Skip to navigation

Security Advisory Important: kernel-rt security and bug fix update

Advisory: RHSA-2009:0451-2
Type: Security Advisory
Severity: Important
Issued on: 2009-04-29
Last updated on: 2009-04-29
Affected Products: Red Hat Enterprise MRG v1 for Red Hat Enterprise Linux (version 5)
CVEs (cve.mitre.org): CVE-2008-4307
CVE-2009-0028
CVE-2009-0834
CVE-2009-0835
CVE-2009-1046
CVE-2009-1337

Details

Updated kernel-rt packages that fix several security issues and a bug are
now available for Red Hat Enterprise MRG 1.1.2.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

These updated packages fix the following security issues:

* a logic error was found in the do_setlk() function of the Linux kernel
Network File System (NFS) implementation. If a signal interrupted a lock
request, the local POSIX lock was incorrectly created. This could cause a
denial of service on the NFS server if a file descriptor was closed before
its corresponding lock request returned. (CVE-2008-4307, Important)

* a deficiency was found in the Linux kernel system call auditing
implementation on 64-bit systems. This could allow a local, unprivileged
user to circumvent a system call audit configuration, if that configuration
filtered based on the "syscall" number or arguments.
(CVE-2009-0834, Important)

* Chris Evans reported a deficiency in the Linux kernel secure-computing
implementation on 64-bit systems. This could allow a local, unprivileged
user to bypass intended access restrictions, if those access restriction
filters were based on the "syscall" number or arguments.
(CVE-2009-0835, Important)

* the exit_notify() function in the Linux kernel did not properly reset the
exit signal if a process executed a set user ID (setuid) application before
exiting. This could allow a local, unprivileged user to elevate their
privileges. (CVE-2009-1337, Important)

* Chris Evans reported a deficiency in the Linux kernel signals
implementation. The clone() system call permits the caller to indicate the
signal it wants to receive when its child exits. When clone() is called
with the CLONE_PARENT flag, it permits the caller to clone a new child that
shares the same parent as itself, enabling the indicated signal to be sent
to the caller's parent (instead of the caller), even if the caller's parent
has different real and effective user IDs. This could lead to a denial of
service of the parent. (CVE-2009-0028, Moderate)

* an off-by-two error was found in the set_selection() function of the
Linux kernel. This could allow a local, unprivileged user to cause a denial
of service when making a selection of characters in a UTF-8 console. Note:
physical console access is required to exploit this issue.
(CVE-2009-1046, Low)

These updated packages also fix the following bug:

* the __scsi_device_lookup_by_target() function was always returning the
first matching device, regardless of the state of the device. This meant
that any valid device listed after a deleted device would not be found. The
__scsi_device_lookup_by_target() function was modified so that deleted
devices are skipped, and valid devices are now found. (BZ#495976)

All Red Hat Enterprise MRG users should install this update, which resolves
these issues. For this update to take effect, the system must be rebooted.


Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

Red Hat Enterprise MRG v1 for Red Hat Enterprise Linux (version 5)

IA-32:
kernel-rt-2.6.24.7-111.el5rt.i686.rpm
File outdated by:  RHBA-2013:0927
    MD5: e1bf85a3798d4cb5ff0f73a083c7aff0
kernel-rt-debug-2.6.24.7-111.el5rt.i686.rpm
File outdated by:  RHBA-2013:0927
    MD5: 423360c67fa87b0721124572d020e05c
kernel-rt-debug-devel-2.6.24.7-111.el5rt.i686.rpm
File outdated by:  RHBA-2013:0927
    MD5: 80d29803684790cdb8c0217bb99ecac2
kernel-rt-devel-2.6.24.7-111.el5rt.i686.rpm
File outdated by:  RHBA-2013:0927
    MD5: 097977c57a18bfb490d46899318636e7
kernel-rt-doc-2.6.24.7-111.el5rt.noarch.rpm
File outdated by:  RHBA-2013:0927
    MD5: 9ffef2b9f18bd335ab3668932ee2f518
kernel-rt-trace-2.6.24.7-111.el5rt.i686.rpm
File outdated by:  RHBA-2013:0927
    MD5: 1eaf6bbf5a4ed239c5a95d28d309c71a
kernel-rt-trace-devel-2.6.24.7-111.el5rt.i686.rpm
File outdated by:  RHBA-2013:0927
    MD5: ed0ce9dd557c3b83d3b40491d7f19f96
kernel-rt-vanilla-2.6.24.7-111.el5rt.i686.rpm
File outdated by:  RHBA-2013:0927
    MD5: 8df5872298db75364b27eda1a7ae8111
kernel-rt-vanilla-devel-2.6.24.7-111.el5rt.i686.rpm
File outdated by:  RHBA-2013:0927
    MD5: 961180a295f1351adb13d6f21ceca6ea
 
x86_64:
kernel-rt-2.6.24.7-111.el5rt.x86_64.rpm
File outdated by:  RHBA-2013:0927
    MD5: be78bafb114666f181a03c7fd4907aa7
kernel-rt-debug-2.6.24.7-111.el5rt.x86_64.rpm
File outdated by:  RHBA-2013:0927
    MD5: f31a8e14947f19882cbc3477c0723ac0
kernel-rt-debug-devel-2.6.24.7-111.el5rt.x86_64.rpm
File outdated by:  RHBA-2013:0927
    MD5: 54a80e9fc24f8536d4a732909cae93ef
kernel-rt-devel-2.6.24.7-111.el5rt.x86_64.rpm
File outdated by:  RHBA-2013:0927
    MD5: 4c1fee6641d6e3d419b7ab688ed33770
kernel-rt-doc-2.6.24.7-111.el5rt.noarch.rpm
File outdated by:  RHBA-2013:0927
    MD5: 9ffef2b9f18bd335ab3668932ee2f518
kernel-rt-trace-2.6.24.7-111.el5rt.x86_64.rpm
File outdated by:  RHBA-2013:0927
    MD5: bf526ac5d0fb3935e4d297f4c14d1c98
kernel-rt-trace-devel-2.6.24.7-111.el5rt.x86_64.rpm
File outdated by:  RHBA-2013:0927
    MD5: e8a3a4b1ec7e17f7e06d0a38c1525872
kernel-rt-vanilla-2.6.24.7-111.el5rt.x86_64.rpm
File outdated by:  RHBA-2013:0927
    MD5: 520185fd8f6299c56cb7864f921de056
kernel-rt-vanilla-devel-2.6.24.7-111.el5rt.x86_64.rpm
File outdated by:  RHBA-2013:0927
    MD5: a31a69ac88a038656dbfb056c1deb3e8
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

456282 - CVE-2008-4307 Kernel BUG() in locks_remove_flock
479932 - CVE-2009-0028 Linux kernel minor signal handling vulnerability
487255 - CVE-2009-0835 kernel: x86-64: seccomp: 32/64 syscall hole
487990 - CVE-2009-0834 kernel: x86-64: syscall-audit: 32/64 syscall hole
491787 - CVE-2009-1046 kernel: utf8 selection memory corruption
493771 - CVE-2009-1337 kernel: exit_notify: kill the wrong capable(CAP_KILL) check


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/