AXSA:2019-3870:02

リリース日: 
2019/05/09 Thursday - 08:18
題名: 
kernel-2.6.32-754.12.1.el6
影響のあるチャネル: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
High
Description: 

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members (CVE-2018-13405)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* sched/sysctl: Check user input value of sysctl_sched_time_avg (BZ#1579128)

* unable to handle kernel NULL pointer dereference at 000000000000005d in tcp_enter_frto 0x102 (BZ#1585892)

* qla2xxx: Mask Off Scope bits for Retry delay timer in the driver (BZ#1588133)

* [PATCH] perf: Fix a race between ring_buffer_detach() and ring_buffer_wakeup() (BZ#1589340)

* RHEL6.10 - kernel: improve spectre mitigation for s390x (BZ#1625381)

* kernel panic due to NULL pointer dereference in __wake_up_common through perf_event_wakeup (BZ#1627672)

* After upgrading from rhel 6.9 to rhel 6.10, files in a cifs share can't be read (BZ#1636484)

* Retpoline impact on vdso gettimeofday performance (BZ#1638552)

* [RHEL 6.10] 32-bit kernel-2.6.32-754.3.5 registers the swap of 4k size only (BZ#1670328)

CVE-2018-13405
The inode_init_owner function in fs/inode.c in the Linux kernel through 4.17.4 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

解決策: 

Update packages.

追加情報: 

N/A

ダウンロード: 

SRPMS
1. kernel-2.6.32-754.12.1.el6.src.rpm
md5sum: 62b692f87ebdc0ba1b55e89ce839a3d3
sha256sum: 4ded3b431ae904eee5765561c0753aa6f125b8f93ece4cc62599e7eead7ef598
Size: 130,594 Kb

Asianux Server 4.0 for x86_64
1. kernel-2.6.32-754.12.1.el6.x86_64.rpm
md5sum: d3bd22ec2b95785e309875baa88f51d8
sha256sum: 9c2aa16d97d32629af4b94e58a14a2125a0b28a18061c948a5fe028e38422957
Size: 33,164 Kb
2. kernel-abi-whitelists-2.6.32-754.12.1.el6.noarch.rpm
md5sum: 8230a7de3179a9cab57c8cff075fd58c
sha256sum: 5e6953d1f27bf33aaa61deefd8a94ff2a9712baec0ebac119f0d706addf079d6
Size: 3,921 Kb
3. kernel-debug-2.6.32-754.12.1.el6.x86_64.rpm
md5sum: 89faabb1dadbb444b72b361c39492351
sha256sum: a8a4f0313d3645f91a3e2abc8b12e9b8d7c0f4a7cce8474a5f400d4644c6ec06
Size: 34,064 Kb
4. kernel-debug-devel-2.6.32-754.12.1.el6.x86_64.rpm
md5sum: e7e20cf578c71624e8fe7640f0322d3d
sha256sum: 4396811796aac95699bb2c4dcd054b704b6ef3c9e86b31fc62295baaa8d3aaac
Size: 11,128 Kb
5. kernel-devel-2.6.32-754.12.1.el6.x86_64.rpm
md5sum: a34c9fd3d41c56a4cf01bdabebf94809
sha256sum: 4287118a829818e75ebd3425d7bef780437572ad4a8148791890dbea92c14fbc
Size: 11,083 Kb
6. kernel-doc-2.6.32-754.12.1.el6.noarch.rpm
md5sum: d788ea29ba27164b8c7b6fef869f83d4
sha256sum: eb9841304e330f0d55644c44fa1551f904e024b9c31ccb5d9bf0b3c904e1e4e3
Size: 12,710 Kb
7. kernel-firmware-2.6.32-754.12.1.el6.noarch.rpm
md5sum: cbcf33c7d99c9b929a7611139821ea5d
sha256sum: 199312a9c555aba82e146f831d23cf8de6aa6bada6dd027fdea842ff7d6afab5
Size: 29,589 Kb
8. kernel-headers-2.6.32-754.12.1.el6.x86_64.rpm
md5sum: 1876aaf4a3912c29514a261035199ca3
sha256sum: 8ee313c017e764787372656ef21106b86d0ffa403a0580ad401cb46df2367418
Size: 4,660 Kb
9. perf-2.6.32-754.12.1.el6.x86_64.rpm
md5sum: c031bf91aea4859ce551e5cd370c5cc8
sha256sum: 0a89587f28377ff16361723b944d854cbba6bda014c206cb84a428413863407f
Size: 4,865 Kb
{"prod":"4.0", "arch":"x86", "list":["/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/kernel-abi-whitelists-2.6.32-754.12.1.el6.noarch.rpm", "/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/kernel-doc-2.6.32-754.12.1.el6.noarch.rpm", "/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/kernel-firmware-2.6.32-754.12.1.el6.noarch.rpm", "/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/kernel-2.6.32-754.12.1.el6.i686.rpm", "/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/kernel-debug-2.6.32-754.12.1.el6.i686.rpm", "/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/kernel-debug-devel-2.6.32-754.12.1.el6.i686.rpm", "/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/kernel-devel-2.6.32-754.12.1.el6.i686.rpm", "/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/kernel-headers-2.6.32-754.12.1.el6.i686.rpm""/var/www/html/asianux/sites/tsn.asianux.com/files/private/AXS4/x86/UPDATE/RPMS/perf-2.6.32-754.12.1.el6.i686.rpm"]}
Copyright© 2007-2015 Asianux. All rights reserved.