Important: kernel security update

Updated kernel packages that fix various security issues in the Red Hat
Enterprise Linux 4 kernel are now available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

The Linux kernel is the core of the operating system.

These updated kernel packages contain fixes for the following security
issues:

* A flaw was found in the handling of process death signals. This allowed a
local user to send arbitrary signals to the suid-process executed by that
user. A successful exploitation of this flaw depends on the structure of
the suid-program and its signal handling. (CVE-2007-3848, Important)

* A flaw was found in the CIFS file system. This could cause the umask
values of a process to not be honored on CIFS file systems where UNIX
extensions are supported. (CVE-2007-3740, Important)

* A flaw was found in the VFAT compat ioctl handling on 64-bit systems.
This allowed a local user to corrupt a kernel_dirent struct and cause a
denial of service. (CVE-2007-2878, Important)

* A flaw was found in the Advanced Linux Sound Architecture (ALSA). A local
user who had the ability to read the /proc/driver/snd-page-alloc file could
see portions of kernel memory. (CVE-2007-4571, Moderate)

* A flaw was found in the aacraid SCSI driver. This allowed a local user to
make ioctl calls to the driver that should be restricted to privileged
users. (CVE-2007-4308, Moderate)

* A flaw was found in the stack expansion when using the hugetlb kernel on
PowerPC systems. This allowed a local user to cause a denial of service.
(CVE-2007-3739, Moderate)

* A flaw was found in the handling of zombie processes. A local user could
create processes that would not be properly reaped which could lead to a
denial of service. (CVE-2006-6921, Moderate)

* A flaw was found in the CIFS file system handling. The mount option
"sec=" did not enable integrity checking or produce an error message if
used. (CVE-2007-3843, Low)

* A flaw was found in the random number generator implementation that
allowed a local user to cause a denial of service or possibly gain
privileges. This flaw could be exploited if the root user raised the
default wakeup threshold over the size of the output pool.
(CVE-2007-3105, Low)

Additionally, the following bugs were fixed:

* A flaw was found in the kernel netpoll code, creating a potential
deadlock condition. If the xmit_lock for a given network interface is
held, and a subsequent netpoll event is generated from within the lock
owning context (a console message for example), deadlock on that cpu will
result, because the netpoll code will attempt to re-acquire the xmit_lock.
The fix is to, in the netpoll code, only attempt to take the lock, and
fail if it is already acquired (rather than block on it), and queue the
message to be sent for later delivery. Any user of netpoll code in the
kernel (netdump or netconsole services), is exposed to this problem, and
should resolve the issue by upgrading to this kernel release immediately.

* A flaw was found where, under 64-bit mode (x86_64), AMD processors were
not able to address greater than a 40-bit physical address space; and Intel
processors were only able to address up to a 36-bit physical address space.
The fix is to increase the physical addressing for an AMD processor to 48
bits, and an Intel processor to 38 bits. Please see the Red Hat
Knowledgebase for more detailed information.

* A flaw was found in the xenU kernel that may prevent a paravirtualized
guest with more than one CPU from starting when running under an Enterprise
Linux 5.1 hypervisor. The fix is to allow your Enterprise Linux 4 Xen SMP
guests to boot under a 5.1 hypervisor. Please see the Red Hat Knowledgebase
for more detailed information.

Red Hat Enterprise Linux 4 users are advised to upgrade to these updated
packages, which contain backported patches to correct these issues.

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

247726 - CVE-2007-2878 VFAT compat ioctls DoS on 64-bit
248126 - autofs problem with symbolic links
248325 - CVE-2007-3105 Bound check ordering issue in random driver
250972 - CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG
252309 - CVE-2007-4308 Missing ioctl() permission checks in aacraid driver
275881 - CVE-2007-3740 CIFS should honor umask
275901 - CVE-2007-3843 CIFS signing sec= mount options don't work correctly
282351 - [PATCH] Fix memory leak of dma_alloc_coherent() on x86_64
288961 - CVE-2007-4571 ALSA memory disclosure flaw
294941 - CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions
302921 - CVE-2006-6921 denial of service with wedged processes
320791 - EL4.5: Improperly flushed TLBs may lead to Machine check errors

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6921
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2878
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3105
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3739
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3843
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4308
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4571
http://kbase.redhat.com/
http://kbase.redhat.com/faq/FAQ_42_11697.shtm
http://www.redhat.com/security/updates/classification/#important