The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A flaw in the dccp_rcv_state_process() function could     allow a remote attacker to cause a denial of service,     even when the socket was already closed. (CVE-2011-1093,     Important)

  - Multiple buffer overflow flaws were found in the Linux     kernel's Management Module Support for Message Passing     Technology (MPT) based controllers. A local,     unprivileged user could use these flaws to cause a     denial of service, an information leak, or escalate     their privileges. (CVE-2011-1494, CVE-2011-1495,     Important)

  - A missing validation of a null-terminated string data     structure element in the bnep_sock_ioctl() function     could allow a local user to cause an information leak or     a denial of service. (CVE-2011-1079, Moderate)

  - Missing error checking in the way page tables were     handled in the Xen hypervisor implementation could allow     a privileged guest user to cause the host, and the     guests, to lock up. (CVE-2011-1166, Moderate)

  - A flaw was found in the way the Xen hypervisor     implementation checked for the upper boundary when     getting a new event channel port. A privileged guest     user could use this flaw to cause a denial of service or     escalate their privileges. (CVE-2011-1763, Moderate)

  - The start_code and end_code values in '/proc/[pid]/stat'     were not protected. In certain scenarios, this flaw     could be used to defeat Address Space Layout     Randomization (ASLR). (CVE-2011-0726, Low)

  - A missing initialization flaw in the     sco_sock_getsockopt() function could allow a local,     unprivileged user to cause an information leak.
    (CVE-2011-1078, Low)

  - A missing validation of a null-terminated string data     structure element in the do_replace() function could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1080, Low)

  - A buffer overflow flaw in the DEC Alpha OSF partition     implementation in the Linux kernel could allow a local     attacker to cause an information leak by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1163, Low)

  - Missing validations of null-terminated string data     structure elements in the do_replace(),     compat_do_replace(), do_ipt_get_ctl(),     do_ip6t_get_ctl(), and do_arpt_get_ctl() functions could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1170,     CVE-2011-1171, CVE-2011-1172, Low)

  - A heap overflow flaw in the Linux kernel's EFI GUID     Partition Table (GPT) implementation could allow a local     attacker to cause a denial of service by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1577, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

Collective May/2011 update for Xen

Xen :

  - 691238 - L3: question on behaviour change xm list

  - 623680 - xen kernel freezes during boot when processor     module is loaded

  - 680824 - dom0 can't recognize boot disk when IOMMU is     enabled

  - 688473 - VUL-0: potential buffer overflow in tools

  - 679344 - VUL-0: Xen: multi-vCPU pv guest may crash host

  - 687981 - L3: mistyping model type when defining VIF     crashes

  - 675817 - Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871 - dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related

  - 678229 - restore of sles HVM fails

  - 672833 - xen-tools bug causing problems with Ubuntu     10.10 under Xen 4.

  - 665610 - xm console > 1 to same VM messes up both     consoles

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-264:04 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2011-0726     The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an     expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by     reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE     binary.
    CVE-2011-1093     The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP)     implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint,     which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending     a DCCP-Close packet followed by a DCCP-Reset packet.
    CVE-2011-1170     net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not     place the expected '0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1171     net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place     the expected '0' character at the end of string data in the values of certain structure members, which     allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1172     net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not     place the expected '0' character at the end of string data in the values of certain structure members,     which allows local users to obtain potentially sensitive information from kernel memory by leveraging the     CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting     modprobe process.
    CVE-2011-1163     The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly     handle an invalid number of partitions, which might allow local users to obtain potentially sensitive     information from kernel heap memory via vectors related to partition-table parsing.
    CVE-2011-1494     Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux     kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory     corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
    CVE-2011-1495     drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and     (2) offset values before performing memory copy operations, which might allow local users to gain     privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel     memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
    CVE-2011-1577     Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    CVE-2011-1078     CVE-2011-1079     CVE-2011-1080     CVE-2011-1166     CVE-2011-1763     No descriptions at the time of writing, please use the CVE links below.
    Fixed bugs:
    For an exhasive list of other fixes, please refer to the changelog

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This collective June/2011 Update for Xen provides the following fixes :

  - Xen does not properly check the upper boundary of     user-supplied data in the get_free_port() function when     getting a new event channel port. A local user on the     guest operating system can exploit this flaw to cause     denial of service conditions or potentially gain     elevated privileges. (CVE-2011-1166)

  - 654798: Fix race between hotplug scripts writing to     xenstore and xend registering a watch for the write.

