Updated 2.4 kernel for pSeries and iSeries fixes vulnerabilities

Updated kernel packages, based on the 2.4.18 kernel, are now available for
Red Hat Linux 7.1 for iSeries and pSeries systems.

Please see the NOTE at the end of the description for important information
about booting the new kernel on your system.

The Linux kernel handles the basic functions of the operating system.

A number of security issues have been found which affect the version of the
Linux kernel shipped for iSeries and pSeries systems:

Al Viro found a security issue in the tty layer whereby any user could
cause a kernel oops. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-0247 to this issue.

Multiple Ethernet Network Interface Card (NIC) device drivers do not pad
frames with null bytes. This allows remote attackers to obtain information
from previous packets or kernel memory by using malformed packets. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2003-0001 to this issue.

The kernel module loader allows local users to gain root privileges by
using ptrace to attach to a child process that is spawned by the kernel.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0127 to this issue.

A flaw has been found in several hash table implementations in the kernel
networking code. A remote attacker could send packets with carefully
chosen, forged source addresses in such a way as to make every routing
cache entry get hashed into the same hash chain. The result would be that
the kernel would use a disproportionate amount of processor time to deal
with new packets, resulting in a remote denial of service attack. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the names CAN-2003-0244 and CAN-2003-0364 to these issues.

NOTE: Installing the kernel RPMs will not automatically prepare the system
to boot the new kernel. Refer to the following sections for the appropriate
instructions to boot the new kernel on your machine.

Preparing to boot the new kernel on iSeries:

After the kernel RPM is installed, the new kernel image file is
/boot/vmlinux. This is a link to the /boot/vmlinux-"version" file (where
"version" is the new kernel's version-release).

Use the installkernel.iSeries command to load the new kernel image into the
"side" from which you want to boot. For instance, to boot from the C side,
use the command:

installkernel.iSeries C /boot/vmlinux

Preparing to boot the new kernel on pSeries:

After the kernel RPM is installed, the new kernel image file is
/boot/vmlinux. This is a link to the /boot/vmlinux-"version" file (where
"version" is the new kernel's version-release).

Edit the /etc/yaboot.conf file to instruct YABOOT to boot the new
kernel. Add a new stanza or change the existing stanza to point to
the new kernel image file. The yaboot.conf man page has detailed
information about the format of the yaboot configuration file.

NOTE: Installing the kernel rpms does not automatically prepare the system
to boot the new kernel. Refer to the Problem Description section for
specific instructions.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Please note that this update is also available via Red Hat Network. Many
people find this to be an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system. Note that you need to select the kernel
explicitly on default configurations of up2date.

76534 - nfs export performance problems
76676 - smbclient reports bad sizes for large files
76720 - smb unable to xfer large files
77288 - LTC1490 - System Map is not included in stock RH kernels.
77348 - LTC1493 - 2.4.9-23.19.6 kernel hangs in ext2_readdir
77702 - LTC1510 - EXT2-fs errors reported during LVT runs.
79286 - LTC1599 - TCE Allocation failure with ACENIC driver causes a panic.
79910 - LTC Bugzilla 1467 - RPC Timeout - rpc.rstad terminates abnormally
79911 - LTC Bugzilla 1495 - Found "doread:read input/output" error using strace command.
79912 - LTC Bugzilla 1470 - No datagrams received from client machine

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0001
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0127
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0247
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0364