Programmable Interrupt Controller). A missing validation check in the     ioapic_read_indirect() function could allow a privileged guest user to     crash the host, or read a substantial portion of host kernel memory.
    (CVE-2013-1798, Important)

    * A format string flaw was found in the ext3_msg() function in the Linux     kernel's ext3 file system implementation. A local user who is able to mount     an ext3 file system could use this flaw to cause a denial of service or,     potentially, escalate their privileges. (CVE-2013-1848, Low)

    Red Hat would like to thank Andrew Honig of Google for reporting     CVE-2013-1796, CVE-2013-1797, and CVE-2013-1798.

    This update also fixes several bugs. Documentation for these changes will     be available shortly from the Technical Notes document linked to in the     References section.

    Users should upgrade to these updated packages, which contain backported     patches to correct these issues. The system must be rebooted for this     update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.3 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the way the vhost kernel module handled descriptors that spanned multiple regions. A privileged guest user in a KVM (Kernel-based Virtual Machine) guest could use this flaw to crash the host or, potentially, escalate their privileges on the host.
(CVE-2013-0311, Important)

* A buffer overflow flaw was found in the way UTF-8 characters were converted to UTF-16 in the utf8s_to_utf16s() function of the Linux kernel's FAT file system implementation. A local user able to mount a FAT file system with the 'utf8=1' option could use this flaw to crash the system or, potentially, to escalate their privileges.
(CVE-2013-1773, Important)

* A flaw was found in the way KVM handled guest time updates when the buffer the guest registered by writing to the MSR_KVM_SYSTEM_TIME machine state register (MSR) crossed a page boundary. A privileged guest user could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the host kernel level. (CVE-2013-1796, Important)

* A potential use-after-free flaw was found in the way KVM handled guest time updates when the GPA (guest physical address) the guest registered by writing to the MSR_KVM_SYSTEM_TIME machine state register (MSR) fell into a movable or removable memory region of the hosting user-space process (by default, QEMU-KVM) on the host. If that memory region is deregistered from KVM using KVM_SET_USER_MEMORY_REGION and the allocated virtual memory reused, a privileged guest user could potentially use this flaw to escalate their privileges on the host. (CVE-2013-1797, Important)

* A flaw was found in the way KVM emulated IOAPIC (I/O Advanced Programmable Interrupt Controller). A missing validation check in the ioapic_read_indirect() function could allow a privileged guest user to crash the host, or read a substantial portion of host kernel memory.
(CVE-2013-1798, Important)

* It was found that the default SCSI command filter does not accommodate commands that overlap across device classes. A privileged guest user could potentially use this flaw to write arbitrary data to a LUN that is passed-through as read-only. (CVE-2012-4542, Moderate)

* A use-after-free flaw was found in the tmpfs implementation. A local user able to mount and unmount a tmpfs file system could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1767, Low)

* A format string flaw was found in the ext3_msg() function in the Linux kernel's ext3 file system implementation. A local user who is able to mount an ext3 file system could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2013-1848, Low)

Red Hat would like to thank Andrew Honig of Google for reporting the CVE-2013-1796, CVE-2013-1797, and CVE-2013-1798 issues. The CVE-2012-4542 issue was discovered by Paolo Bonzini of Red Hat.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Updated kernel-rt packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise MRG 2.3.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Security fixes :

* It was found that the kernel-rt update RHBA-2012:0044 introduced an integer conversion issue in the Linux kernel's Performance Events implementation. This led to a user-supplied index into the perf_swevent_enabled array not being validated properly, resulting in out-of-bounds kernel memory access. A local, unprivileged user could use this flaw to escalate their privileges. (CVE-2013-2094, Important)

A public exploit for CVE-2013-2094 that affects Red Hat Enterprise MRG 2 is available. Refer to Red Hat Knowledge Solution 373743, linked to in the References, for further information and mitigation instructions for users who are unable to immediately apply this update.

