Home / mailings [RHSA-2007:0940-01] Important: kernel security update
Posted on 22 October 2007
RedHat-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: kernel security update
Advisory ID: RHSA-2007:0940-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0940.html
Issue date: 2007-10-22
Updated on: 2007-10-22
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-3105 CVE-2007-3380 CVE-2007-3513
CVE-2007-3731 CVE-2007-3848 CVE-2007-3850
CVE-2007-4308 CVE-2007-4133 CVE-2007-4574
- ---------------------------------------------------------------------
1. Summary:
Updated kernel packages that fix various security issues in the Red Hat
Enterprise Linux 5 kernel are now available.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64
3. Problem description:
The Linux kernel handles the basic functions of the operating system.
These new kernel packages contain fixes for the following security issues:
* A flaw was found in the backported stack unwinder fixes in Red Hat
Enterprise Linux 5. On AMD64 and Intel 64 platforms, a local user could
trigger this flaw and cause a denial of service. (CVE-2007-4574, Important)
* A flaw was found in the handling of process death signals. This allowed a
local user to send arbitrary signals to the suid-process executed by that
user. A successful exploitation of this flaw depends on the structure of
the suid-program and its signal handling. (CVE-2007-3848, Important)
* A flaw was found in the Distributed Lock Manager (DLM) in the cluster
manager. This allowed a remote user who is able to connect to the DLM port
to cause a denial of service. (CVE-2007-3380, Important)
* A flaw was found in the aacraid SCSI driver. This allowed a local user to
make ioctl calls to the driver which should otherwise be restricted to
privileged users. (CVE-2007-4308, Moderate)
* A flaw was found in the prio_tree handling of the hugetlb support that
allowed a local user to cause a denial of service. This only affected
kernels with hugetlb support. (CVE-2007-4133, Moderate)
* A flaw was found in the eHCA driver on PowerPC architectures that allowed
a local user to access 60k of physical address space. This address space
could contain sensitive information. (CVE-2007-3850, Moderate)
* A flaw was found in ptrace support that allowed a local user to cause a
denial of service via a NULL pointer dereference. (CVE-2007-3731, Moderate)
* A flaw was found in the usblcd driver that allowed a local user to cause
a denial
of service by writing data to the device node. To exploit this issue, write
access to the device node was needed. (CVE-2007-3513, Moderate)
* A flaw was found in the random number generator implementation that
allowed a local user to cause a denial of service or possibly gain
privileges. If the root user raised the default wakeup threshold over the
size of the output pool, this flaw could be exploited. (CVE-2007-3105, Low)
In addition to the security issues described above, several bug fixes
preventing possible system crashes and data corruption were also included.
Red Hat Enterprise Linux 5 users are advised to upgrade to these packages,
