kernel-2.6.32-220.7.1.el6
エラータID: AXSA:2012-406:03
リリース日:
2012/03/27 Tuesday - 10:52
題名:
kernel-2.6.32-220.7.1.el6
影響のあるチャネル:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- CONFIG_XFS_DEBUGが無効のときのxfs_readlink関数でバッファオーバーフローが検出されました。長いパス名を持つシンボリックリンクを含むXFSイメージを使って、権限のないローカルユーザがサービス拒否(メモリ破壊)を引き起こす、または任意のコードが実行される危険性があります。(CVE-2011-4077)
- ghash_update関数とghash_final関数にセキュリティ上の欠陥が検出されました。権限のないローカルユーザがサービス拒否を引き起こす危険性があります。(CVE-2011-4081)
- JBD(Journaling Block Device)のcleanup_journal_tail関数にセキュリティ上の欠陥が検出されました。不正なext3、ext4イメージを使って、権限のないローカルユーザがサービス拒否(kernel OOPS)を引き起こす危険性があります。(CVE-2011-4132)
- KVMのkvm_vm_ioctl_assign_device関数はuser requesting device assignmentが権限を持っているかどうかチェックしていませんでした。ホスト上の権限のないローカルユーザが使用されていないPCI装置をアサインしてホストをクラッシュさせる危険性があります。(CVE-2011-4347)
- sendmsgシステムコールから実行される__sys_sendmsg関数のユーザ空間メモリのアクセス方法にセキュリティ上の欠陥が検出されました。権限のないローカルユーザがサービス拒否を引き起こす危険性があります。(CVE-2011-4594)
- 前回のアップデートに整数オーバーフローの問題がありました。PPCシステム上において権限のないローカルユーザがサービス拒否を引き起こす危険性があります。(CVE-2011-4611)
- KVMのcreate_pit_time関数にセキュリティ上の欠陥が検出されました。タイマーをスタートさせることで、権限のないローカルユーザがサービス拒否(NULLポインタ逆参照)を引き起こす危険性があります。(CVE-2011-4622)
- XFSのon-disk ACLs(Access Control Lists)の処理方法にセキュリティ上の欠陥が検出されました。細工したディスクをマウントすることで、権限のないローカルユーザがサービス拒否を引き起こす、または権限のエスカレーションを行う危険性があります。(CVE-2012-0038)
- 32bitゲストに対するKVMのsyscall命令のエミュレート方法にセキュリティ上の欠陥が検出されました。権限のないローカルユーザがゲストをクラッシュさせる危険性があります。(CVE-2012-0045)
- igmp_heard_query関数でゼロ除算が検出されました。アタッカーが特定のIGMP(Internet Group Management Protocol)パケットを対象システムに送ることでサービス拒否を引き起こす危険性があります。(CVE-2012-0207)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2011-4077
Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.
Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.
CVE-2011-4081
crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket.
crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket.
CVE-2011-4132
The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value."
The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value."
CVE-2011-4347
The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify permission to access PCI configuration space and BAR resources, which allows host OS users to assign PCI devices and cause a denial of service (host OS crash) via a KVM_ASSIGN_PCI_DEVICE operation.
The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify permission to access PCI configuration space and BAR resources, which allows host OS users to assign PCI devices and cause a denial of service (host OS crash) via a KVM_ASSIGN_PCI_DEVICE operation.
CVE-2011-4594
The __sys_sendmsg function in net/socket.c in the Linux kernel before 3.1 allows local users to cause a denial of service (system crash) via crafted use of the sendmmsg system call, leading to an incorrect pointer dereference.
The __sys_sendmsg function in net/socket.c in the Linux kernel before 3.1 allows local users to cause a denial of service (system crash) via crafted use of the sendmmsg system call, leading to an incorrect pointer dereference.
CVE-2011-4611
Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events.
Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events.
CVE-2011-4622
The create_pit_timer function in arch/x86/kvm/i8254.c in KVM 83, and possibly other versions, does not properly handle when Programmable Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt controller (irqchip) is not available, which allows local users to cause a denial of service (NULL pointer dereference) by starting a timer.
The create_pit_timer function in arch/x86/kvm/i8254.c in KVM 83, and possibly other versions, does not properly handle when Programmable Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt controller (irqchip) is not available, which allows local users to cause a denial of service (NULL pointer dereference) by starting a timer.
CVE-2012-0038
Integer overflow in the xfs_acl_from_disk function in fs/xfs/xfs_acl.c in the Linux kernel before 3.1.9 allows local users to cause a denial of service (panic) via a filesystem with a malformed ACL, leading to a heap-based buffer overflow.
Integer overflow in the xfs_acl_from_disk function in fs/xfs/xfs_acl.c in the Linux kernel before 3.1.9 allows local users to cause a denial of service (panic) via a filesystem with a malformed ACL, leading to a heap-based buffer overflow.
CVE-2012-0045
The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file.
The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file.
CVE-2012-0207
The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP packets.
The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP packets.