* An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the Intel i915 driver in the Linux kernel handled the allocation of the buffer used for relocation copies. A local user with console access could use this flaw to cause a denial of service or escalate their privileges. (CVE-2013-0913, Important)

* It was found that the Linux kernel used effective user and group IDs instead of real ones when passing messages with SCM_CREDENTIALS ancillary data. A local, unprivileged user could leverage this flaw with a set user ID (setuid) application, allowing them to escalate their privileges. (CVE-2013-1979, Important)

* A race condition in install_user_keyrings(), leading to a NULL pointer dereference, was found in the key management facility. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2013-1792, Moderate)

* A NULL pointer dereference flaw was found in the Linux kernel's XFS file system implementation. A local user who is able to mount an XFS file system could use this flaw to cause a denial of service.
(CVE-2013-1819, Moderate)

* An information leak was found in the Linux kernel's POSIX signals implementation. A local, unprivileged user could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature.
(CVE-2013-0914, Low)

* A use-after-free flaw was found in the tmpfs implementation. A local user able to mount and unmount a tmpfs file system could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1767, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's USB Inside Out Edgeport Serial Driver implementation. A local user with physical access to a system and with access to a USB device's tty file could use this flaw to cause a denial of service. (CVE-2013-1774, Low)

* A format string flaw was found in the ext3_msg() function in the Linux kernel's ext3 file system implementation. A local user who is able to mount an ext3 file system could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2013-1848, Low)

* A heap-based buffer overflow flaw was found in the Linux kernel's cdc-wdm driver, used for USB CDC WCM device management. An attacker with physical access to a system could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1860, Low)

* A heap-based buffer overflow in the way the tg3 Ethernet driver parsed the vital product data (VPD) of devices could allow an attacker with physical access to a system to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1929, Low)

* Information leaks in the Linux kernel's cryptographic API could allow a local user who has the CAP_NET_ADMIN capability to leak kernel stack memory to user-space. (CVE-2013-2546, CVE-2013-2547, CVE-2013-2548, Low)

* Information leaks in the Linux kernel could allow a local, unprivileged user to leak kernel stack memory to user-space.
(CVE-2013-2634, CVE-2013-2635, CVE-2013-3076, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225, CVE-2013-3231, Low)

Red Hat would like to thank Andy Lutomirski for reporting CVE-2013-1979. CVE-2013-1792 was discovered by Mateusz Guzik of Red Hat EMEA GSS SEG Team.

Linux kernel was updated to kernel 3.4.42 fixing various bugs and security issues.

  - Refresh patches.suse/SUSE-bootsplash. Fix bootsplash     breakage due to stable fix (bnc#813963)

  - Linux 3.4.39.

  - kABI: protect struct tracer.

  - Linux 3.4.38 (bnc#808829,CVE-2013-0913).

  - patches.kabi/kabi-protect-struct-sk_buff.patch: kABI:
    protect struct sk_buff.

  - patches.kabi/kabi-ipv4-remove-inclusion.patch: kABI:
    ipv4, remove inclusion.

  - USB: io_ti: Fix NULL dereference in chase_port()     (bnc#806976, CVE-2013-1774).

  - Linux 3.4.37 (bnc#809155 bnc#809330 bnc#809748     CVE-2013-1848).

  - Linux 3.4.36.

  - KVM: Convert MSR_KVM_SYSTEM_TIME to use     gfn_to_hva_cache_init (bnc#806980 CVE-2013-1797).

  - KVM: Fix bounds checking in ioapic indirect register     read (bnc#806980 CVE-2013-1798).

  - KVM: Fix for buffer overflow in handling of     MSR_KVM_SYSTEM_TIME (bnc#806980 CVE-2013-1796).

  - kabi/severities: Allow kvm abi changes - kvm modules are     self consistent

  - loopdev: fix a deadlock (bnc#809748).

  - block: use i_size_write() in bd_set_size() (bnc#809748).

  - drm/i915: bounds check execbuffer relocation count     (bnc#808829,CVE-2013-0913).

  - TTY: do not reset master's packet mode (bnc#809330).

  - Update patches.fixes/ext3-Fix-format-string-issues.patch     (bnc#809155 CVE-2013-1848).

  - ext3: Fix format string issues (bnc#809155).

  - Linux 3.4.35 (bnc#802153).

  - Linux 3.4.34 (CVE-2013-1763 CVE-2013-1767 bnc#792500     bnc#806138 bnc#805633).

  - tmpfs: fix use-after-free of mempolicy object     (bnc#806138, CVE-2013-1767).

