Red Hat ENTERPRISE 5.4 RELEASE NOTES, Manual

Page: 134 / 466

Chapter 1. Package Updates
116
Updated kernel packages that fix several security issues and several bugs are now available for Red
Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red Hat Security Response
Team.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security fixes:
• the possibility of a timeout value overflow was found in the Linux kernel high-resolution timers
functionality, hrtimers. This could allow a local, unprivileged user to execute arbitrary code, or cause
a denial of service (kernel panic). (
CVE-2007-5966
773
, Important)
• a flaw was found in the Intel PRO/1000 network driver in the Linux kernel. Frames with sizes near
the MTU of an interface may be split across multiple hardware receive descriptors. Receipt of such
a frame could leak through a validation check, leading to a corruption of the length check. A remote
attacker could use this flaw to send a specially-crafted packet that would cause a denial of service
or code execution. (
CVE-2009-1385
774
, Important)
• Michael Tokarev reported a flaw in the Realtek r8169 Ethernet driver in the Linux kernel. This driver
allowed interfaces using this driver to receive frames larger than could be handled, which could lead
to a remote denial of service or code execution. (
CVE-2009-1389
775
, Important)
• the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a setuid
or setgid program was executed. A local, unprivileged user could use this flaw to bypass the
mmap_min_addr protection mechanism and perform a NULL pointer dereference attack, or bypass
the Address Space Layout Randomization (ASLR) security feature. (
CVE-2009-1895
776
, Important)
• Ramon de Carvalho Valle reported two flaws in the Linux kernel eCryptfs implementation. A local
attacker with permissions to perform an eCryptfs mount could modify the metadata of the files in
that eCrypfts mount to cause a buffer overflow, leading to a denial of service or privilege escalation.
(
CVE-2009-2406
777
,
CVE-2009-2407
778
, Important)
• Konstantin Khlebnikov discovered a race condition in the ptrace implementation in the Linux kernel.
This race condition can occur when the process tracing and the process being traced participate in
a core dump. A local, unprivileged user could use this flaw to trigger a deadlock, resulting in a partial
denial of service. (
CVE-2009-1388
779
, Moderate)
Bug fixes:
• possible host (dom0) crash when installing a Xen para-virtualized guest while another para-
virtualized guest was rebooting. (
BZ#497812
780
)
• no audit record for a directory removal if the directory and its subtree were recursively watched by
an audit rule. (
BZ#507561
781
)
• page caches in memory can be freed up using the Linux kernel's drop_caches feature. If
drop_pagecache_sb()
and
prune_icache()
ran concurrently, however, a missing test in drop-
pagecache_sb() could cause a kernel panic. For example, running
echo 1 > /proc/sys/vm/
drop_caches
or
sysctl .w vm.drop_caches=1
on systems under high memory load could
cause a kernel panic or system hang. With this update, the missing test has been added and the
drop_cache feature frees up page caches properly. Consequently these system failures no longer
occur, even under high memory load. (
BZ#503692
782
)