An update for kernel is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. (CVE-2016-5195, Important)

* It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/environ. An unprivileged, local user could potentially use this flaw to escalate their privileges on the system.
(CVE-2016-1583, Important)

Red Hat would like to thank Phil Oester for reporting CVE-2016-5195.

Bug Fix(es) :

* In some cases, a kernel crash or file system corruption occurred when running journal mode 'ordered'. The kernel crash was caused by a NULL pointer dereference due to a race condition between two journal functions. The file system corruption occurred due to a race condition between the do_get_write_access() function and buffer writeout. This update fixes both race conditions. As a result, neither the kernel crash, nor the file system corruption now occur. (BZ#1067708)

* Prior to this update, some Global File System 2 (GFS2) files had incorrect time stamp values due to two problems with handling time stamps of such files. The first problem concerned the atime time stamp, which ended up with an arbitrary value ahead of the actual value, when a GFS2 file was accessed. The second problem was related to the mtime and ctime time stamp updates, which got lost when a GFS2 file was written to from one node and read from or written to from another node. With this update, a set of patches has been applied that fix these problems. As a result, the time stamps of GFS2 files are now handled correctly. (BZ#1374861)

Security Fix(es) :

  - A race condition was found in the way the Linux kernel's     memory subsystem handled the copy-on-write (COW)     breakage of private read-only memory mappings. An     unprivileged, local user could use this flaw to gain     write access to otherwise read-only memory mappings and     thus increase their privileges on the system.
    (CVE-2016-5195, Important)

  - It was found that stacking a file system over procfs in     the Linux kernel could lead to a kernel stack overflow     due to deep nesting, as demonstrated by mounting     ecryptfs over procfs and creating a recursion by mapping     /proc/environ. An unprivileged, local user could     potentially use this flaw to escalate their privileges     on the system. (CVE-2016-1583, Important)

Bug Fix(es) :

  - In some cases, a kernel crash or file system corruption     occurred when running journal mode 'ordered'. The kernel     crash was caused by a NULL pointer dereference due to a     race condition between two journal functions. The file     system corruption occurred due to a race condition     between the do_get_write_access() function and buffer     writeout. This update fixes both race conditions. As a     result, neither the kernel crash, nor the file system     corruption now occur.

  - Prior to this update, some Global File System 2 (GFS2)     files had incorrect time stamp values due to two     problems with handling time stamps of such files. The     first problem concerned the atime time stamp, which     ended up with an arbitrary value ahead of the actual     value, when a GFS2 file was accessed. The second problem     was related to the mtime and ctime time stamp updates,     which got lost when a GFS2 file was written to from one     node and read from or written to from another node. With     this update, a set of patches has been applied that fix     these problems. As a result, the time stamps of GFS2     files are now handled correctly.

This update for the Linux Kernel 3.12.51-52_39 fixes several issues.
The following security bugs were fixed :

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure is initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bsc#984764).

  - CVE-2016-1583: The ecryptfs_privileged_open function in     fs/ecryptfs/kthread.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (stack memory consumption) via vectors involving crafted     mmap calls for /proc pathnames, leading to recursive     pagefault handling (bsc#983144).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relied on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bsc#980883).

  - CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in     the Linux kernel allowed local users to gain privileges     via crafted ASN.1 data (bsc#980856).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bsc#979074).

  - CVE-2015-8816: The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel did not     properly maintain a hub-interface data structure, which     allowed physically proximate attackers to cause a denial     of service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device (bsc#979064).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bsc#971793).

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bsc#973570, bsc#955837).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2016-3955: The usbip_recv_xbuff function in     drivers/usb/usbip/usbip_common.c in the Linux kernel     allowed remote attackers to cause a denial of service     (out-of-bounds write) or possibly have unspecified other     impact via a crafted length value in a USB/IP packet     (bnc#975945).

  - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from kernel heap memory by leveraging     in-container root access to provide a crafted offset     value that leads to crossing a ruleset blob boundary     (bnc#986365).

  - CVE-2015-7513: arch/x86/kvm/x86.c in the Linux kernel     did not reset the PIT counter values during state     restoration, which allowed guest OS users to cause a     denial of service (divide-by-zero error and host OS     crash) via a zero value, related to the     kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions     (bnc#960689).

