Synopsis: Updated IA64 kernel packages fix security vulnerabilities
Advisory ID: RHSA-2003:198-01
Issue date: 2003-08-21
Updated on: 2003-08-21
Product: Red Hat Enterprise Linux
Keywords:
Cross references:
Obsoletes: RHSA-2003:145
CVE Names:
CAN-2003-0247 CAN-2003-0364 CAN-2003-0462 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552 CAN-2003-0619 CAN-2003-0699
- ---------------------------------------------------------------------
1. Topic:
Updated kernel packages that address several security vulnerabilites are
now available for the IA64 architecture.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
3. Problem description:
The Linux kernel handles the basic functions of the operating system.
Al Viro found a security issue in the tty layer in which any user could
cause a kernel oops. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name
CAN-2002-0247 to this issue.
A vulnerability in the kernel's TCP/IP fragment reassembly handling allows
remote attackers to cause a denial of service (CPU consumption) via packets
that cause a large number of hash table collisions. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0364 to this issue.
Paul Starzetz discovered a file read race condition in the execve() system
call, which could cause a local crash. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0462 to
this issue.
The /proc file system under Linux allows local users to obtain sensitive
information by opening various entries in /proc/self before executing a
setuid program. This causes the program to fail to change the ownership and
permissions of already-opened entries. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0501 to
this issue.
The STP protocol is known to have no security, which could allow attackers
to alter the bridge topology. STP is now turned off by default. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0550 to this issue.
The STP input processing is lax in its length checking, which could lead to
a denial of service (DoS). The kernel contained in this erratum improves
STP input processing. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name
CAN-2003-0551 to this issue.
Jerry Kreuscher discovered that the Forwarding table could be spoofed by
sending forged packets with bogus source addresses that are the same as the
local host. The Common Vulnerabilities and Exposures project cve.mitre.org)
has assigned the name
CAN-2003-0552 to this issue.
An integer signedness error in the decode_fh function of nfs3xdr.c allows
remote attackers to cause a denial of service (kernel panic) via a negative
size value within XDR data of an NFSv3 procedure call. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0619 to this issue.
The C-Media PCI sound driver in unpatched kernel versions prior to 2.4.21
accesses userspace without using the get_user function, which is a
potential security hole. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name
CAN-2003-0699 to this issue.
In addition, a number of bugfixes and updates have been applied to the IA32
emulation layer.
All users should upgrade to these errata packages, which contain patches to
the 2.4.18 kernel that address these issues.
4. Solution:
Release notes, driver notes, and driver disks for this update are available
at the following URL:
http://www.redhat.com/support/errata/rhel/
Before applying this update, make sure all previously released errata
relevant to your system have been applied, especially the additional
packages from RHSA-2002:205 and RHSA-2002:206 respectively.
The procedure for upgrading the kernel manually is documented at:
http://www.redhat.com/support/docs/howto/kernel-upgrade/
Please read the directions for your architecture carefully before
proceeding with the kernel upgrade.
Please note that this update is also available via Red Hat Network. Many
people find this to be an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system. Note that you need to select the kernel
explicitly on default configurations of up2date.
5. Bug IDs fixed (
http://bugzilla.redhat.com/bugzilla for more info):
99514 - Various kernel security issues affect Enterprise Linux kernel
92110 - System panic when loading/unload drivers and accessing /proc/pid/statm
98815 - fork()ing from a threaded program makes memory accesses unreliable
99340 - [RHEL2.1 IPF Q2] linux-2.4.2-blkioctl-sector.patch dropped
90705 - Linux kernel panic during shutdown on IBM x450
99335 - [PATCH] Reboot hangs (not completed) following run of "busy" system stress test
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/kernel-2.4.18-e.37.src.rpm
ia64:
Available from Red Hat Network: kernel-source-2.4.18-e.37.ia64.rpm
Available from Red Hat Network: kernel-smp-2.4.18-e.37.ia64.rpm
Available from Red Hat Network: kernel-doc-2.4.18-e.37.ia64.rpm
Available from Red Hat Network: kernel-2.4.18-e.37.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/kernel-2.4.18-e.37.src.rpm
ia64:
Available from Red Hat Network: kernel-source-2.4.18-e.37.ia64.rpm
Available from Red Hat Network: kernel-smp-2.4.18-e.37.ia64.rpm
Available from Red Hat Network: kernel-doc-2.4.18-e.37.ia64.rpm
Available from Red Hat Network: kernel-2.4.18-e.37.ia64.rpm
7. Verification:
MD5 sum Package Name
- --------------------------------------------------------------------------
f1329349f25cabde6cbc083a5c552947 2.1AS/en/os/SRPMS/kernel-2.4.18-e.37.src.rpm
5cefdf70820707476e671f850c9d9756 2.1AS/en/os/ia64/kernel-2.4.18-e.37.ia64.rpm
8bc24b141041a1990412c0ea1da40d6f 2.1AS/en/os/ia64/kernel-doc-2.4.18-e.37.ia64.rpm
63c9ad3469227bc5f30b885c203282d0 2.1AS/en/os/ia64/kernel-smp-2.4.18-e.37.ia64.rpm
11dc083c2f83fc9614a15a1d130b00ca 2.1AS/en/os/ia64/kernel-source-2.4.18-e.37.ia64.rpm
f1329349f25cabde6cbc083a5c552947 2.1AW/en/os/SRPMS/kernel-2.4.18-e.37.src.rpm
5cefdf70820707476e671f850c9d9756 2.1AW/en/os/ia64/kernel-2.4.18-e.37.ia64.rpm
8bc24b141041a1990412c0ea1da40d6f 2.1AW/en/os/ia64/kernel-doc-2.4.18-e.37.ia64.rpm
63c9ad3469227bc5f30b885c203282d0 2.1AW/en/os/ia64/kernel-smp-2.4.18-e.37.ia64.rpm
11dc083c2f83fc9614a15a1d130b00ca 2.1AW/en/os/ia64/kernel-source-2.4.18-e.37.ia64.rpm
These packages are GPG signed by Red Hat for security. Our key is
available from
http://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
md5sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0247
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0364
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0550
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0551
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0552
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0619
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0699
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at
http://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE/RQQ4XlSAg2UNWIIRAgNdAJ9dAQGvFYabKLbBtlie6noz29ClqwCgwh2C
tg0l9i997A12RnUBeJUrYWw=
=IauL
-----END PGP SIGNATURE-----
