kernel-2.6.32-131.12.1.el6

エラータID: AXSA:2011-489:04

リリース日: 
2011/12/28 Wednesday - 20:41
題名: 
kernel-2.6.32-131.12.1.el6
影響のあるチャネル: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
High
Description: 

The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.
Security issues fixed with this release:
CVE-2011-1593
Multiple integer overflows in the next_pidmap function in kernel/pid.c in
the Linux kernel before 2.6.38.4 allow local users to cause a denial of service
(system crash) via a crafted (1) getdents or (2) readdir system call.
CVE-2011-1898
Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by using DMA to generate MSI interrupts by writing to the interrupt injection registers.
CVE-2011-2492
The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
CVE-2011-2689
The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space.
CVE-2011-2695
Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned
integer.
CVE-2011-0999
mm/huge_memory.c in the Linux kernel before 2.6.38-rc5 does not prevent creation of a transparent huge page (THP) during the existence of a temporary stack for an exec system call, which allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact via a crafted application.
CVE-2011-1010
Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a malformed Mac OS partition table.
CVE-2011-1082
fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
CVE-2011-1090
The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.
CVE-2011-1163
The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.
CVE-2011-1494
Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
CVE-2011-1495
drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
CVE-2010-3296
The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.
CVE-2010-4346
The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.
CVE-2010-4526
Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function.
CVE-2011-0521
The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.
CVE-2011-0695
Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request handlers are still running, which triggers an invalid pointer dereference.
CVE-2011-0710
The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/.
CVE-2010-4565
The bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to obtain potentially sensitive information about kernel memory use by listing this filename.
CVE-2010-4649
Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.
CVE-2011-0711
The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.
CVE-2011-0712
Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.
CVE-2011-1013
Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.
CVE-2011-1016
The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values.
CVE-2011-1044
The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649.
CVE-2010-3858
The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit platform, which allows local users to cause a denial of service (system crash) via a crafted exec system call, a related issue to CVE-2010-2240.
CVE-2011-1598
The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.
CVE-2011-1748
The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.
CVE-2010-4250
CVE-2010-4251
CVE-2010-4648
CVE-2010-4655
CVE-2010-4656
CVE-2011-0006
CVE-2011-0716
CVE-2011-0726
CVE-2011-1019
CVE-2011-1023
CVE-2011-1079
CVE-2011-1080
CVE-2011-1093
CVE-2011-1170
CVE-2011-1171
CVE-2011-1172
CVE-2011-1182
CVE-2011-1478
CVE-2011-1573
CVE-2011-1576
CVE-2011-1581
CVE-2011-1767
CVE-2011-1768
CVE-2011-1770
CVE-2011-1771
CVE-2011-1776
CVE-2011-2183
CVE-2011-2213
CVE-2011-2479
CVE-2011-2491
CVE-2011-2495
CVE-2011-2497
CVE-2011-2517
No information available at the time of writing, please refer to the CVE links below.
Fixed bugs:
Too many to list everything here, see the changelog
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3296
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3858
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4250
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4251
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4346
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4526
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4648
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4649
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4655
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4656
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0006
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0521
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0695
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0711
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0712
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0726
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0999
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1010
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1013
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1016
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1019
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1023
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1044
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1079
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1080
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1082
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1093
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1163
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1170
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1171
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1172
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1182
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1478
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1495
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1573
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1576
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1581
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1593
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1598
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1748
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1768
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1770
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1771
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1776
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1898
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2183
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2213
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2479
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2492
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2495
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2497
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2517
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2689
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2695

解決策: 

Update packages.

追加情報: 

From Asianux Server 4 SP1.

ダウンロード: 

SRPMS
  1. kernel-2.6.32-131.12.1.el6.src.rpm
    MD5: 31b508165a2eba6c1f9228fd741b670f
    SHA-256: 82ee29f937a1e083cba794106a3c9eae0d57e0239f57af4e34ee7d707383f3c8
    Size: 67.34 MB

