Oracle Linux 4 : kernel (ELSA-2010-0936)

high Nessus Plugin ID 68153

Language:

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

From Red Hat Security Advisory 2010:0936 :

Updated kernel packages that fix two security issues and multiple bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Update 6 December 2010] The package list in this erratum has been updated to include the kernel-doc packages for the IA32 architecture.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security fixes :

* A flaw in sctp_packet_config() in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation could allow a remote attacker to cause a denial of service. (CVE-2010-3432, Important)

* A missing integer overflow check in snd_ctl_new() in the Linux kernel's sound subsystem could allow a local, unprivileged user on a 32-bit system to cause a denial of service or escalate their privileges. (CVE-2010-3442, Important)

Red Hat would like to thank Dan Rosenberg for reporting CVE-2010-3442.

Bug fixes :

* Forward time drift was observed on virtual machines using PM timer-based kernel tick accounting and running on KVM or the Microsoft Hyper-V Server hypervisor. Virtual machines that were booted with the divider=x kernel parameter set to a value greater than 1 and that showed the following in the kernel boot messages were subject to this issue :

time.c: Using PM based timekeeping

Fine grained accounting for the PM timer is introduced which eliminates this issue. However, this fix uncovered a bug in the Xen hypervisor, possibly causing backward time drift. If this erratum is installed in Xen HVM guests that meet the aforementioned conditions, it is recommended that the host use kernel-xen-2.6.18-194.26.1.el5 or newer, which includes a fix (BZ#641915) for the backward time drift.
(BZ#629237)

* With multipath enabled, systems would occasionally halt when the do_cciss_request function was used. This was caused by wrongly-generated requests. Additional checks have been added to avoid the aforementioned issue. (BZ#640193)

* A Sun X4200 system equipped with a QLogic HBA spontaneously rebooted and logged a Hyper-Transport Sync Flood Error to the system event log.
A Maximum Memory Read Byte Count restriction was added to fix this bug. (BZ#640919)

* For an active/backup bonding network interface with VLANs on top of it, when a link failed over, it took a minute for the multicast domain to be rejoined. This was caused by the driver not sending any IGMP join packets. The driver now sends IGMP join packets and the multicast domain is rejoined immediately. (BZ#641002)

* Replacing a disk and trying to rebuild it afterwards caused the system to panic. When a domain validation request for a hot plugged drive was sent, the mptscsi driver did not validate its existence.
This could result in the driver accessing random memory and causing the crash. A check has been added that describes the newly-added device and reloads the iocPg3 data from the firmware if needed.
(BZ#641137)

* An attempt to create a VLAN interface on a bond of two bnx2 adapters in two switch configurations resulted in a soft lockup after a few seconds. This was caused by an incorrect use of a bonding pointer.
With this update, soft lockups no longer occur and creating a VLAN interface works as expected. (BZ#641254)

* Erroneous pointer checks could have caused a kernel panic. This was due to a critical value not being copied when a network buffer was duplicated and consumed by multiple portions of the kernel's network stack. Fixing the copy operation resolved this bug. (BZ#642746)

* A typo in a variable name caused it to be dereferenced in either mkdir() or create() which could cause a kernel panic. (BZ#643342)

* SCSI high level drivers can submit SCSI commands which would never be completed when the device was offline. This was caused by a missing callback for the request to complete the given command. SCSI requests are now terminated by calling their callback when a device is offline.
(BZ#644816)

* A kernel panic could have occurred on systems due to a recursive lock in the 3c59x driver. Recursion is now avoided and this kernel panic no longer occurs. (BZ#648407)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.

Solution

Update the affected kernel packages.

Plugin Details

Severity: High

ID: 68153

File Name: oraclelinux_ELSA-2010-0936.nasl

Version: 1.15

Type: local

Agent: unix

Family: Oracle Linux Local Security Checks

Published: 7/12/2013

Updated: 8/24/2021

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Information

CPE: p-cpe:/a:oracle:linux:kernel-largesmp-devel, p-cpe:/a:oracle:linux:kernel-hugemem-devel, p-cpe:/a:oracle:linux:kernel-devel, cpe:/o:oracle:linux:4, p-cpe:/a:oracle:linux:kernel-hugemem, p-cpe:/a:oracle:linux:kernel-largesmp, p-cpe:/a:oracle:linux:kernel-smp-devel, p-cpe:/a:oracle:linux:kernel-xenu, p-cpe:/a:oracle:linux:kernel-smp, p-cpe:/a:oracle:linux:kernel-doc, p-cpe:/a:oracle:linux:kernel, p-cpe:/a:oracle:linux:kernel-xenu-devel

Required KB Items: Host/local_checks_enabled, Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 12/2/2010

Vulnerability Publication Date: 10/4/2010

Reference Information

CVE: CVE-2010-3432, CVE-2010-3442

BID: 43480, 43787

RHSA: 2010:0936

Detections

Analytics