which contain backported patches to resolve these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
245922 - CVE-2007-3380 A TCP connection to DLM port blocks DLM operations
247728 - CVE-2007-3513 Locally triggerable memory consumption in usblcd
248324 - CVE-2007-3731 NULL pointer dereference triggered by ptrace
248325 - CVE-2007-3105 Bound check ordering issue in random driver
250972 - CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG
252309 - CVE-2007-4308 Missing ioctl() permission checks in aacraid driver
253926 - CVE-2007-4133 prio_tree unit kernel panic
298141 - CVE-2007-4574 EM64T local DoS
308811 - CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-8.1.15.el5.src.rpm
96e7f738ecce94568d5bb134189c326c kernel-2.6.18-8.1.15.el5.src.rpm
i386:
f862f2df0259807e71880bd71b7d459c kernel-2.6.18-8.1.15.el5.i686.rpm
04fa118c137a7ed248e9c906df961528 kernel-PAE-2.6.18-8.1.15.el5.i686.rpm
04e2f8b037a27ab6f4943d496339079a kernel-PAE-debuginfo-2.6.18-8.1.15.el5.i686.rpm
a2850422391d9909877543b3aca1c16b kernel-PAE-devel-2.6.18-8.1.15.el5.i686.rpm
c94b1a5980aa9183b2563ee97af1ec39 kernel-debuginfo-2.6.18-8.1.15.el5.i686.rpm
796744b00942d2ff7aaec2a0519e1c18 kernel-debuginfo-common-2.6.18-8.1.15.el5.i686.rpm
fe3e7757c2a305387104d1d3a23eaff4 kernel-devel-2.6.18-8.1.15.el5.i686.rpm
e2d502422d61345c2b5e14397358eccc kernel-headers-2.6.18-8.1.15.el5.i386.rpm
ea4b753172c08f45e0d67ac8bdd60bf8 kernel-xen-2.6.18-8.1.15.el5.i686.rpm
7310e6056cfacd977b6e9a6e4dbdeaa3 kernel-xen-debuginfo-2.6.18-8.1.15.el5.i686.rpm
9c709312d55ca786d01302618aa50309 kernel-xen-devel-2.6.18-8.1.15.el5.i686.rpm
noarch:
82503886fa27faada673b4c5b51f5e91 kernel-doc-2.6.18-8.1.15.el5.noarch.rpm
x86_64:
47227f2902ab9ed3e2bf56836cf3f8c8 kernel-2.6.18-8.1.15.el5.x86_64.rpm
a7923c0f2724d9c7f844f98cdc6bc4c6 kernel-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
936c2ebb45de91e38ec406dbd4ea1552 kernel-debuginfo-common-2.6.18-8.1.15.el5.x86_64.rpm
de0ab04f9ece35d22230277e57ac4163 kernel-devel-2.6.18-8.1.15.el5.x86_64.rpm
7b14e095feb0be96ed4335c99aeff961 kernel-headers-2.6.18-8.1.15.el5.x86_64.rpm
97d1aac9db45b83ef9ab05ccfa6e41d9 kernel-xen-2.6.18-8.1.15.el5.x86_64.rpm
70908a1f7e420369a81fb2c6772bb94d kernel-xen-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
e1356a3b6a13306a0da4da273b78c8de kernel-xen-devel-2.6.18-8.1.15.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-8.1.15.el5.src.rpm
96e7f738ecce94568d5bb134189c326c kernel-2.6.18-8.1.15.el5.src.rpm
i386:
f862f2df0259807e71880bd71b7d459c kernel-2.6.18-8.1.15.el5.i686.rpm
04fa118c137a7ed248e9c906df961528 kernel-PAE-2.6.18-8.1.15.el5.i686.rpm
04e2f8b037a27ab6f4943d496339079a kernel-PAE-debuginfo-2.6.18-8.1.15.el5.i686.rpm
a2850422391d9909877543b3aca1c16b kernel-PAE-devel-2.6.18-8.1.15.el5.i686.rpm
c94b1a5980aa9183b2563ee97af1ec39 kernel-debuginfo-2.6.18-8.1.15.el5.i686.rpm
796744b00942d2ff7aaec2a0519e1c18 kernel-debuginfo-common-2.6.18-8.1.15.el5.i686.rpm
fe3e7757c2a305387104d1d3a23eaff4 kernel-devel-2.6.18-8.1.15.el5.i686.rpm
e2d502422d61345c2b5e14397358eccc kernel-headers-2.6.18-8.1.15.el5.i386.rpm
