[Ksplice][Fedora-15-updates] New updates available via Ksplice (FEDORA-2011-13809)

[Nelson Elhage]

Synopsis: FEDORA-2011-13809 can now be patched using Ksplice
CVEs: CVE-2011-1161 CVE-2011-1162 CVE-2011-3191

Systems running Fedora 15 can now use Ksplice to patch against the
latest Fedora security update, FEDORA-2011-13809.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack on Fedora 15 install
these updates.  You can install these updates by running:

# /usr/sbin/uptrack-upgrade -y

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any additional action.


DESCRIPTION

* NULL pointer dereference in kernel alarm timer.

A NULL pointer dereference in alarm_timer_set could allow a local,
unprivileged user to cause a denial of service.


* CVE-2011-3191: Memory corruption in CIFSFindNext.

Darren Lavender reported an issue in the Common Internet File System
(CIFS). A malicious file server could cause memory corruption leading
to a denial of service.


* CVE-2011-1161: Information leak in transmission logic of Trusted Platform Module driver.

A missing buffer size check in tpm_transmit could allow leaking of
potentially sensitive kernel memory.


* CVE-2011-1162: Information leak in Trusted Platform Module driver.

A buffer in tpm_read was not initialized before being returned to
userspace, leading to a leak of potentially sensitive kernel memory.

SUPPORT

Ksplice support is available at support at ksplice.com or +1 765-577-5423.