kernel-2.6.32-220.4.1.el6

エラータID: AXSA:2012-228:02

Release date: 
Friday, February 24, 2012 - 11:43
Subject: 
kernel-2.6.32-220.4.1.el6
Affected Channels: 
Asianux Server 4 for x86
Asianux Server 4 for x86_64
Severity: 
High
Description: 

The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.
Security issues fixed with this release:
CVE-2011-1020
The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.
CVE-2011-3347
CVE-2011-3638
No information available at the time of writing, see the CVE link below.
CVE-2011-4110
The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and updating a negative key into a fully instantiated key.
CVE-2011-1162
The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local users to read the results of the previous TPM command.
CVE-2011-1577
Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
CVE-2012-0056
The mem_write function in Linux kernel 2.6.39 and other versions, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.
CVE-2011-2494
CVE-2011-2699
CVE-2011-2905
CVE-2011-3188
CVE-2011-3191
CVE-2011-3353
CVE-2011-3359
CVE-2011-3363
CVE-2011-3593
CVE-2011-4326
CVE-2011-4127
No information available at the time of writing, please refer to the CVE links
below.

Solution: 

Update packages.

CVEs: 
CVE-2011-1020
The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.
CVE-2011-3347
A certain Red Hat patch to the be2net implementation in the kernel package before 2.6.32-218.el6 on Red Hat Enterprise Linux (RHEL) 6, when promiscuous mode is enabled, allows remote attackers to cause a denial of service (system crash) via non-member VLAN packets.
CVE-2011-3638
fs/ext4/extents.c in the Linux kernel before 3.0 does not mark a modified extent as dirty in certain cases of extent splitting, which allows local users to cause a denial of service (system crash) via vectors involving ext4 umount and mount operations.
CVE-2011-4110
The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and "updating a negative key into a fully instantiated key."
CVE-2011-1162
The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local users to read the results of the previous TPM command.
CVE-2011-1577
Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
CVE-2011-2494
kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password.
CVE-2011-2699
The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service (disrupted networking) by predicting these values and sending crafted packets.
CVE-2011-2905
Untrusted search path vulnerability in the perf_config function in tools/perf/util/config.c in perf, as distributed in the Linux kernel before 3.1, allows local users to overwrite arbitrary files via a crafted config file in the current working directory.
CVE-2011-3188
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.
CVE-2011-3191
Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.
CVE-2011-3353
Buffer overflow in the fuse_notify_inval_entry function in fs/fuse/dev.c in the Linux kernel before 3.1 allows local users to cause a denial of service (BUG_ON and system crash) by leveraging the ability to mount a FUSE filesystem.
CVE-2011-3359
The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame.
CVE-2011-3363
The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.
CVE-2011-3593
A certain Red Hat patch to the vlan_hwaccel_do_receive function in net/8021q/vlan_core.c in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows remote attackers to cause a denial of service (system crash) via priority-tagged VLAN frames.
CVE-2011-4326
The udp6_ufo_fragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload (UFO) configuration is enabled, allows remote attackers to cause a denial of service (system crash) by sending fragmented IPv6 UDP packets to a bridge device.
CVE-2011-4127
The Linux kernel before 3.2.2 does not properly restrict SG_IO ioctl calls, which allows local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume.
CVE-2012-0056
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc//mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.




Additional Info: 

N/A

Download: 

SRPMS
  1. kernel-2.6.32-220.4.1.el6.src.rpm
    MD5: 2d511d054c2dd1867d88adf2e689f07d
    SHA-256: ba08c13dbf95f37bc561ef99c039ac8620ad431c069b0448dbc141323921be26
    Size: 73.52 MB

