Skip to navigation

Security Advisory Three security holes fixed in new kernel

Advisory: RHSA-2001:013-06
Type: Security Advisory
Severity: N/A
Issued on: 2001-02-08
Last updated on: 2001-02-09
Affected Products: Red Hat Linux 6.2
Red Hat Linux 7.0
CVEs (cve.mitre.org): CVE-2001-0316
CVE-2001-0317
CVE-2001-1273

Details

Three security holes fixed in new kernel, and several other
updates and bug fixes have been applied as well.

Three security holes have been fixed in the kernel. One involves
ptrace, another involves sysctl, and the last is specific to some
Intel CPUs. All three security holes involve local access only
(they do not provide a hole to remote attackers without a local
account). The ptrace and sysctl bugs provide local users with the
potential to compromise the root account. Neither has an active
exploit available at the time of this writing. The last security
hole is a DOS (Denial Of Service) that does not provide access to
the root account but does allow any user with shell access the
ability to halt the CPU.

All users are strongly recommended to upgrade.

In addition to the security fixes, these kernels contain more
advanced support for the Intel Pentium 4 processors, as well as
a number of driver updates. These updates include e100, sis900,
cs46xx, qla1x160, qla2x00, ServeRAID, and ipvs.

In addition, a number of other bugs have been fixed. Most notably,
the RAW I/O facility could corrupt data under certain usage patterns.


Solution

Upgrade to kernel-2.2.17-14

The procedure for upgrading the kernel is documented at:

http://www.redhat.com/support/docs/howto/kernel-upgrade/kernel-upgrade.html

Please read the directions for your architecture carefully before
proceeding with the kernel upgrade.

Updated packages

Red Hat Linux 6.2

Alpha:
kernel-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: 94a66e9957b5f6183cd2048c37d627e6
kernel-BOOT-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: 4c2de8af30a1f0e7a5df3e0c327ce012
kernel-doc-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: bf44ed30edb776903e362203ed7c790d
kernel-enterprise-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: ae5cda1426dac598d372da0412ec3396
kernel-smp-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: 12bffd53a573138c5f307d5debc7032b
kernel-source-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: accd11c1a755f9ddbccaa3b78868c22d
kernel-utils-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: 28c6d9fb21ad9000ae4014a32c8b7ee0
 
IA-32:
kernel-ibcs-2.2.17-14.i386.rpm
File outdated by:  RHSA-2003:088
    MD5: 1dd67a1bdd6828fc5e68a01ce0941680
 
Sparc:
{filename}     
MD5: e64efcf1d5e1f3c89e019e74c2f807b3
 
Red Hat Linux 7.0

Alpha:
kernel-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: 94a66e9957b5f6183cd2048c37d627e6
kernel-BOOT-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: 4c2de8af30a1f0e7a5df3e0c327ce012
kernel-doc-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: bf44ed30edb776903e362203ed7c790d
kernel-enterprise-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: ae5cda1426dac598d372da0412ec3396
kernel-smp-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: 12bffd53a573138c5f307d5debc7032b
kernel-source-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: accd11c1a755f9ddbccaa3b78868c22d
kernel-utils-2.2.17-14.alpha.rpm
File outdated by:  RHSA-2002:210
    MD5: 28c6d9fb21ad9000ae4014a32c8b7ee0
 
IA-32:
kernel-ibcs-2.2.17-14.i386.rpm
File outdated by:  RHSA-2003:088
    MD5: 1dd67a1bdd6828fc5e68a01ce0941680
 

References

https://www.redhat.com/security/data/cve/CVE-2001-0316.html
https://www.redhat.com/security/data/cve/CVE-2001-0317.html
https://www.redhat.com/security/data/cve/CVE-2001-1273.html
Thanks to Chris Evans for finding the sysctl bug, and to
Solar Designer for the versions of the sysctl and ptrace
patches we used.

Keywords

P4


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/