SuSE: 2011-015: Linux kernel Security Update
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Announcement
Package: kernel
Announcement ID: SUSE-SA:2011:015
Date: Thu, 24 Mar 2011 16:00:00 +0000
Affected Products: SLE SDK 10 SP3
SUSE Linux Enterprise Desktop 10 SP3
SUSE Linux Enterprise Server 10 SP3
Vulnerability Type: remote denial of service
CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
SUSE Default Package: yes
Cross-References: CVE-2010-1173, CVE-2010-3875, CVE-2010-3876
CVE-2010-3877, CVE-2010-4075, CVE-2010-4076
CVE-2010-4077, CVE-2010-4163, CVE-2010-4242
CVE-2010-4248, CVE-2010-4342, CVE-2010-4526
CVE-2010-4527, CVE-2010-4529, CVE-2010-4655
CVE-2010-4668, CVE-2011-0521, CVE-2011-0710
CVE-2011-0711
Content of This Advisory:
1) Security Vulnerability Resolved:
Linux kernel security update
Problem Description
2) Solution or Work-Around
3) Special Instructions and Notes
4) Package Location and Checksums
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
See SUSE Security Summary Report.
6) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Problem Description and Brief Discussion
This kernel update for the SUSE Linux Enterprise 10 SP3 kernel fixes several
security issues and bugs.
Following security issues were fixed:
CVE-2010-4655: A memory leak in the ethtool ioctl was fixed that could
disclose kernel memory to local attackers with CAP_NET_ADMIN privileges.
CVE-2011-0521: The dvb_ca_ioctl function in
drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel did not check
the sign of a certain integer field, which allowed local users to cause
a denial of service (memory corruption) or possibly have unspecified
other impact via a negative value.
CVE-2010-3875: The ax25_getname function in net/ax25/af_ax25.c in the
Linux kernel did not initialize a certain structure, which allowed
local users to obtain potentially sensitive information from kernel
stack memory by reading a copy of this structure.
CVE-2010-3876: net/packet/af_packet.c in the Linux kernel did not properly
initialize certain structure members, which allowed local users to obtain
potentially sensitive information from kernel stack memory by leveraging
the CAP_NET_RAW capability to read copies of the applicable structures.
CVE-2010-3877: The get_name function in net/tipc/socket.c in the Linux
kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory by
reading a copy of this structure.
CVE-2011-0711: A stack memory information leak in the xfs FSGEOMETRY_V1
ioctl was fixed.
CVE-2011-0710: The task_show_regs function in arch/s390/kernel/traps.c
in the Linux kernel on the s390 platform allowed local users to obtain
the values of the registers of an arbitrary process by reading a status
file under /proc/.
CVE-2010-1173: The sctp_process_unk_param function in
net/sctp/sm_make_chunk.c in the Linux kernel, when SCTP is enabled,
allowed remote attackers to cause a denial of service (system crash)
via an SCTPChunkInit packet containing multiple invalid parameters that
require a large amount of error data.
CVE-2010-4075: The uart_get_count function in drivers/serial/serial_core.c
in the Linux kernel did not properly initialize a certain structure
member, which allowed local users to obtain potentially sensitive
information from kernel stack memory via a TIOCGICOUNT ioctl call.
CVE-2010-4076: The rs_ioctl function in drivers/char/amiserial.c in the
Linux kernel did not properly initialize a certain structure member,
which allowed local users to obtain potentially sensitive information
from kernel stack memory via a TIOCGICOUNT ioctl call.
CVE-2010-4077: The ntty_ioctl_tiocgicount function in
drivers/char/nozomi.c in the Linux kernel did not properly initialize a
certain structure member, which allowed local users to obtain potentially
sensitive information from kernel stack memory via a TIOCGICOUNT ioctl
call.
CVE-2010-4527: The load_mixer_volumes function in sound/oss/soundcard.c
in the OSS sound subsystem in the Linux kernel incorrectly expected
that a certain name field ends with a '0' character, which allowed
local users to conduct buffer overflow attacks and gain privileges,
or possibly obtain sensitive information from kernel memory, via a
SOUND_MIXER_SETLEVELS ioctl call.
CVE-2010-4248: Race condition in the __exit_signal function in
kernel/exit.c in the Linux kernel allowed local users to cause a denial
of service via vectors related to multi threaded exec, the use of a thread
group leader in kernel/posix-cpu-timers.c, and the selection of a new
thread group leader in the de_thread function in fs/exec.c.
CVE-2010-4668: The blk_rq_map_user_iov function in block/blk-map.c
in the Linux kernel allowed local users to cause a denial of service
(panic) via a zero-length I/O request in a device ioctl to a SCSI device,
related to an unaligned map. NOTE: this vulnerability exists because of
an incomplete fix for CVE-2010-4163.
CVE-2010-4242: The hci_uart_tty_open function in the HCI UART driver
(drivers/bluetooth/hci_ldisc.c) in the Linux kernel did not verify
whether the tty has a write operation, which allowed local users to cause
a denial of service (NULL pointer dereference) via vectors related to
the Bluetooth driver.
CVE-2010-4529: Integer underflow in the irda_getsockopt function in
net/irda/af_irda.c in the Linux kernel on platforms other than x86
allowed local users to obtain potentially sensitive information from
kernel heap memory via an IRLMP_ENUMDEVICES getsockopt call.
CVE-2010-4342: The aun_incoming function in net/econet/af_econet.c in
the Linux kernel, when Econet is enabled, allowed remote attackers to
cause a denial of service (NULL pointer dereference and OOPS) by sending
an Acorn Universal Networking (AUN) packet over UDP.
CVE-2010-4526: Race condition in the sctp_icmp_proto_unreachable function
in net/sctp/input.c in Linux kernel allowed remote attackers to cause
a denial of service (panic) via an ICMP unreachable message to a socket
that is already locked by a user, which causes the socket to be freed and
triggers list corruption, related to the sctp_wait_for_connect function.
2) Solution or Work-Around
There is no known workaround, please install the update packages.
3) Special Instructions and Notes
Please reboot the machine after installing the update.
4) Package Location and Checksums
The preferred method for installing security updates is to use the YaST
"Online Update" module or the "zypper" commandline tool. The package and
patch management stack will detect which updates are required and
automatically perform the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command
rpm -Fhv
References