追加情報:
N/A
ダウンロード:
SRPMS
- kernel-2.6.32-220.7.1.el6.src.rpm
MD5: a9fcc9f285f023d0e60da70082bf4d80
SHA-256: 359f2cf60b4628f6c4d8f1fd56162983085221823a62259578b9ec40ca3240c3
Size: 74.65 MB
Asianux Server 4 for x86
- kernel-2.6.32-220.7.1.el6.i686.rpm
MD5: 548592e15c13423f9cceffa6e11c525d
SHA-256: ab48d963d6887ba09188e4346094b0f5b1a7c41a40bcb64852d03aa974a878c4
Size: 22.32 MB - kernel-debug-2.6.32-220.7.1.el6.i686.rpm
MD5: c3092fd7d592e91a8063747f71a0ae41
SHA-256: 06df5cfadab9a77d86a29ac66abba01f257eff9f3bdd43675b8b934ade0aec7f
Size: 22.80 MB - kernel-debug-devel-2.6.32-220.7.1.el6.i686.rpm
MD5: 4801f0b5136f1d789fc1118bedee8027
SHA-256: 48ad8f2539eadb704ce9e83766d7e40b3c44b9fd2010327b00aa715c8f4516f8
Size: 7.28 MB - kernel-devel-2.6.32-220.7.1.el6.i686.rpm
MD5: 1acb5e3d072057ce8df4dbc8cb15f44e
SHA-256: 1cb794026b07177f4b9629f0996a833632265d05e3b5054b324c39a855c9294a
Size: 7.23 MB - kernel-doc-2.6.32-220.7.1.el6.noarch.rpm
MD5: 4cda98553b361a7270925ea44d90f870
SHA-256: caa65528c516948427f14b858b09b1413d23965191f596183e42c7cee72b8fb8
Size: 9.15 MB - kernel-firmware-2.6.32-220.7.1.el6.noarch.rpm
MD5: 2583e529cbf3305192a583379d1c1e38
SHA-256: 7cba91ef0bf97a7f9a8055012f3454462680a665eed037db982d70ed4388db60
Size: 6.24 MB - kernel-headers-2.6.32-220.7.1.el6.i686.rpm
MD5: 2600910f42e968d31056217dbe4f1a0a
SHA-256: 471d7da5b7583cf653750af91b4c3d667940e0996cf2f769a41b8227292cc86e
Size: 1.62 MB - perf-2.6.32-220.7.1.el6.i686.rpm
MD5: 824ce41f98d24063125469859b913853
SHA-256: fb4387fa54a4aa377ed0d9040945060166c0b2de1fae2de37e8364ad0684fe22
Size: 1.27 MB
Asianux Server 4 for x86_64
- kernel-2.6.32-220.7.1.el6.x86_64.rpm
MD5: e4490ea57181ab3fa98685f910928bca
SHA-256: 188f98db1ca495154d199c1157ae914126c15de21bc74ba470f3f12f765f2472
Size: 24.28 MB - kernel-debug-2.6.32-220.7.1.el6.x86_64.rpm
MD5: af53c03b8f637badd599b35ecc68cac9
SHA-256: 1c902fb3af04cd8e6c66cdc17f75431e7756cd43d55046c4dc1496d21ae1b504
Size: 24.84 MB - kernel-debug-devel-2.6.32-220.7.1.el6.x86_64.rpm
MD5: 2aacbed2a3a6f2e15031dc1b1a09af33
SHA-256: 2c4a136cfd39cd5ee3036f5d33f28348c2add51f49aecbe7031ebfdb6f448512
Size: 7.32 MB - kernel-devel-2.6.32-220.7.1.el6.x86_64.rpm
MD5: f893e7165844ca13572e44768b1d97b1
SHA-256: 7c869a6351cb3fcc1bad9dca4c5bba6826ff8d0258b1c035ead45b08e753b0b0
Size: 7.28 MB - kernel-doc-2.6.32-220.7.1.el6.noarch.rpm
MD5: 807d3e4c043c3605b748d1146ee767a5
SHA-256: 455c4fc647eda45a6ee15195f85ffb68070ac7f0e2bd2569f963bb90acd330a6
Size: 9.15 MB - kernel-firmware-2.6.32-220.7.1.el6.noarch.rpm
MD5: 67dae91cca26e2e5978ebd2e6231a7d2
SHA-256: 4d454b7d8505cdd945934d4fd84655fa2b93211e89e4b09c81efec93d0a0ff47
Size: 6.24 MB - kernel-headers-2.6.32-220.7.1.el6.x86_64.rpm
MD5: c7e7420c35690aacbd87cc2b5cf987a6
SHA-256: 3e43b99b778c0c98869c6f5760ce7d5c1653e9c8b3c686f942889c24bc0473eb
Size: 1.62 MB - perf-2.6.32-220.7.1.el6.x86_64.rpm
MD5: 18341cb9188b5c8990b57927bffefe57
SHA-256: eb6d927945bf1d72a83b4a0a09681a8748137c03f82128e2c8ba029cee8e3481
Size: 1.28 MB