Asianux Server 4 for x86
  1. kernel-doc-2.6.32-220.4.1.el6.noarch.rpm
    MD5: 9641282f2d90b269b38140866c266830
    SHA-256: 818b21605ff4d2f74a3aab73324492a4e9b2a6131af3276fc7fb5965e42348de
    Size: 9.15 MB
  2. kernel-firmware-2.6.32-220.4.1.el6.noarch.rpm
    MD5: c1e9b90fb6672113561921b448dbf403
    SHA-256: 4723f6e3bd3a395bc23253dd3ac09da9eee5f3c074f1ad29f7159347441ffb46
    Size: 6.24 MB
  3. kernel-2.6.32-220.4.1.el6.i686.rpm
    MD5: e50f94f929eeb53c618d472c6b022643
    SHA-256: 783f1e69836361982023acc35d968f7df84a64a3abac5d2e1e1a7f46842b9346
    Size: 22.32 MB
  4. kernel-debug-2.6.32-220.4.1.el6.i686.rpm
    MD5: 5f1566701ac6be1e514b2fbcf4122f10
    SHA-256: dbaeb92b1b43c74c055b5640b84b1e99511a73f630642638ad81728932070c27
    Size: 22.80 MB
  5. kernel-debug-devel-2.6.32-220.4.1.el6.i686.rpm
    MD5: 573d45f14513666194ec09ce9db09b7d
    SHA-256: 386d725e443672b65783876521d2662d7d4f98389c83dd0fba6bd11d82af526e
    Size: 7.27 MB
  6. kernel-devel-2.6.32-220.4.1.el6.i686.rpm
    MD5: 5183655993da1fddca0412d394c890f3
    SHA-256: 00ace2e055d06966daf76243c39d6d69497e7d74c2da95ebe6473d1911cea577
    Size: 7.23 MB
  7. kernel-headers-2.6.32-220.4.1.el6.i686.rpm
    MD5: b95803eb4278412bdd10538bdcbb7356
    SHA-256: b1e06d474d7dad407b1f47e5905c97db33d46a31a183868ce30cd56b3d0db609
    Size: 1.62 MB
  8. perf-2.6.32-220.4.1.el6.i686.rpm
    MD5: 529974571c10bc17dd78f6a96f38d489
    SHA-256: 7d4058dfbb549c69f822a9e294e09757c0e321bb0d0133e7e251df5a9811322c
    Size: 1.26 MB

Asianux Server 4 for x86_64
  1. kernel-doc-2.6.32-220.4.1.el6.noarch.rpm
    MD5: 7c8486d44175763e82bf26532268a225
    SHA-256: 2be97ec970372490d34fa996b9b5998fd2c9cc55a2dac30cbbce43793da52437
    Size: 9.15 MB
  2. kernel-firmware-2.6.32-220.4.1.el6.noarch.rpm
    MD5: a39f0efd2bc9e4307e7ec4f9b0281424
    SHA-256: 989be6c2b06663be111659493a7a4f35bb645d18acbd8dfb7896da4295a423dd
    Size: 6.24 MB
  3. kernel-2.6.32-220.4.1.el6.x86_64.rpm
    MD5: 49cca11e07f33a62da9fb37f374a949d
    SHA-256: b8dfb914c76e5774c876c5525175f42459820403dcc69c3bb00c221c3fa04638
    Size: 24.28 MB
  4. kernel-debug-2.6.32-220.4.1.el6.x86_64.rpm
    MD5: 01e899dca022d15e1ee3b6c16c98eee8
    SHA-256: ecb31ce59c0577998941e812d6d5d7d70816f619c48aab7b4653d2fd35ad3d59
    Size: 24.84 MB
  5. kernel-debug-devel-2.6.32-220.4.1.el6.x86_64.rpm
    MD5: 102eac8caaa83b48ad6dfe34458cdb35
    SHA-256: bea4e838e6e0ed73e1a81af0686082743ae54a4952357bfe747d4d34a07c637a
    Size: 7.31 MB
  6. kernel-devel-2.6.32-220.4.1.el6.x86_64.rpm
    MD5: 1981daeea0a6fb20b08b54257b997023
    SHA-256: 28cd3648a4a19df8b82979a019610dd79cdcad7b37bca08304cca9c13638b88f
    Size: 7.27 MB
  7. kernel-headers-2.6.32-220.4.1.el6.x86_64.rpm
    MD5: 70ad5d4511415ae5c2fc85e936307874
    SHA-256: 7ea81a26d05ec8d4c616cec76184c4acbfed022fc97acff777da0401e90f61dc
    Size: 1.62 MB
  8. perf-2.6.32-220.4.1.el6.x86_64.rpm
    MD5: 39352460954a213b5e3abb1a25fdd719
    SHA-256: 29f1ebb0145441c6abb95668077cb1052bddc0db6fcfe653e60a599f8a357bdf
    Size: 1.27 MB