Skip to navigation

Security Advisory Moderate: lvm2-cluster security update

Advisory: RHSA-2010:0567-1
Type: Security Advisory
Severity: Moderate
Issued on: 2010-07-28
Last updated on: 2010-07-28
Affected Products: RHEL Cluster-Storage (v. 5 server)
CVEs (cve.mitre.org): CVE-2010-2526

Details

An updated lvm2-cluster package that fixes one security issue is now
available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

The lvm2-cluster package contains support for Logical Volume Management
(LVM) in a clustered environment.

It was discovered that the cluster logical volume manager daemon (clvmd)
did not verify the credentials of clients connecting to its control UNIX
abstract socket, allowing local, unprivileged users to send control
commands that were intended to only be available to the privileged root
user. This could allow a local, unprivileged user to cause clvmd to exit,
or request clvmd to activate, deactivate, or reload any logical volume on
the local system or another system in the cluster. (CVE-2010-2526)

Note: This update changes clvmd to use a pathname-based socket rather than
an abstract socket. As such, the lvm2 update RHBA-2010:0569, which changes
LVM to also use this pathname-based socket, must also be installed for LVM
to be able to communicate with the updated clvmd.

All lvm2-cluster users should upgrade to this updated package, which
contains a backported patch to correct this issue. After installing the
updated package, clvmd must be restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

RHEL Cluster-Storage (v. 5 server)

SRPMS:
lvm2-cluster-2.02.56-7.el5_5.4.src.rpm
File outdated by:  RHBA-2014:0021
    MD5: b707da4fd4cd65717f966b843c44c811
SHA-256: 47bdca453a9867b3205af17231260130afe4c18ae94a040a71756ed9d7704213
 
IA-32:
lvm2-cluster-2.02.56-7.el5_5.4.i386.rpm
File outdated by:  RHBA-2014:0021
    MD5: 44c9f06e480fb71aeb3ccd84e912b970
SHA-256: 65cc2a2260a7b1e20f9f6c20f71b539d94906516f266338a180942ba938f8085
 
IA-64:
lvm2-cluster-2.02.56-7.el5_5.4.ia64.rpm
File outdated by:  RHBA-2014:0021
    MD5: 66c35c8a905b835b6798e6b5e8bcb0b9
SHA-256: 9632f4072c2d31d602cb6a2beb4d84d74847aa026eaffff57bab8afd1c2cddd4
 
PPC:
lvm2-cluster-2.02.56-7.el5_5.4.ppc.rpm
File outdated by:  RHBA-2014:0021
    MD5: e371db49208d458c07a5257e946b6c8f
SHA-256: 4fd6b0cc9b44ded43259e24848bfc64e7eefd61a8f97a6f1824900d069f46cf5
 
x86_64:
lvm2-cluster-2.02.56-7.el5_5.4.x86_64.rpm
File outdated by:  RHBA-2014:0021
    MD5: 9c4dd717bfe047111165c75fa61f94b2
SHA-256: 2a2a2b9d6adc84f1093519e6086bebe589b32f71e8ba1e01ab125e5f73910259
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

614248 - CVE-2010-2526 lvm2-cluster: insecurity when communicating between lvm2 and clvmd


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/