Sigurnosni nedostatak u jezgri operacijskog sustava

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: kernel security, bug fix, and enhancement update
Advisory ID: RHSA-2016:0494-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-0494.html
Issue date: 2016-03-22
CVE Names: CVE-2016-0774
=====================================================================

1. Summary:

Updated kernel packages that fix one security issue, several bugs, and add
one enhancement are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) – i386, noarch, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) – i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) – noarch, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) – x86_64
Red Hat Enterprise Linux Server (v. 6) – i386, noarch, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) – i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) – i386, noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) – i386, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

* It was found that the fix for CVE-2015-1805 incorrectly kept buffer
offset and buffer length in sync on a failed atomic read, potentially
resulting in a pipe buffer state corruption. A local, unprivileged user
could use this flaw to crash the system or leak kernel memory to user
space. (CVE-2016-0774, Moderate)

The security impact of this issue was discovered by Red Hat.

This update also fixes the following bugs:

* In the anon_vma structure, the degree counts number of child anon_vmas
and of VMAs which points to this anon_vma. Failure to decrement the
parent’s degree in the unlink_anon_vma() function, when its list was empty,
previously triggered a BUG_ON() assertion. The provided patch makes sure
the anon_vma degree is always decremented when the VMA list is empty, thus
fixing this bug. (BZ#1318364)

* When running Internet Protocol Security (IPSEC) on external storage
encrypted with LUKS under a substantial load on the system, data
corruptions could previously occur. A set of upstream patches has been
provided, and data corruption is no longer reported in this situation.
(BZ#1298994)

* Due to prematurely decremented calc_load_task, the calculated load
average was off by up to the number of CPUs in the machine. As a
consequence, job scheduling worked improperly causing a drop in the system
performance. This update keeps the delta of the CPU going into NO_HZ idle
separately, and folds the pending idle delta into the global active count
while correctly aging the averages for the idle-duration when leaving NO_HZ
mode. Now, job scheduling works correctly, ensuring balanced CPU load.
(BZ#1300349)

* Due to a regression in the Red Hat Enterprise Linux 6.7 kernel, the
cgroup OOM notifier accessed a cgroup-specific internal data structure
without a proper locking protection, which led to a kernel panic. This
update adjusts the cgroup OOM notifier to lock internal data properly,
thus fixing the bug. (BZ#1302763)

* GFS2 had a rare timing window that sometimes caused it to reference an
uninitialized variable. Consequently, a kernel panic occurred. The code has
been changed to reference the correct value during this timing window, and
the kernel no longer panics. (BZ#1304332)

* Due to a race condition whereby a cache operation could be submitted
after a cache object was killed, the kernel occasionally crashed on systems
running the cachefilesd service. The provided patch prevents the race
condition by adding serialization in the code that makes the object
unavailable. As a result, all subsequent operations targetted on the object
are rejected and the kernel no longer crashes in this scenario.
(BZ#1308471)

This update also adds this enhancement:

* The lpfc driver has been updated to version 11.0.0.4. (BZ#1297838)

All kernel users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues and add this
enhancement. The system must be rebooted for this update to take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1303961 – CVE-2016-0774 kernel: pipe buffer state corruption after unsuccessful atomic read from pipe

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
kernel-2.6.32-573.22.1.el6.src.rpm

i386:
kernel-2.6.32-573.22.1.el6.i686.rpm
kernel-debug-2.6.32-573.22.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-573.22.1.el6.i686.rpm
kernel-debug-devel-2.6.32-573.22.1.el6.i686.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-573.22.1.el6.i686.rpm
kernel-devel-2.6.32-573.22.1.el6.i686.rpm
kernel-headers-2.6.32-573.22.1.el6.i686.rpm
perf-2.6.32-573.22.1.el6.i686.rpm
perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm

noarch:
kernel-abi-whitelists-2.6.32-573.22.1.el6.noarch.rpm
kernel-doc-2.6.32-573.22.1.el6.noarch.rpm
kernel-firmware-2.6.32-573.22.1.el6.noarch.rpm

x86_64:
kernel-2.6.32-573.22.1.el6.x86_64.rpm
kernel-debug-2.6.32-573.22.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-573.22.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-573.22.1.el6.i686.rpm
kernel-debug-devel-2.6.32-573.22.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.i686.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-573.22.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-573.22.1.el6.x86_64.rpm
kernel-devel-2.6.32-573.22.1.el6.x86_64.rpm
kernel-headers-2.6.32-573.22.1.el6.x86_64.rpm
perf-2.6.32-573.22.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm
perf-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

i386:
kernel-debug-debuginfo-2.6.32-573.22.1.el6.i686.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-573.22.1.el6.i686.rpm
perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm
python-perf-2.6.32-573.22.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.i686.rpm

x86_64:
kernel-debug-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-573.22.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm
python-perf-2.6.32-573.22.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
kernel-2.6.32-573.22.1.el6.src.rpm

noarch:
kernel-abi-whitelists-2.6.32-573.22.1.el6.noarch.rpm
kernel-doc-2.6.32-573.22.1.el6.noarch.rpm
kernel-firmware-2.6.32-573.22.1.el6.noarch.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Red Hat Enterprise Linux Server (v. 6):

