Scientific Linux alert SL-kern-20121219 (kernel)

From:
    	     
 
Pat Riehecky <riehecky@fnal.gov> 
To:
    	     
 
"SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV"
	<SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV> 
Subject:
    	     
 
Security ERRATA Moderate: kernel on SL6.x i386/x86_64 
Date:
    	     
 
Wed, 19 Dec 2012 09:45:12 -0600
Message-ID:
    	     
 
<50D1E108.3010707@fnal.gov>
Archive-link:
    	     
 
Article, Thread
              
Synopsis:          Moderate: kernel security, bug fix and enhancement update
Issue Date:        2012-12-18
CVE Numbers:       CVE-2012-2100
                    CVE-2012-4565
                    CVE-2012-2375
                    CVE-2012-4444
                    CVE-2012-5517
--

This update fixes the following security issues:

* It was found that a previous update did not correctly fix the 
CVE-2011-4131
issue. A malicious Network File System version 4 (NFSv4) server could return
a crafted reply to a GETACL request, causing a denial of service on the 
client.
(CVE-2012-2375, Moderate)

* A divide-by-zero flaw was found in the TCP Illinois congestion control
algorithm implementation in the Linux kernel. If the TCP Illinois congestion
control algorithm were in use (the sysctl net.ipv4.tcp_congestion_control
variable set to "illinois"), a local, unprivileged user could trigger 
this flaw
and cause a denial of service. (CVE-2012-4565, Moderate)

* A NULL pointer dereference flaw was found in the way a new node's hot 
added
memory was propagated to other nodes' zonelists. By utilizing this newly 
added
memory from one of the remaining nodes, a local, unprivileged user could use
this flaw to cause a denial of service. (CVE-2012-5517, Moderate)

* It was found that the initial release of Scientific Linux 6 did not 
correctly
fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system
code. A local, unprivileged user with the ability to mount an ext4 file 
system
could use this flaw to cause a denial of service. (CVE-2012-2100, Low)

* A flaw was found in the way the Linux kernel's IPv6 implementation handled
overlapping, fragmented IPv6 packets. A remote attacker could 
potentially use
this flaw to bypass protection mechanisms (such as a firewall or intrusion
detection system (IDS)) when sending network packets to a target system.
(CVE-2012-4444, Low)

The system must be rebooted for this update to take effect.
--

SL6
   x86_64
     kernel-2.6.32-279.19.1.el6.x86_64.rpm
     kernel-debug-2.6.32-279.19.1.el6.x86_64.rpm
     kernel-debug-debuginfo-2.6.32-279.19.1.el6.x86_64.rpm
     kernel-debug-devel-2.6.32-279.19.1.el6.x86_64.rpm
     kernel-debuginfo-2.6.32-279.19.1.el6.x86_64.rpm
     kernel-debuginfo-common-x86_64-2.6.32-279.19.1.el6.x86_64.rpm
     kernel-devel-2.6.32-279.19.1.el6.x86_64.rpm
     kernel-headers-2.6.32-279.19.1.el6.x86_64.rpm
     perf-2.6.32-279.19.1.el6.x86_64.rpm
     perf-debuginfo-2.6.32-279.19.1.el6.x86_64.rpm
     python-perf-debuginfo-2.6.32-279.19.1.el6.x86_64.rpm
     python-perf-2.6.32-279.19.1.el6.x86_64.rpm
   i386
     kernel-2.6.32-279.19.1.el6.i686.rpm
     kernel-debug-2.6.32-279.19.1.el6.i686.rpm
     kernel-debug-debuginfo-2.6.32-279.19.1.el6.i686.rpm
     kernel-debug-devel-2.6.32-279.19.1.el6.i686.rpm
     kernel-debuginfo-2.6.32-279.19.1.el6.i686.rpm
     kernel-debuginfo-common-i686-2.6.32-279.19.1.el6.i686.rpm
     kernel-devel-2.6.32-279.19.1.el6.i686.rpm
     kernel-headers-2.6.32-279.19.1.el6.i686.rpm
     perf-2.6.32-279.19.1.el6.i686.rpm
     perf-debuginfo-2.6.32-279.19.1.el6.i686.rpm
     python-perf-debuginfo-2.6.32-279.19.1.el6.i686.rpm
     python-perf-2.6.32-279.19.1.el6.i686.rpm
   noarch
     kernel-doc-2.6.32-279.19.1.el6.noarch.rpm
     kernel-firmware-2.6.32-279.19.1.el6.noarch.rpm

- Scientific Linux Development Team