The openSUSE 12.3 kernel was updated to fix various security issues and bugs :

  - config.conf: Disable armv7hl/u8500 until it builds again

  -     patches.fixes/ocfs2-Fix-oops-in-ocfs2_fast_symlink_readp     age: ocfs2: Fix oops in ocfs2_fast_symlink_readpage()     code path

  - drm/nouveau: Fix typo in init_idx_addr_latched()     (bnc#800686).

  - rtl28xxu: Add USB ID for MaxMedia HU394-T (bnc#812113).

  - rtl28xxu: Add USB IDs for Compro VideoMate U620F     (bnc#812113).

  - Support Digivox Mini HD (rtl2832) (bnc#812113).

  - rtl28xxu: correct some device names (bnc#812113).

  - rtl28xxu: add Gigabyte U7300 DVB-T Dongle (bnc#812113).

  - rtl28xxu: [1b80:d3a8] ASUS My Cinema-U3100Mini Plus V2     (bnc#812113).

  - rtl28xxu: add NOXON DAB/DAB+ USB dongle rev 2     (bnc#812113).

  - drm: correctly restore mappings if drm_open fails     (bnc#807850).

  - Drivers: hv: vmbus: Fix a bug in hv_need_to_signal()     (bnc#811417).

  - svcrpc: fix rpc server shutdown races (bnc#802812).

  - Update patches to what was accepted upstream.

  - Refresh     patches.arch/kvm-convert-msr_kvm_system_time-to-use-gfn_     to_hva_cache_init.patch.

  - Refresh     patches.arch/kvm-fix-for-buffer-overflow-in-handling-of-     msr_kvm_system_time.patch.

  - KVM: Convert MSR_KVM_SYSTEM_TIME to use     gfn_to_hva_cache_init (bnc#806980 CVE-2013-1797).

  - KVM: Fix bounds checking in ioapic indirect register     read (bnc#806980 CVE-2013-1798).

  - KVM: Fix for buffer overflow in handling of     MSR_KVM_SYSTEM_TIME (bnc#806980 CVE-2013-1796).

  - kabi/severities: Allow kvm abi changes - kvm modules are     self consistent

  - loopdev: fix a deadlock (bnc#809748).

  - block: use i_size_write() in bd_set_size() (bnc#809748).

  - drm/i915: bounds check execbuffer relocation count     (bnc#808829,CVE-2013-0913).

  - TTY: do not reset master's packet mode (bnc#809330).

  - Update patches.fixes/ext3-Fix-format-string-issues.patch     (bnc#809155 CVE-2013-1848).

  - ext3: Fix format string issues (bnc#809155).

  - Drivers: hv: balloon: Do not request completion     notification (fate#314663).

  - e1000e: fix runtime power management transitions     (bnc#806966).

  - e1000e: fix pci-device enable-counter balance     (bnc#806966).

  - e1000e: fix accessing to suspended device (bnc#806966).

  - gpio-ich: Fix ichx_gpio_check_available() return what     callers expect.

  - gpio/ich: Add missing spinlock init.

  - Refresh     patches.suse/SUSE-bootsplash-mgadrmfb-workaround. Add     the same w/a for ast and cirrus KMS, too (bnc#806990).

  - Fix broken VT1 output with mgadrmfb (bnc#806990).

  - PCI/PM: Clear state_saved during suspend (bnc#806966).

The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.

The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call.

The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.

The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.

The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.

The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.

The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.

net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.

net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2546 advisory.

  - The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows     local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning     CD-ROM drive. (CVE-2013-2164)

  - The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux     kernel before 3.10 do not initialize certain structure members, which allows local users to obtain     sensitive information from kernel heap memory by reading a broadcast message from the notify interface of     an IPSec key_socket. (CVE-2013-2234)

  - The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not     initialize a certain structure member, which allows local users to obtain sensitive information from     kernel heap memory via a crafted application. (CVE-2012-6549)

  - The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove     a prefix string from a syslog header, which allows local users to cause a denial of service (buffer     overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers     function call. (CVE-2013-1772)

  - The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation     in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via     filesystem write operations on a read-only disk that supports the (1) BLKIF_OP_DISCARD (aka discard or     TRIM) or (2) SCSI UNMAP feature. (CVE-2013-2140)

