kernel-2.6.18-308.3.AXS3
エラータID: AXSA:2012-550:04
リリース日:
2012/07/23 Monday - 12:03
題名:
kernel-2.6.18-308.3.AXS3
影響のあるチャネル:
Asianux Server 3 for x86_64
Asianux Server 3 for x86
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- xfrm6_tunnel_rcv関数に二重解放が検出されました。xfrm6_tunnelモジュールが有効な場合、細工したIPv6パケットを使ってリモートアタッカーがサービス拒否(panic)を引き起こす危険性があります。(CVE-2012-1583)
- sock_alloc_send_pskb関数のdata_len引数は使用前に検証されていませんでした。この欠陥を利用してTUN/TAP仮想インターフェースへのアクセス権を持ったローカルユーザがシステムをクラッシュさせる、または権限のエスカレーションを行う危険性があります。(CVE-2012-2136)
- 古いAMDのCPUを持つ環境においてXenハイパーバイザ上で動作するゲストOSがCPUハードロックアップを引き起こす危険性が検出されました。この欠陥を利用して64bitの準仮想化ゲストOS内の特権を持たないローカルユーザがホストOSをクラッシュさせる危険性があります。(CVE-2012-2934)
[Bug Fix]
- 一部の機種においてi8042ドライバのprobe処理がnmi_watchdog機能を誤動作させる場合があります。この問題を回避するためのカーネルパラメータ i8042.noprobe=1 を追加しました。
- 一部のBIOS実装では誰もハンドリングしなくなってもIntel GPUの割り込みを有効にしたままにしていました。モニタの接続ケーブルを外した際にクラッシュする可能性があります。
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2012-1583
Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.
Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.
CVE-2012-0217
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
CVE-2012-2136
The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.
The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.
CVE-2012-2934
Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.
Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.
追加情報:
N/A
ダウンロード:
Asianux Server 3 for x86
- kernel-2.6.18-308.3.AXS3.i686.rpm
MD5: 14ad47fe7087d08084777172615ac9fe
SHA-256: 81a7a747ba16b4c634e66bbf73f05cdfb6e067c81ea02df9191280a4cc2c26df
Size: 19.66 MB - kernel-devel-2.6.18-308.3.AXS3.i686.rpm
MD5: c74b29cb646ff39d37ba2ef24fe75c9e
SHA-256: 0702c108f50ae1ef72d292e1f4f0813c6c2681a3c0616d16ef16057ca2def22c
Size: 5.91 MB - kernel-PAE-2.6.18-308.3.AXS3.i686.rpm
MD5: bfb94fb4781eb03383211f34087f0ca4
SHA-256: ad78304349bb0205355c8e601b761138b90aa715e79af8fed5c9a5a52590965e
Size: 19.68 MB - kernel-PAE-devel-2.6.18-308.3.AXS3.i686.rpm
MD5: 36502fccf6c7a128731e39bb94f4ea76
SHA-256: 307d77e682bce4eb737b1c9ccf7bf7f4613f4150a4d3b2f5e678585951245b2e
Size: 5.92 MB - kernel-xen-2.6.18-308.3.AXS3.i686.rpm
MD5: 43617856e7260bcb7af29d040ca57a1c
SHA-256: 59f5bd2a3c4a4ee33b0b06aa72548a7dad400e808e2dba6ac5336f3f957bdfa1
Size: 20.84 MB - kernel-xen-devel-2.6.18-308.3.AXS3.i686.rpm
MD5: f7c83c2badac41a335711f9a9015ee8b
SHA-256: 348ab8ea2083fde530e3e9811623cf03a843110685a55882961d7a154ec3c995
Size: 5.92 MB - kernel-doc-2.6.18-308.3.AXS3.noarch.rpm
MD5: c96a172d01f2ecef60f74d5308df188e
SHA-256: 740a533dd5118289129335cd045232db6b233d1b5c88c5c5aaf5c72113bb5885
Size: 3.38 MB - kernel-headers-2.6.18-308.3.AXS3.i386.rpm
MD5: c69e2cc8348d969c92eee96422acfbe7
SHA-256: 001cb268ef907a75d390d320d463936aa48f97df066ed9a60c41a031e72f73ce
Size: 1.35 MB
Asianux Server 3 for x86_64
- kernel-2.6.18-308.3.AXS3.x86_64.rpm
MD5: 5eb3f776e9d088385d53fa0938d899b3
SHA-256: af89e4d63a9843b1899767505c20e4de6fc9be95206ece195bd2082b1fb26ced
Size: 21.77 MB - kernel-devel-2.6.18-308.3.AXS3.x86_64.rpm
MD5: e4d93238b9326297d537e470f2626b97
SHA-256: fa32baa4c72eef21c896eb3f3f408de90583c252de5d7e2c1e0a2ba1b4075cee
Size: 5.92 MB - kernel-headers-2.6.18-308.3.AXS3.x86_64.rpm
MD5: c74e04c84d01f11e96889bc22ec6e9f3
SHA-256: 37617498d0d9016e9eee17a6eb112a451cf53053093151988accc115647cacae
Size: 1.39 MB - kernel-xen-2.6.18-308.3.AXS3.x86_64.rpm
MD5: fbf32a4c9fcf195949f2167753cea285
SHA-256: 7043457e7bae4a1fc34081a5469d6af4f9747c3b4d136acbc3c03985a8ade93e
Size: 22.70 MB - kernel-xen-devel-2.6.18-308.3.AXS3.x86_64.rpm
MD5: d5a32b2c72e38213fd26ef23fb50b52e
SHA-256: a3756be5d486fd82395286d9ea3ea37c8215b4a08429de23576ddd9ee7354993
Size: 5.92 MB - kernel-doc-2.6.18-308.3.AXS3.noarch.rpm
MD5: df8d4b084547aed2c92c8a1057391ba6
SHA-256: 8a1b049471b300674473fbf74bd324ea4d8dac20fcc2a6e21a40d42762f064e8
Size: 3.38 MB