  - CVE-2013-4312: The Linux kernel allowed local users to     bypass file-descriptor limits and cause a denial of     service (memory consumption) by sending each descriptor     over a UNIX socket before closing it, related to     net/unix/af_unix.c and net/unix/garbage.c (bnc#839104).

  - CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt     implementation in the netfilter subsystem in the Linux     kernel allowed local users to gain privileges or cause a     denial of service (memory corruption) by leveraging     in-container root access to provide a crafted offset     value that triggers an unintended decrement     (bnc#986362).

  - CVE-2016-5829: Multiple heap-based buffer overflows in     the hiddev_ioctl_usage function in     drivers/hid/usbhid/hiddev.c in the Linux kernel allow     local users to cause a denial of service or possibly     have unspecified other impact via a crafted (1)     HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call     (bnc#986572).

  - CVE-2016-4470: The key_reject_and_link function in     security/keys/key.c in the Linux kernel did not ensure     that a certain data structure was initialized, which     allowed local users to cause a denial of service (system     crash) via vectors involving a crafted keyctl request2     command (bnc#984755).

  - CVE-2016-5244: The rds_inc_info_copy function in     net/rds/recv.c in the Linux kernel did not initialize a     certain structure member, which allowed remote attackers     to obtain sensitive information from kernel stack memory     by reading an RDS message (bnc#983213).

  - CVE-2016-1583: The ecryptfs_privileged_open function in     fs/ecryptfs/kthread.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (stack memory consumption) via vectors involving crafted     mmap calls for /proc pathnames, leading to recursive     pagefault handling (bnc#983143).

  - CVE-2016-4913: The get_rock_ridge_filename function in     fs/isofs/rock.c in the Linux kernel mishandled NM (aka     alternate name) entries containing \0 characters, which     allowed local users to obtain sensitive information from     kernel memory or possibly have unspecified other impact     via a crafted isofs filesystem (bnc#980725).

  - CVE-2016-4580: The x25_negotiate_facilities function in     net/x25/x25_facilities.c in the Linux kernel did not     properly initialize a certain data structure, which     allowed attackers to obtain sensitive information from     kernel stack memory via an X.25 Call Request     (bnc#981267).

  - CVE-2016-4805: Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash, or spinlock) or possibly     have unspecified other impact by removing a network     namespace, related to the ppp_register_net_channel and     ppp_unregister_channel functions (bnc#980371).

  - CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in     the Linux kernel allowed local users to gain privileges     via crafted ASN.1 data (bnc#979867).

  - CVE-2015-7833: The usbvision driver in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (panic) via a nonzero bInterfaceNumber value     in a USB device descriptor (bnc#950998).

  - CVE-2016-2187: The gtco_probe function in     drivers/input/tablet/gtco.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#971944).

  - CVE-2016-4482: The proc_connectinfo function in     drivers/usb/core/devio.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via a crafted USBDEVFS_CONNECTINFO ioctl call     (bnc#978401).

  - CVE-2016-4565: The InfiniBand (aka IB) stack in the     Linux kernel incorrectly relies on the write system     call, which allowed local users to cause a denial of     service (kernel memory write operation) or possibly have     unspecified other impact via a uAPI interface     (bnc#979548).

  - CVE-2016-2053: The asn1_ber_decoder function in     lib/asn1_decoder.c in the Linux kernel allowed attackers     to cause a denial of service (panic) via an ASN.1 BER     file that lacks a public key, leading to mishandling by     the public_key_verify_signature function in     crypto/asymmetric_keys/public_key.c (bnc#963762).

  - CVE-2016-4485: The llc_cmsg_rcv function in     net/llc/af_llc.c in the Linux kernel did not initialize     a certain data structure, which allowed attackers to     obtain sensitive information from kernel stack memory by     reading a message (bnc#978821).

  - CVE-2016-4578: sound/core/timer.c in the Linux kernel     did not initialize certain r1 data structures, which     allowed local users to obtain sensitive information from     kernel stack memory via crafted use of the ALSA timer     interface, related to the (1) snd_timer_user_ccallback     and (2) snd_timer_user_tinterrupt functions     (bnc#979879).

  - CVE-2016-4569: The snd_timer_user_params function in     sound/core/timer.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory via crafted use of the ALSA timer interface     (bnc#979213).