  - The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which     allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or     recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg     function in crypto/algif_skcipher.c. (CVE-2013-3076)

  - The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel     through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had     been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted     application that uses the UDP_CORK option in a setsockopt system call. (CVE-2013-4163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - A flaw was found in the tcp_read_sock() function in the     Linux kernel's IPv4 TCP/IP protocol suite implementation     in the way socket buffers (skb) were handled. A local,     unprivileged user could trigger this issue via a call to     splice(), leading to a denial of service.
    (CVE-2013-2128, Moderate)

  - Information leak flaws in the Linux kernel could allow a     local, unprivileged user to leak kernel memory to     user-space. (CVE-2012-6548, CVE-2013-2634,     CVE-2013-2635, CVE-2013-3222, CVE-2013-3224,     CVE-2013-3225, Low)

  - An information leak was found in the Linux kernel's     POSIX signals implementation. A local, unprivileged user     could use this flaw to bypass the Address Space Layout     Randomization (ASLR) security feature. (CVE-2013-0914,     Low)

  - A format string flaw was found in the ext3_msg()     function in the Linux kernel's ext3 file system     implementation. A local user who is able to mount an     ext3 file system could use this flaw to cause a denial     of service or, potentially, escalate their privileges.
    (CVE-2013-1848, Low)

  - A format string flaw was found in the     b43_do_request_fw() function in the Linux kernel's b43     driver implementation. A local user who is able to     specify the 'fwpostfix' b43 module parameter could use     this flaw to cause a denial of service or, potentially,     escalate their privileges. (CVE-2013-2852, Low)

  - A NULL pointer dereference flaw was found in the Linux     kernel's ftrace and function tracer implementations. A     local user who has the CAP_SYS_ADMIN capability could     use this flaw to cause a denial of service.
    (CVE-2013-3301, Low)

The system must be rebooted for this update to take effect.

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

* A flaw was found in the tcp_read_sock() function in the Linux kernel's IPv4 TCP/IP protocol suite implementation in the way socket buffers (skb) were handled. A local, unprivileged user could trigger this issue via a call to splice(), leading to a denial of service.
(CVE-2013-2128, Moderate)

* Information leak flaws in the Linux kernel could allow a local, unprivileged user to leak kernel memory to user-space. (CVE-2012-6548, CVE-2013-2634, CVE-2013-2635, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225, Low)

* An information leak was found in the Linux kernel's POSIX signals implementation. A local, unprivileged user could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature.
(CVE-2013-0914, Low)

* A format string flaw was found in the ext3_msg() function in the Linux kernel's ext3 file system implementation. A local user who is able to mount an ext3 file system could use this flaw to cause a denial of service or, potentially, escalate their privileges.
(CVE-2013-1848, Low)

* A format string flaw was found in the b43_do_request_fw() function in the Linux kernel's b43 driver implementation. A local user who is able to specify the 'fwpostfix' b43 module parameter could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-2852, Low)

* A NULL pointer dereference flaw was found in the Linux kernel's ftrace and function tracer implementations. A local user who has the CAP_SYS_ADMIN capability could use this flaw to cause a denial of service. (CVE-2013-3301, Low)

Red Hat would like to thank Kees Cook for reporting CVE-2013-2852.

This update also fixes several bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section.

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1051 advisory.

  - fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain     circumstances related to printk input, which allows local users to conduct format-string attacks and     possibly gain privileges via a crafted application. (CVE-2013-1848)

  - The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value     of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the     ASLR protection mechanism via a crafted application containing a sigaction system call. (CVE-2013-0914)

  - The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a     certain length variable, which allows local users to obtain sensitive information from kernel stack memory     via a crafted recvmsg or recvfrom system call. (CVE-2013-3222)

  - The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not     properly initialize a certain length variable, which allows local users to obtain sensitive information     from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3224)

  - The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain     structure member, which allows local users to obtain sensitive information from kernel heap memory via a     crafted application. (CVE-2012-6548)

  - The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage     skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice     system call for a TCP socket. (CVE-2013-2128)

  - net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows     local users to obtain sensitive information from kernel stack memory via a crafted application.
    (CVE-2013-2634)

  - The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize     a certain structure member, which allows local users to obtain sensitive information from kernel stack     memory via a crafted application. (CVE-2013-2635)

  - Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the     Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by     leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading     to improper construction of an error message. (CVE-2013-2852)

  - The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does     not initialize a certain length variable, which allows local users to obtain sensitive information from     kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3225)

  - The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the     CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and     then making an lseek system call. (CVE-2013-3301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2525 advisory.