ea4b753172c08f45e0d67ac8bdd60bf8 kernel-xen-2.6.18-8.1.15.el5.i686.rpm
7310e6056cfacd977b6e9a6e4dbdeaa3 kernel-xen-debuginfo-2.6.18-8.1.15.el5.i686.rpm
9c709312d55ca786d01302618aa50309 kernel-xen-devel-2.6.18-8.1.15.el5.i686.rpm
ia64:
d359d0330e7b6804af362af1eb1adc7d kernel-2.6.18-8.1.15.el5.ia64.rpm
ef7242edeab0b6b4e819931012a9ac77 kernel-debuginfo-2.6.18-8.1.15.el5.ia64.rpm
70d97793b3913609d98a56716d788fa8 kernel-debuginfo-common-2.6.18-8.1.15.el5.ia64.rpm
3376e3721a0409159040aa448d2e7c63 kernel-devel-2.6.18-8.1.15.el5.ia64.rpm
9b176d5a29ee2f4ddfded0e6317b5260 kernel-headers-2.6.18-8.1.15.el5.ia64.rpm
d48babc1ecb538673533d2c00017773f kernel-xen-2.6.18-8.1.15.el5.ia64.rpm
7d095696578e0b8c6da43885a7f0b119 kernel-xen-debuginfo-2.6.18-8.1.15.el5.ia64.rpm
e65b46be5519d6e9cda212a2f52cbc51 kernel-xen-devel-2.6.18-8.1.15.el5.ia64.rpm
noarch:
82503886fa27faada673b4c5b51f5e91 kernel-doc-2.6.18-8.1.15.el5.noarch.rpm
ppc:
075c973a5187cfc363b4039743c851a1 kernel-2.6.18-8.1.15.el5.ppc64.rpm
dcdec27094c2c3ad8ac98ad549f7e2b9 kernel-debuginfo-2.6.18-8.1.15.el5.ppc64.rpm
b3146028b8afb016a14629f203341a66 kernel-debuginfo-common-2.6.18-8.1.15.el5.ppc64.rpm
28cb4c0282755727b1d0960b188816a6 kernel-devel-2.6.18-8.1.15.el5.ppc64.rpm
7b52271f10576a5649ae85050732ad62 kernel-headers-2.6.18-8.1.15.el5.ppc.rpm
b66c688e3bae66044baa5f8d987d5606 kernel-headers-2.6.18-8.1.15.el5.ppc64.rpm
2d6a3bed623a2ae016793e99c283dfea kernel-kdump-2.6.18-8.1.15.el5.ppc64.rpm
8ba60265e125f856c813cafcf1587a56 kernel-kdump-debuginfo-2.6.18-8.1.15.el5.ppc64.rpm
d5d1dd7a6b076f01338430fc45570192 kernel-kdump-devel-2.6.18-8.1.15.el5.ppc64.rpm
s390x:
e0982a8fa0d9e315cb3b7dc7efcacfde kernel-2.6.18-8.1.15.el5.s390x.rpm
38f795e7b02840409e2afceaf6659211 kernel-debuginfo-2.6.18-8.1.15.el5.s390x.rpm
ff1b32db3d923a14e969eed741c22e88 kernel-debuginfo-common-2.6.18-8.1.15.el5.s390x.rpm
e0fd341c4267569f79589ed67d151d92 kernel-devel-2.6.18-8.1.15.el5.s390x.rpm
d616fd9a1ecac69f961977ee2e3d0288 kernel-headers-2.6.18-8.1.15.el5.s390x.rpm
x86_64:
47227f2902ab9ed3e2bf56836cf3f8c8 kernel-2.6.18-8.1.15.el5.x86_64.rpm
a7923c0f2724d9c7f844f98cdc6bc4c6 kernel-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
936c2ebb45de91e38ec406dbd4ea1552 kernel-debuginfo-common-2.6.18-8.1.15.el5.x86_64.rpm
de0ab04f9ece35d22230277e57ac4163 kernel-devel-2.6.18-8.1.15.el5.x86_64.rpm
7b14e095feb0be96ed4335c99aeff961 kernel-headers-2.6.18-8.1.15.el5.x86_64.rpm
97d1aac9db45b83ef9ab05ccfa6e41d9 kernel-xen-2.6.18-8.1.15.el5.x86_64.rpm
70908a1f7e420369a81fb2c6772bb94d kernel-xen-debuginfo-2.6.18-8.1.15.el5.x86_64.rpm
e1356a3b6a13306a0da4da273b78c8de kernel-xen-devel-2.6.18-8.1.15.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3105
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3380
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3513
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3731
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4308
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4574
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