  - CVE-2016-4486: The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel did not     initialize a certain data structure, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#978822).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel     did not properly determine the rate of challenge ACK     segments, which made it easier for man-in-the-middle     attackers to hijack TCP sessions via a blind in-window     attack. (bsc#989152)

  - CVE-2016-6480: Race condition in the ioctl_send_fib     function in drivers/scsi/aacraid/commctrl.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds access or system crash) by changing a     certain size value, aka a 'double fetch' vulnerability.
    (bsc#991608)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/ environ. An unprivileged, local user could potentially use this flaw to escalate their privileges on the system.
(CVE-2016-1583, Important)

* It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms.
All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process. (CVE-2016-2143, Moderate)

Bug Fix(es) :

* Use of a multi-threaded workload with high memory mappings sometiems caused a kernel panic, due to a race condition between the context switch and the pagetable upgrade. This update fixes the switch_mm() by using the complete asce parameter instead of the asce_bits parameter.
As a result, the kernel no longer panics in the described scenario.
(BZ#1377472)

* When iptables created the Transmission Control Protocol (TCP) reset packet, a kernel crash could occur due to uninitialized pointer to the TCP header within the Socket Buffer (SKB). This update fixes the transport header pointer in TCP reset for both IPv4 and IPv6, and the kernel no longer crashes in the described situation.(BZ#1372266)

* Previously, when the Enhanced Error Handling (EEH) mechanism did not block the PCI configuration space access and an error was detected, a kernel panic occurred. This update fixes EEH to fix this problem. As a result, the kernel no longer panics in the described scenario.
(BZ#1379596)

* When the lockd service failed to start up completely, the notifier blocks were in some cases registered on a notification chain multiple times, which caused the occurrence of a circular list on the notification chain. Consequently, a soft lock-up or a kernel oops occurred. With this update, the notifier blocks are unregistered if lockd fails to start up completely, and the soft lock-ups or the kernel oopses no longer occur under the described circumstances.
(BZ#1375637)

* When the Fibre Channel over Ethernet (FCoE) was configured, the FCoE MaxFrameSize parameter was incorrectly restricted to 1452. With this update, the NETIF_F_ALL_FCOE symbol is no longer ignored, which fixes this bug. MaxFrameSize is now restricted to 2112, which is the correct value. (BZ#1381592)

* When the fnic driver was installed on Cisco UCS Blade Server, the discs were under certain circumstances put into the offline state with the following error message: 'Medium access timeout failure. Offlining disk!'. This update fixes fnic to set the Small Computer System Interface (SCSI) status as DID_ABORT after a successful abort operation. As a result, the discs are no longer put into the offlined state in the described situation. (BZ#1382620)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - acpi: Disable ACPI table override if securelevel is set     (Linn Crosetto) [Orabug: 25058966] (CVE-2016-3699)

  - aacraid: Check size values after double-fetch from user     (Dave Carroll) [Orabug: 25060060] (CVE-2016-6480)     (CVE-2016-6480)

  - audit: fix a double fetch in audit_log_single_execve_arg     (Paul Moore) [Orabug: 25059969] (CVE-2016-6136)

  - ecryptfs: don't allow mmap when the lower fs doesn't     support it (Jeff Mahoney) [Orabug: 25023269]     (CVE-2016-1583) (CVE-2016-1583)

  - Revert 'ecryptfs: forbid opening files without mmap     handler' (Chuck Anderson) [Orabug: 24971921]     (CVE-2016-1583)

  - percpu: fix synchronization between synchronous map     extension and chunk destruction (Tejun Heo) [Orabug:
    25060084] (CVE-2016-4794)

  - percpu: fix synchronization between     chunk->map_extend_work and chunk destruction (Tejun Heo)     [Orabug: 25060084] (CVE-2016-4794)

  - ALSA: timer: Fix leak in events via     snd_timer_user_tinterrupt (Kangjie Lu) [Orabug:
    25059898] (CVE-2016-4578)

  - ALSA: timer: Fix leak in events via     snd_timer_user_ccallback (Kangjie Lu) [Orabug: 25059898]     (CVE-2016-4578)

  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS     (Kangjie Lu) [Orabug: 25059752] (CVE-2016-4569)

  - Bluetooth: Fix potential NULL dereference in RFCOMM bind     callback (Jaganath Kanakkassery) [Orabug: 25058894]     (CVE-2015-8956)

