kernel-2.6.32-279.14.1.el6
エラータID: AXSA:2012-1018:09
リリース日:
2012/12/13 Thursday - 13:58
題名:
kernel-2.6.32-279.14.1.el6
影響のあるチャネル:
Asianux Server 4 for x86
Asianux Server 4 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- rio_ioctl関数はSIOCSMIIREGコマンドへのアクセスを制限していませんでした。Ioctlコールを使って権限のないローカルユーザがEthernetアダプターにデータを書き込む危険性があります。(CVE-2012-2313)
- 32bitプラットフォームにおいてDRM(Direct Rendering Manager)サブシステムのi915_gem_do_execbuffer関数に整数オーバーフローが検出されました。細工したioctlコールを使って権限のないローカルユーザがサービス拒否またはインパクト不明な障害を引き起こす危険性があります。(CVE-2012-2384)
- mm/hugetlb.cにメモリリークが検出されました。不正なMAP_HUGETLB mmapオペレーションを使って、権限のないローカルユーザがサービス拒否(システムクラッシュ)を引き起こす危険性があります。(CVE-2012-2390)
- rds_recvmsg関数は特定の構造体のメンバを初期化していませんでした。RDSソケットに対してrecvfromまたはrecvmsgシステムコールを使って権限のないローカルユーザがカーネルメモリの情報を取得する危険性があります。(CVE-2012-3430)
- IPの実装にセキュリティ上の欠陥が検出されました。ネットワークトラフィックを処理中にソケットオプションをセットするアプリケーションにパケットを送信することにより、リモートアタッカーがサービス拒否(システムクラッシュ)を引き起こす危険性があります。(CVE-2012-3552)
- sfcドライバにセキュリティ上の欠陥が検出されました。細工したTCPパケットを使ってリモートアタッカーがサービス拒否を引き起こす危険性があります。(CVE-2012-3412)
- 多くのsharedライブラリを使う32bitバイナリを実行中にライブラリの1つが常に予測可能なアドレスにロードされる問題が検出されました。アタッカーがASLR(Address Space Layout Randomization)セキュリティ機能を回避できる危険性があります。(CVE-2012-1568)
- huge pagesが有効な場合にfree後参照の問題が検出されました。権限のないローカルユーザがサービス拒否(システムクラッシュ)または権限の取得ができる危険性があります。(CVE-2012-2133)
- udf_load_logicalvol関数にヒープベースのバッファオーバーフローが検出されました。細工したUDFファイルシステムを使って、リモートアタッカーがサービス拒否(システムクラッシュ)を引き起こす危険性があります。(CVE-2012-3400)
- madvise_remove関数に複数の競合状態が検出されました。munmapまたはcloseシステムコールを使って権限のないローカルユーザがサービス拒否(システムクラッシュ)を引き起こす危険性があります。(CVE-2012-3511)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2012-2313
The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call.
The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call.
CVE-2012-2384
Integer overflow in the i915_gem_do_execbuffer function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
Integer overflow in the i915_gem_do_execbuffer function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
CVE-2012-2390
Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAP_HUGETLB mmap operations.
Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAP_HUGETLB mmap operations.
CVE-2012-3430
The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.
The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.
CVE-2012-3552
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
CVE-2012-3412
The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.
The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.
CVE-2012-1568
The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.
The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.
CVE-2012-2133
Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data.
Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data.
CVE-2012-3400
Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.
Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.
CVE-2012-3511
Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.
Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.