  - The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return     value in certain circumstances, which allows local users to obtain sensitive information from kernel stack     memory via a crafted application that leverages an uninitialized pointer argument. (CVE-2012-6542)

  - Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the     Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system     crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital     Product Data (VPD) data structure. (CVE-2013-1929)

  - Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux     kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or     possibly execute arbitrary code via a crafted cdc-wdm USB device. (CVE-2013-1860)

  - fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain     circumstances related to printk input, which allows local users to conduct format-string attacks and     possibly gain privileges via a crafted application. (CVE-2013-1848)

  - The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and     gid values during credentials passing, which allows local users to gain privileges via a crafted     application. (CVE-2013-1979)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in the Linux kernel :

The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application. (CVE-2013-1979)

The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3232)

net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
(CVE-2013-3235)

The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3234)

The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3233)

The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3231)

The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
(CVE-2013-3229)

The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
(CVE-2013-3228)

The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3227)

The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3225)

The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3224)

The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3223)

The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. (CVE-2013-3222)

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
(CVE-2013-2596)

arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit. (CVE-2013-2146)

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call. (CVE-2013-2094)

The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application. (CVE-2013-1798)

Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation. (CVE-2013-1797)

The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application. (CVE-2013-1796)

The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
(CVE-2013-2141)

Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure. (CVE-2013-1929)

The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669. (CVE-2012-5532)

The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application. (CVE-2012-6548)

The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application. (CVE-2012-6549)

net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
(CVE-2013-2634)

The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. (CVE-2013-2635)

fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application. (CVE-2013-1848)

The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call. (CVE-2013-0914)

Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device. (CVE-2013-1860)

Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads. (CVE-2013-1792)

The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.
(CVE-2013-2546)

The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability. (CVE-2013-2547)

The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability. (CVE-2013-2548)

The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges. (CVE-2013-0311)

Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message. (CVE-2013-1763)

The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
(CVE-2013-0290)

Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option. (CVE-2013-1767)

The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.
(CVE-2013-0228)

Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions. (CVE-2013-0217)

The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption. (CVE-2013-0216)

The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. (CVE-2012-6547)

The updated packages provides a solution for these security issues.

Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548)

Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6549)

An integer overflow was discovered in the Direct Rendering Manager (DRM) subsystem for the i915 video driver in the Linux kernel. A local user could exploit this flaw to cause a denial of service (crash) or potentially escalate privileges. (CVE-2013-0913)

Andrew Honig discovered a flaw in guest OS time updates in the Linux kernel's KVM (Kernel-based Virtual Machine). A privileged guest user could exploit this flaw to cause a denial of service (crash host system) or potential escalate privilege to the host kernel level.
(CVE-2013-1796)

Andrew Honig discovered a use after free error in guest OS time updates in the Linux kernel;s KVM (Kernel-based Virtual Machine). A privileged guest user could exploit this flaw to escalate privilege to the host kernel level. (CVE-2013-1797)

Andrew Honig reported a flaw in the way KVM (Kernel-based Virtual Machine) emulated the IOAPIC. A privileged guest user could exploit this flaw to read host memory or cause a denial of service (crash the host). (CVE-2013-1798)

A format-string bug was discovered in the Linux kernel's ext3 filesystem driver. A local user could exploit this flaw to possibly escalate privileges on the system. (CVE-2013-1848)

A buffer overflow was discovered in the Linux Kernel's USB subsystem for devices reporting the cdc-wdm class. A specially crafted USB device when plugged-in could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2013-1860)

An information leak in the Linux kernel's dcb netlink interface was discovered. A local user could obtain sensitive information by examining kernel stack memory. (CVE-2013-2634)

A kernel stack information leak was discovered in the RTNETLINK component of the Linux kernel. A local user could read sensitive information from the kernel stack. (CVE-2013-2635).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mathias Krause discovered an information leak in the Linux kernel's UDF file system implementation. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6548)