  - ASN.1: Fix non-match detection failure on data overrun     (David Howells) [Orabug: 25059037] (CVE-2016-2053)

  - mm: migrate dirty page without clear_page_dirty_for_io     etc (Hugh Dickins) [Orabug: 25059188] (CVE-2016-3070)

  - uek-rpm ol7: change uek-rpm/ol7/update-el release value     from 7.1 to 7.3 (Chuck Anderson) [Orabug: 25050614]

Security Fix(es) :

  - It was found that stacking a file system over procfs in     the Linux kernel could lead to a kernel stack overflow     due to deep nesting, as demonstrated by mounting     ecryptfs over procfs and creating a recursion by mapping     /proc/environ. An unprivileged, local user could     potentially use this flaw to escalate their privileges     on the system. (CVE-2016-1583, Important)

  - It was reported that on s390x, the fork of a process     with four page table levels will cause memory corruption     with a variety of symptoms. All processes are created     with three level page table and a limit of 4TB for the     address space. If the parent process has four page table     levels with a limit of 8PB, the function that duplicates     the address space will try to copy memory areas outside     of the address space limit for the child process.
    (CVE-2016-2143, Moderate)

Bug Fix(es) :

  - Use of a multi-threaded workload with high memory     mappings sometiems caused a kernel panic, due to a race     condition between the context switch and the pagetable     upgrade. This update fixes the switch_mm() by using the     complete asce parameter instead of the asce_bits     parameter. As a result, the kernel no longer panics in     the described scenario.

  - When iptables created the Transmission Control Protocol     (TCP) reset packet, a kernel crash could occur due to     uninitialized pointer to the TCP header within the     Socket Buffer (SKB). This update fixes the transport     header pointer in TCP reset for both IPv4 and IPv6, and     the kernel no longer crashes in the described situation.

  - Previously, when the Enhanced Error Handling (EEH)     mechanism did not block the PCI configuration space     access and an error was detected, a kernel panic     occurred. This update fixes EEH to fix this problem. As     a result, the kernel no longer panics in the described     scenario.

  - When the lockd service failed to start up completely,     the notifier blocks were in some cases registered on a     notification chain multiple times, which caused the     occurrence of a circular list on the notification chain.
    Consequently, a soft lock-up or a kernel oops occurred.
    With this update, the notifier blocks are unregistered     if lockd fails to start up completely, and the soft     lock-ups or the kernel oopses no longer occur under the     described circumstances.

  - When the Fibre Channel over Ethernet (FCoE) was     configured, the FCoE MaxFrameSize parameter was     incorrectly restricted to 1452. With this update, the     NETIF_F_ALL_FCOE symbol is no longer ignored, which     fixes this bug. MaxFrameSize is now restricted to 2112,     which is the correct value.

  - When the fnic driver was installed on Cisco UCS Blade     Server, the discs were under certain circumstances put     into the offline state with the following error message:
    'Medium access timeout failure. Offlining disk!'. This     update fixes fnic to set the Small Computer System     Interface (SCSI) status as DID_ABORT after a successful     abort operation. As a result, the discs are no longer     put into the offlined state in the described situation.

ID	Name	Product	Family	Published	Updated	Severity
94409	CentOS 5 : kernel (CESA-2016:2124) (Dirty COW)	Nessus	CentOS Local Security Checks	10/31/2016	3/8/2022	high
94432	Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20161028) (Dirty COW)	Nessus	Scientific Linux Local Security Checks	10/31/2016	3/8/2022	high
93280	SUSE SLES12 Security Update : kernel (SUSE-SU-2016:2010-1)	Nessus	SuSE Local Security Checks	9/2/2016	1/6/2021	high
93370	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2245-1)	Nessus	SuSE Local Security Checks	9/8/2016	1/19/2021	critical
94980	CentOS 6 : kernel (CESA-2016:2766)	Nessus	CentOS Local Security Checks	11/21/2016	1/4/2021	high
95045	OracleVM 3.4 : Unbreakable / etc (OVMSA-2016-0162)	Nessus	OracleVM Local Security Checks	11/22/2016	1/4/2021	high
95050	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20161115)	Nessus	Scientific Linux Local Security Checks	11/22/2016	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

high