Skip to navigation

Security Advisory Important: kernel-rt security and bug fix update

Advisory: RHSA-2012:0670-1
Type: Security Advisory
Severity: Important
Issued on: 2012-05-15
Last updated on: 2012-05-15
Affected Products: Red Hat Enterprise MRG v2 for Red Hat Enterprise Linux (version 6)
CVEs (cve.mitre.org): CVE-2011-4086
CVE-2012-2123

Details

Updated kernel-rt packages that fix two security issues and various bugs
are now available for Red Hat Enterprise MRG 2.1.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issues:

* When a set user ID (setuid) application is executed, certain personality
flags for controlling the application's behavior are cleared (that is, a
privileged application will not be affected by those flags). It was found
that those flags were not cleared if the application was made privileged
via file system capabilities. A local, unprivileged user could use this
flaw to change the behavior of such applications, allowing them to bypass
intended restrictions. Note that for default installations, no application
shipped by Red Hat for Red Hat Enterprise MRG is made privileged via file
system capabilities. (CVE-2012-2123, Important)

* A flaw was found in the way the Linux kernel's journal_unmap_buffer()
function handled buffer head states. On systems that have an ext4 file
system with a journal mounted, a local, unprivileged user could use this
flaw to cause a denial of service. (CVE-2011-4086, Moderate)

This update also fixes the following bugs:

* The CAP_SYS_ADMIN check was missing from the dmesg_restrict feature.
Consequently, an unprivileged and jailed root user could bypass the
dmesg_restrict protection. This update adds CAP_SYS_ADMIN to both
dmesg_restrict and kptr_restrict, which only allows writing to
dmesg_restrict when root has CAP_SYS_ADMIN. (BZ#808271)

* Previously, the _copy_from_pages() function, which is used to copy data
from the temporary buffer to the user-passed buffer, was passed the wrong
size parameter when copying data. Consequently, if the user provided a
buffer greater than PAGE_SIZE, the getxattr() syscalls were handled
incorrectly. This update fixes _copy_from_pages() to use the ACL length,
which uses a correctly-sized buffer. (BZ#753230)

* Some older versions of hardware or their software could not recognize
certain commands and would log messages for illegal or unsupported errors
the driver could not properly handle. This bug has been fixed and no bogus
error messages are now returned in the described scenario. (BZ#813892)

* Previously, the qla2x00_poll() function did the local_irq_save() call
before calling qla24xx_intr_handler(), which had a spinlock. Since
spinlocks are sleepable in the real-time kernel, it is not allowed to call
them with interrupts disabled. This scenario produced error messages and
could cause a system deadlock. With this update, the
local_irq_save_nort(flags) function is used to save flags without disabling
interrupts, which prevents potential deadlocks and removes the error
messages. (BZ#818220)

Users should upgrade to these updated packages, which correct these issues.
The system must be rebooted for this update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.

Updated packages

Red Hat Enterprise MRG v2 for Red Hat Enterprise Linux (version 6)

SRPMS:
kernel-rt-3.0.30-rt50.62.el6rt.src.rpm
File outdated by:  RHBA-2014:0381
    MD5: dbd214ec470e0d391aa3d6ac756bb635
SHA-256: d62a77b9dea211bc2d0793ed56f26f0a3b0448ec743047af9fcae9686cdfe8fa
 
x86_64:
kernel-rt-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 89573f80854b8ff9c2139e8f6c41ed37
SHA-256: 623514220be72d71316e8f5c5d7adfd79e5fd083fbd2005ef27a55ad778f65f8
kernel-rt-debug-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 9d7a03f1963e1610a7c092ecb77ef5ef
SHA-256: 74773fc1cd67d215e6911be41f96095f1495451e69f5d9036ef7faab6092facc
kernel-rt-debug-debuginfo-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 06ddc2479a1ddc909e6aa5c61cac5988
SHA-256: bce76f1147a760ac69b4a3be62df44c4f36d40451dd26ffc684404b2be97efb8
kernel-rt-debug-devel-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 46a1abe0fcf12f8356d010fb6bb6f677
SHA-256: f13354474def3a4d56bbd8fb3908eb408aa8faaf04a26f23be3a63410ddff9fc
kernel-rt-debuginfo-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: fb42205266479f9d44f645a6920587b8
SHA-256: 626617c1389ca1d1de683ee7015420c050a0b674d3b17d73f3b18dc99998d597
kernel-rt-debuginfo-common-x86_64-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: f4ff4ec4a12728e8aaa8cd724d80fa6c
SHA-256: 4c7c3315451e837235c2cb86672594bffa4e3321d95d8bd947bdb0857e886ae9
kernel-rt-devel-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 2915dc7011f8bd22d8bcf697bc7b5b18
SHA-256: 5890fc77e2e0e5d2ce7e6a07fe7d92734133bb4d6391cb5e86e64976bf8e66bb
kernel-rt-doc-3.0.30-rt50.62.el6rt.noarch.rpm
File outdated by:  RHBA-2014:0381
    MD5: 5aff887f69beaf07bcd3d7d0d901ab5d
SHA-256: 0f2dcb7ee2c16929b84ccf3f7d90dec85bb3621d82829d414229057e4987d54f
kernel-rt-firmware-3.0.30-rt50.62.el6rt.noarch.rpm
File outdated by:  RHBA-2014:0381
    MD5: 545f2e9c1540b034571b85d7be3298b8
SHA-256: d1e842476123c0ba1bea2ae6a425a7be1f11368ef86e420812771c78e850587b
kernel-rt-trace-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 150ca636dee2e1a927f30681e9cf07d9
SHA-256: 64a610daf8d6242fcf620d2c9106eb15468ffbee8cec6d9349aed2b8015f1c8d
kernel-rt-trace-debuginfo-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 2db27b0654c28a64ac390946ca381618
SHA-256: 8b1884c3caafa7059bc37532198b372d9ea82b13d760fef770b479e4f9ce6b6a
kernel-rt-trace-devel-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 2e4998a9c448cf75dec7b1e4896cbeaf
SHA-256: 63b861e58b1a5cbb11204ea02865684e442c258741c49963d59e41c711b4b757
kernel-rt-vanilla-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 963ca8b195b0bc8440d6d3920101d870
SHA-256: 83e1fd0435b04658044b337223dd9028214bfca1ca3feed7b9bfbcfaa1fed505
kernel-rt-vanilla-debuginfo-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 733fe70c37a792013258266ea22306ac
SHA-256: 7a6bc79167a0a21e04d0b4ff21c8d111885cc7261683e066cff7f1cf7dff1e81
kernel-rt-vanilla-devel-3.0.30-rt50.62.el6rt.x86_64.rpm
File outdated by:  RHBA-2014:0381
    MD5: 9575785abcf7e1f749b22517a7f5ffad
SHA-256: 59feb9c7acef26d481017ac1c4994c577bf020bf9c4855a559025d206f1ac9cc
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

749143 - CVE-2011-4086 kernel: jbd2: unmapped buffer with _Unwritten or _Delay flags set can lead to DoS
806722 - CVE-2012-2123 kernel: fcaps: clear the same personality flags as suid when fcaps are used
818220 - qla2xxx does a spinlock with interrupts disabled


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/