Mathias Krause discovered an information leak in the Linux kernel's ISO 9660 CDROM file system driver. A local user could exploit this flaw to examine some of the kernel's heap memory. (CVE-2012-6549)

An integer overflow was discovered in the Direct Rendering Manager (DRM) subsystem for the i915 video driver in the Linux kernel. A local user could exploit this flaw to cause a denial of service (crash) or potentially escalate privileges. (CVE-2013-0913)

Andrew Honig discovered a flaw in guest OS time updates in the Linux kernel's KVM (Kernel-based Virtual Machine). A privileged guest user could exploit this flaw to cause a denial of service (crash host system) or potentially escalate privilege to the host kernel level.
(CVE-2013-1796)

Andrew Honig discovered a use after free error in guest OS time updates in the Linux kernel's KVM (Kernel-based Virtual Machine). A privileged guest user could exploit this flaw to escalate privilege to the host kernel level. (CVE-2013-1797)

Andrew Honig reported a flaw in the way KVM (Kernel-based Virtual Machine) emulated the IOAPIC. A privileged guest user could exploit this flaw to read host memory or cause a denial of service (crash the host). (CVE-2013-1798)

A format-string bug was discovered in the Linux kernel's ext3 filesystem driver. A local user could exploit this flaw to possibly escalate privileges on the system. (CVE-2013-1848)

A buffer overflow was discovered in the Linux Kernel's USB subsystem for devices reporting the cdc-wdm class. A specially crafted USB device when plugged-in could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2013-1860)

An information leak in the Linux kernel's dcb netlink interface was discovered. A local user could obtain sensitive information by examining kernel stack memory. (CVE-2013-2634)

A kernel stack information leak was discovered in the RTNETLINK component of the Linux kernel. A local user could read sensitive information from the kernel stack. (CVE-2013-2635).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
210186	RHEL 6 : kernel (RHSA-2013:1080)	Nessus	Red Hat Local Security Checks	medium
78964	RHEL 6 : kernel (RHSA-2013:1026)	Nessus	Red Hat Local Security Checks	high
78963	RHEL 6 : kernel (RHSA-2013:0928)	Nessus	Red Hat Local Security Checks	medium
76660	RHEL 6 : MRG (RHSA-2013:0829)	Nessus	Red Hat Local Security Checks	high
75012	openSUSE Security Update : kernel (openSUSE-SU-2013:0824-1)	Nessus	SuSE Local Security Checks	high
74985	openSUSE Security Update : kernel (openSUSE-SU-2013:0923-1)	Nessus	SuSE Local Security Checks	high
70222	Amazon Linux AMI : kernel (ALAS-2013-218)	Nessus	Amazon Linux Local Security Checks	medium
69942	Oracle Linux 5 / 6 : Unbreakable Enterprise Kernel (ELSA-2013-2546)	Nessus	Oracle Linux Local Security Checks	high
68945	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20130716)	Nessus	Scientific Linux Local Security Checks	medium
68940	CentOS 6 : kernel (CESA-2013:1051)	Nessus	CentOS Local Security Checks	medium
68921	RHEL 6 : kernel (RHSA-2013:1051)	Nessus	Red Hat Local Security Checks	medium
68920	Oracle Linux 6 : kernel (ELSA-2013-1051)	Nessus	Oracle Linux Local Security Checks	medium
68855	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel Security (ELSA-2013-2525)	Nessus	Oracle Linux Local Security Checks	high
66975	Mandriva Linux Security Advisory : kernel (MDVSA-2013:176)	Nessus	Mandriva Local Security Checks	high
66344	SuSE 11.2 Security Update : Linux kernel (SAT Patch Numbers 7667 / 7669 / 7675)	Nessus	SuSE Local Security Checks	high
66302	Ubuntu 12.10 : linux vulnerabilities (USN-1813-1)	Nessus	Ubuntu Local Security Checks	high
66292	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-1812-1)	Nessus	Ubuntu Local Security Checks	high
66291	Ubuntu 12.04 LTS : linux vulnerabilities (USN-1809-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2013-1848

high

Tenable Plugins

medium

high

medium

high

high

high

medium

high

medium

medium

medium

medium

high

high

high

high

high

high