  - 684297: HVM taking too long to dump vmcore

  - 688757: Fix kernel panic on fully virtualized setup

  - 658413: Fix root drive search on SLES 10-SP3 HVM guest

  - 675363: Random lockups with kernel-xen related to     graphics

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0833 advisory.

    - [scsi] mpt2sas: prevent heap overflows and unchecked access (Tomas Henzl) [694526 694527] {CVE-2011-1495     CVE-2011-1494}
    - [net] bridge/netfilter: fix ebtables information leak (Don Howard) [681325 681326] {CVE-2011-1080}
    - [net] bluetooth: fix sco information leak to userspace (Don Howard) [681310 681311] {CVE-2011-1078}
    - [fs] fix corrupted GUID partition table kernel oops (Jerome Marchand) [695979 695980] {CVE-2011-1577}
    - [xen] x86/domain: fix error checks in arch_set_info_guest (Laszlo Ersek) [688581 688582] {CVE-2011-1166}
    - [fs] partitions: Fix corrupted OSF partition table parsing (Danny Feng) [688022 688023] {CVE-2011-1163}
    - [net] netfilter: ip6_tables: fix infoleak to userspace (Jiri Pirko) [689348 689349] {CVE-2011-1172}
    - [net] netfilter/ip_tables: fix infoleak to userspace (Jiri Pirko) [689331 689332] {CVE-2011-1171}
    - [net] netfilter/arp_tables: fix infoleak to userspace (Jiri Pirko) [689322 689323] {CVE-2011-1170}
    - [fs] proc: protect mm start_/end_code in /proc/pid/stat (Eugene Teo) [684570 684571] {CVE-2011-0726}
    - [net] dccp: fix oops in dccp_rcv_state_process (Eugene Teo) [682955 682956] {CVE-2011-1093}
    - [net] bluetooth: fix bnep buffer overflow (Don Howard) [681318 681319] {CVE-2011-1079}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0833 advisory.

  - kernel: proc: protect mm start_code/end_code in /proc/pid/stat (CVE-2011-0726)

  - kernel: bt sco_conninfo infoleak (CVE-2011-1078)

  - kernel: bnep device field missing NULL terminator (CVE-2011-1079)

  - kernel: ebtables stack infoleak (CVE-2011-1080)

  - kernel: dccp: fix oops on Reset after close (CVE-2011-1093)

  - kernel: fs/partitions: Corrupted OSF partition table infoleak (CVE-2011-1163)

  - kernel: xen: x86_64: fix error checking in arch_set_info_guest() (CVE-2011-1166)

  - kernel: ipv4: netfilter: arp_tables: fix infoleak to userspace (CVE-2011-1170)

  - kernel: ipv4: netfilter: ip_tables: fix infoleak to userspace (CVE-2011-1171)

  - kernel: ipv6: netfilter: ip6_tables: fix infoleak to userspace (CVE-2011-1172)

  - kernel: drivers/scsi/mpt2sas: prevent heap overflows (CVE-2011-1494, CVE-2011-1495)

  - kernel: corrupted GUID partition tables can cause kernel oops (CVE-2011-1577)

  - kernel: xen: improper upper boundary check in get_free_port() function (CVE-2011-1763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
61059	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
75776	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0580-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
284281	MiracleLinux 3 : kernel-2.6.18-194.13.AXS3 (AXSA:2011-264:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/19	high
57265	SuSE 10 Security Update : Xen (ZYPP Patch Number 7547)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	medium
68276	Oracle Linux 5 : kernel (ELSA-2011-0833)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	high
54925	RHEL 5 : kernel (RHSA-2011:0833)	Nessus	Red Hat Local Security Checks	2011/6/1	2024/4/21	high

偵測

搜尋 Plugin

high

medium

high

medium

high

high