Oval Definition:oval:com.redhat.rhsa:def:20070488
Revision Date:2007-06-25Version:635
Title:RHSA-2007:0488: kernel security update (Important)
Description:The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below:

  • a flaw in the connection tracking support for SCTP that allowed a remote user to cause a denial of service by dereferencing a NULL pointer. (CVE-2007-2876, Important)

  • a flaw in the mount handling routine for 64-bit systems that allowed a local user to cause denial of service (crash). (CVE-2006-7203, Important)

  • a flaw in the IPv4 forwarding base that allowed a local user to cause an out-of-bounds access. (CVE-2007-2172, Important)

  • a flaw in the PPP over Ethernet implementation that allowed a local user to cause a denial of service (memory consumption) by creating a socket using connect and then releasing it before the PPPIOCGCHAN ioctl has been called. (CVE-2007-2525, Important)

  • a flaw in the fput ioctl handling of 32-bit applications running on 64-bit platforms that allowed a local user to cause a denial of service (panic). (CVE-2007-0773, Important)

  • a flaw in the NFS locking daemon that allowed a local user to cause denial of service (deadlock). (CVE-2006-5158, Moderate)

  • a flaw in the sysfs_readdir function that allowed a local user to cause a denial of service by dereferencing a NULL pointer. (CVE-2007-3104, Moderate)

    a flaw in the core-dump handling that allowed a local user to create core dumps from unreadable binaries via PT_INTERP. (CVE-2007-0958, Low)

  • a flaw in the Bluetooth subsystem that allowed a local user to trigger an information leak. (CVE-2007-1353, Low)

    In addition, the following bugs were addressed:

    the NFS could recurse on the same spinlock. Also, NFS, under certain conditions, did not completely clean up Posix locks on a file close, leading to mount failures.

    the 32bit compatibility didn't return to userspace correct values for the rt_sigtimedwait system call.

    the count for unused inodes could be incorrect at times, resulting in dirty data not being written to disk in a timely manner.

    the cciss driver had an incorrect disk size calculation (off-by-one error) which prevented disk dumps.

    Red Hat would like to thank Ilja van Sprundel and the OpenVZ Linux kernel team for reporting issues fixed in this erratum.

    All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.
  • Family:unixClass:patch
    Status:Reference(s):CVE-2006-5158
    CVE-2006-7203
    CVE-2007-0773
    CVE-2007-0958
    CVE-2007-1353
    CVE-2007-2172
    CVE-2007-2525
    CVE-2007-2876
    CVE-2007-3104
    RHSA-2007:0488
    RHSA-2007:0488-03
    RHSA-2007:0488-03
    Platform(s):Red Hat Enterprise Linux 4
    Product(s):
    Definition Synopsis
  • Red Hat Enterprise Linux must be installed
  • OR Package Information
  • Red Hat Enterprise Linux 4 is installed
  • AND
  • kernel earlier than 0:2.6.9-55.0.2.EL is currently running
  • OR kernel earlier than 0:2.6.9-55.0.2.EL is set to boot up on next boot
  • AND
  • kernel is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel is signed with Red Hat redhatrelease2 key
  • kernel-devel is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-devel is signed with Red Hat redhatrelease2 key
  • kernel-doc is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-doc is signed with Red Hat redhatrelease2 key
  • kernel-hugemem is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-hugemem is signed with Red Hat redhatrelease2 key
  • kernel-hugemem-devel is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-hugemem-devel is signed with Red Hat redhatrelease2 key
  • kernel-largesmp is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-largesmp is signed with Red Hat redhatrelease2 key
  • kernel-largesmp-devel is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-largesmp-devel is signed with Red Hat redhatrelease2 key
  • kernel-smp is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-smp is signed with Red Hat redhatrelease2 key
  • kernel-smp-devel is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-smp-devel is signed with Red Hat redhatrelease2 key
  • kernel-xenU is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-xenU is signed with Red Hat redhatrelease2 key
  • kernel-xenU-devel is earlier than 0:2.6.9-55.0.2.EL
  • AND kernel-xenU-devel is signed with Red Hat redhatrelease2 key
  • BACK