Detections
Analytics
CentOS 6 : kernel (CESA-2016:0494)
medium Nessus Plugin ID 90123
Language:
Synopsis
The remote CentOS host is missing one or more security updates.Description
Updated kernel packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6.Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
* It was found that the fix for CVE-2015-1805 incorrectly kept buffer offset and buffer length in sync on a failed atomic read, potentially resulting in a pipe buffer state corruption. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space. (CVE-2016-0774, Moderate)
The security impact of this issue was discovered by Red Hat.
This update also fixes the following bugs :
* In the anon_vma structure, the degree counts number of child anon_vmas and of VMAs which points to this anon_vma. Failure to decrement the parent's degree in the unlink_anon_vma() function, when its list was empty, previously triggered a BUG_ON() assertion. The provided patch makes sure the anon_vma degree is always decremented when the VMA list is empty, thus fixing this bug. (BZ#1318364)
* When running Internet Protocol Security (IPSEC) on external storage encrypted with LUKS under a substantial load on the system, data corruptions could previously occur. A set of upstream patches has been provided, and data corruption is no longer reported in this situation.
(BZ#1298994)
* Due to prematurely decremented calc_load_task, the calculated load average was off by up to the number of CPUs in the machine. As a consequence, job scheduling worked improperly causing a drop in the system performance. This update keeps the delta of the CPU going into NO_HZ idle separately, and folds the pending idle delta into the global active count while correctly aging the averages for the idle-duration when leaving NO_HZ mode. Now, job scheduling works correctly, ensuring balanced CPU load. (BZ#1300349)
* Due to a regression in the Red Hat Enterprise Linux 6.7 kernel, the cgroup OOM notifier accessed a cgroup-specific internal data structure without a proper locking protection, which led to a kernel panic. This update adjusts the cgroup OOM notifier to lock internal data properly, thus fixing the bug. (BZ#1302763)
* GFS2 had a rare timing window that sometimes caused it to reference an uninitialized variable. Consequently, a kernel panic occurred. The code has been changed to reference the correct value during this timing window, and the kernel no longer panics. (BZ#1304332)
* Due to a race condition whereby a cache operation could be submitted after a cache object was killed, the kernel occasionally crashed on systems running the cachefilesd service. The provided patch prevents the race condition by adding serialization in the code that makes the object unavailable. As a result, all subsequent operations targetted on the object are rejected and the kernel no longer crashes in this scenario. (BZ#1308471)
This update also adds this enhancement :
* The lpfc driver has been updated to version 11.0.0.4. (BZ#1297838)
All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. The system must be rebooted for this update to take effect.
Solution
Update the affected kernel packages.See Also
Plugin Details
Severity: Medium
ID: 90123
File Name: centos_RHSA-2016-0494.nasl
Version: 2.13
Type: local
Agent: unix
Family: CentOS Local Security Checks
Published: 3/24/2016
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 5.6
Temporal Score: 4.1
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C
CVSS Score Source: CVE-2016-0774
CVSS v3
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:centos:centos:kernel-headers, cpe:/o:centos:centos:6, p-cpe:/a:centos:centos:kernel-debug, p-cpe:/a:centos:centos:kernel-abi-whitelists, p-cpe:/a:centos:centos:kernel-firmware, p-cpe:/a:centos:centos:perf, p-cpe:/a:centos:centos:python-perf, p-cpe:/a:centos:centos:kernel, p-cpe:/a:centos:centos:kernel-doc, p-cpe:/a:centos:centos:kernel-debug-devel, p-cpe:/a:centos:centos:kernel-devel
Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 3/23/2016
Vulnerability Publication Date: 4/27/2016
Reference Information
CVE: CVE-2016-0774
RHSA: 2016:0494