Asianux Server 4 for x86
  1. kernel-2.6.32-131.12.1.el6.i686.rpm
    MD5: 90b5ff79cd241ebdd2bfcb8096c52045
    SHA-256: 54be95542e7ad1df699179db0423e297b44f2410a69095e60422947bfd8c016c
    Size: 21.45 MB
  2. kernel-doc-2.6.32-131.12.1.el6.noarch.rpm
    MD5: d9883025648602a22069b125a85f1a94
    SHA-256: 3b1e23ed258e88ccf8242d7edd1f9109b6f31ec69b52ce41d87f49907ca6d3e9
    Size: 8.83 MB
  3. kernel-headers-2.6.32-131.12.1.el6.i686.rpm
    MD5: e0beccdd9b231bfe19364994bc237d41
    SHA-256: 9e10c6f6d5311b7a496447e225c6c90926d94b84e33b94c067cb88e6bd4b6f1e
    Size: 1.32 MB
  4. kernel-firmware-2.6.32-131.12.1.el6.noarch.rpm
    MD5: 1c6ff694aa3fb348e6ca9ad1c98a59bd
    SHA-256: 963b1a8a3b27d177d021b5df9c30b1dd3917f60a30850873b633a8a51c994974
    Size: 2.54 MB
  5. perf-2.6.32-131.12.1.el6.i686.rpm
    MD5: 06f6ec9bb9cb89f7deb2d12e28465d3d
    SHA-256: d45be7dfc7f566b9153c266d5262a4e4064816b483f072fd4beac2702f590900
    Size: 0.96 MB
  6. kernel-devel-2.6.32-131.12.1.el6.i686.rpm
    MD5: 2c4b3456ce244a7b1f901a5ccc09e169
    SHA-256: f05e1c6f0f0bfec037e25fd9dc5e42ae3269edecbaf70d01af8f34487795aaac
    Size: 6.89 MB
  7. kernel-debug-2.6.32-131.12.1.el6.i686.rpm
    MD5: a66a9af9249abae3927be70f3dc3d8c5
    SHA-256: 54cef0f642699a468b38bd0c5d59e1b5fc1965c438433c39d89d33ef13009894
    Size: 21.94 MB
  8. kernel-debug-devel-2.6.32-131.12.1.el6.i686.rpm
    MD5: b46b5b327707eacede4fec8eb12d436f
    SHA-256: c3699b3666832e4ca1a84229fc47fe87166006671a5afd7bea1b40505ab2df44
    Size: 6.93 MB

Asianux Server 4 for x86_64
  1. kernel-2.6.32-131.12.1.el6.x86_64.rpm
    MD5: de1af79688da674959d76d9c72bdee88
    SHA-256: bc5d8c9be0620da41de7a21c1431d873aab359c0f6c791c95aa62583b4322a10
    Size: 23.28 MB
  2. kernel-doc-2.6.32-131.12.1.el6.noarch.rpm
    MD5: 8b920518343bef2e5ae66ba54af7177c
    SHA-256: b723a68b5e59aa229c8b8f8d991af83e4bbab80f6cb20c391d296f1f664fa2e3
    Size: 8.83 MB
  3. kernel-headers-2.6.32-131.12.1.el6.x86_64.rpm
    MD5: 8cd900fc50465246671481a1cbb83c0c
    SHA-256: 36f53bc69988cbc293010a66e34290858b1f52b954aafef6d7a9900fc31c4ec7
    Size: 1.32 MB
  4. kernel-firmware-2.6.32-131.12.1.el6.noarch.rpm
    MD5: b346ab3ac17613c2dd056ad24aba6236
    SHA-256: 52baba883240351ebd1613e4bb49af17fef9462d9a3ae4fbd8d460c3f34bcfa7
    Size: 2.54 MB
  5. perf-2.6.32-131.12.1.el6.x86_64.rpm
    MD5: 73813f19945a9e45364ef052b1f8af14
    SHA-256: d6d85dbcca9105eef3b537ec7b73cd2479c6187f3722c872e03920f4ecb53cd2
    Size: 0.97 MB
  6. kernel-devel-2.6.32-131.12.1.el6.x86_64.rpm
    MD5: c18578286ff294d9448cbda6d8293afa
    SHA-256: 97edf48ee3006fa481ad3bc4e13d68fb9824cea6f0a30bcf89750d63eacd8055
    Size: 6.93 MB
  7. kernel-debug-2.6.32-131.12.1.el6.x86_64.rpm
    MD5: 02d7b64706d3817fd6a899faa0eeca6c
    SHA-256: e1a1a11ee4a72861255467482fd9252bde09781f7573157bb06a0ede8247d291
    Size: 23.83 MB
  8. kernel-debug-devel-2.6.32-131.12.1.el6.x86_64.rpm
    MD5: a1e8e3c153f529964d0dbf010729c774
    SHA-256: dc5c99bce2ae79da4f6de6f1ddb71bfe7f38a9cc7d21333064f06b86b5332645
    Size: 6.97 MB