追加情報:
N/A
ダウンロード:
SRPMS
- kernel-2.6.32-279.14.1.el6.src.rpm
MD5: 860c9965916609ea33d1669fa04c7baa
SHA-256: 9c33635db8d552cc85be515ba9697a66f9e99b44e3ef51210259f3b9555c6081
Size: 81.69 MB
Asianux Server 4 for x86
- kernel-2.6.32-279.14.1.el6.i686.rpm
MD5: cd2118643ae64dbfc318626063fadfa3
SHA-256: 027e96a2506735abb118aa5e7e263a904c7628108f74140a90153a847ab6c85b
Size: 23.24 MB - kernel-debug-2.6.32-279.14.1.el6.i686.rpm
MD5: 9f325c58636cbe86c71bd4e7af6b8d73
SHA-256: 54e9bc48b6a6fc2d87caba150ad263b6ec73ff36838e792459dbb7725fcafdc7
Size: 23.74 MB - kernel-debug-devel-2.6.32-279.14.1.el6.i686.rpm
MD5: da0e2738dbe12c74068bbb314efcedf7
SHA-256: a629ddf6b27f2f5e9e9eca450815f89756f6e14612b9fb01c259d11205b54e1c
Size: 7.65 MB - kernel-devel-2.6.32-279.14.1.el6.i686.rpm
MD5: d009624bedb3727a8cde1472ce031ceb
SHA-256: cb13844f1acbb29160ec7941231e91faad47696d9eeff326d4e6d4beeacf8677
Size: 7.61 MB - kernel-doc-2.6.32-279.14.1.el6.noarch.rpm
MD5: 5120ea36c1cf7a18d43592ada611b87d
SHA-256: cd716fa3d2a170ba1393927519c99fdb77b13572bd57843236a58190bad52de6
Size: 9.48 MB - kernel-firmware-2.6.32-279.14.1.el6.noarch.rpm
MD5: af6af682cfde512c72102feadbd2f1f5
SHA-256: c73ddf2119e8d4390949c8616290350b15924cb3e4dac590739bdc180461c1c4
Size: 8.69 MB - kernel-headers-2.6.32-279.14.1.el6.i686.rpm
MD5: 9b3ce8953c09800e8e98c4df7fc0d991
SHA-256: ba9f0df7d9f33b1809749767222ebfc7c0024983217f95ddb82d57e0ec78cf21
Size: 1.91 MB - perf-2.6.32-279.14.1.el6.i686.rpm
MD5: 26f32a90cb7635d0231687b4e7a1cc8d
SHA-256: 499f8e31410b216c28e25677b0bd37ae5c227b7908be0738e753acd8f8cd798f
Size: 1.56 MB
Asianux Server 4 for x86_64
- kernel-2.6.32-279.14.1.el6.x86_64.rpm
MD5: 0e83acf41da98dc681cde0b6892e6a68
SHA-256: 048ddc0228bbce27d4e183fe65aeb7b4b2b8f6d064252c4c6000c9209651fa50
Size: 25.26 MB - kernel-debug-2.6.32-279.14.1.el6.x86_64.rpm
MD5: bb0c49604c528c0651104a56d9c8756b
SHA-256: faa428f26e9eeae1da6204d10df393a1eacf586240a0d2ebe98404e937315be2
Size: 25.84 MB - kernel-devel-2.6.32-279.14.1.el6.x86_64.rpm
MD5: 430a84c816a2ca0acb124a721ac1985f
SHA-256: b8259b4e078d58bfb8e67e52c78910836e52e4ee759cbded25ac474bd9f3b067
Size: 7.65 MB - kernel-doc-2.6.32-279.14.1.el6.noarch.rpm
MD5: 0c28a63c4cb4e263c086132f1562b8e0
SHA-256: a0dda0b5435ff0d53fda799a01755ae3ac0f17a494672e9fa69724d1daf23125
Size: 9.48 MB - kernel-firmware-2.6.32-279.14.1.el6.noarch.rpm
MD5: 025e783073c422fcc6cab4ab88ee6efb
SHA-256: 4613fe41b8e592cc3dfa08a6b8803309418d6745ed9e5f53fa01e0a18d37beed
Size: 8.69 MB - kernel-headers-2.6.32-279.14.1.el6.x86_64.rpm
MD5: 1865edb87a6cd893e96439a8c72aa280
SHA-256: db8962109e097d16b88d7157b9d6190d825e50f62348688d6fdc643132b7483e
Size: 1.91 MB - perf-2.6.32-279.14.1.el6.x86_64.rpm
MD5: ea59d90e097931a928fa5f30ad797132
SHA-256: 945cb52f0427459579f9cfbed9dd1b1b4c555c8f974119d2d3377f20b664e4fd
Size: 1.58 MB