Source:
kernel-2.6.32-573.22.1.el6.src.rpm

noarch:
kernel-abi-whitelists-2.6.32-573.22.1.el6.noarch.rpm
kernel-doc-2.6.32-573.22.1.el6.noarch.rpm
kernel-firmware-2.6.32-573.22.1.el6.noarch.rpm

ppc64:
kernel-2.6.32-573.22.1.el6.ppc64.rpm
kernel-bootwrapper-2.6.32-573.22.1.el6.ppc64.rpm
kernel-debug-2.6.32-573.22.1.el6.ppc64.rpm
kernel-debug-debuginfo-2.6.32-573.22.1.el6.ppc64.rpm
kernel-debug-devel-2.6.32-573.22.1.el6.ppc64.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.ppc64.rpm
kernel-debuginfo-common-ppc64-2.6.32-573.22.1.el6.ppc64.rpm
kernel-devel-2.6.32-573.22.1.el6.ppc64.rpm
kernel-headers-2.6.32-573.22.1.el6.ppc64.rpm
perf-2.6.32-573.22.1.el6.ppc64.rpm
perf-debuginfo-2.6.32-573.22.1.el6.ppc64.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.ppc64.rpm

s390x:
kernel-2.6.32-573.22.1.el6.s390x.rpm
kernel-debug-2.6.32-573.22.1.el6.s390x.rpm
kernel-debug-debuginfo-2.6.32-573.22.1.el6.s390x.rpm
kernel-debug-devel-2.6.32-573.22.1.el6.s390x.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.s390x.rpm
kernel-debuginfo-common-s390x-2.6.32-573.22.1.el6.s390x.rpm
kernel-devel-2.6.32-573.22.1.el6.s390x.rpm
kernel-headers-2.6.32-573.22.1.el6.s390x.rpm
kernel-kdump-2.6.32-573.22.1.el6.s390x.rpm
kernel-kdump-debuginfo-2.6.32-573.22.1.el6.s390x.rpm
kernel-kdump-devel-2.6.32-573.22.1.el6.s390x.rpm
perf-2.6.32-573.22.1.el6.s390x.rpm
perf-debuginfo-2.6.32-573.22.1.el6.s390x.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.s390x.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

ppc64:
kernel-debug-debuginfo-2.6.32-573.22.1.el6.ppc64.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.ppc64.rpm
kernel-debuginfo-common-ppc64-2.6.32-573.22.1.el6.ppc64.rpm
perf-debuginfo-2.6.32-573.22.1.el6.ppc64.rpm
python-perf-2.6.32-573.22.1.el6.ppc64.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.ppc64.rpm

s390x:
kernel-debug-debuginfo-2.6.32-573.22.1.el6.s390x.rpm
kernel-debuginfo-2.6.32-573.22.1.el6.s390x.rpm
kernel-debuginfo-common-s390x-2.6.32-573.22.1.el6.s390x.rpm
kernel-kdump-debuginfo-2.6.32-573.22.1.el6.s390x.rpm
perf-debuginfo-2.6.32-573.22.1.el6.s390x.rpm
python-perf-2.6.32-573.22.1.el6.s390x.rpm
python-perf-debuginfo-2.6.32-573.22.1.el6.s390x.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
kernel-2.6.32-573.22.1.el6.src.rpm

noarch:
kernel-abi-whitelists-2.6.32-573.22.1.el6.noarch.rpm
kernel-doc-2.6.32-573.22.1.el6.noarch.rpm
kernel-firmware-2.6.32-573.22.1.el6.noarch.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-0774
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iD8DBQFW8b8SXlSAg2UNWIIRAq8OAJ0Y4bFtarqu+9HC3rYZ+K2DILDbFACeMkEC
yBJF6H2aOZ3X0GCBq+vPDNY=
=5fPn
—–END PGP SIGNATURE—–

—
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

Sigurnosni nedostatak u jezgri operacijskog sustava

Archives

More in Preporuke

Sigurnosni nedostaci programskog paketa webkitgtk