[El-errata] ELSA-2010-2009 Important: Oracle Linux 5 Unbreakable Enterprise kernel security fix update

[Errata Announcements for Enterprise Linux]

Oracle Linux Security Advisory ELSA-2010-2009

The following updated rpms for Oracle Linux 5 have been uploaded to the 
Unbreakable Linux Network:

x86_64:
kernel-2.6.32-100.21.1.el5.x86_64.rpm
kernel-debug-2.6.32-100.21.1.el5.x86_64.rpm
kernel-debug-devel-2.6.32-100.21.1.el5.x86_64.rpm
kernel-devel-2.6.32-100.21.1.el5.x86_64.rpm
kernel-doc-2.6.32-100.21.1.el5.noarch.rpm
kernel-firmware-2.6.32-100.21.1.el5.x86_64.rpm
kernel-headers-2.6.32-100.21.1.el5.x86_64.rpm
ofa-2.6.32-100.21.1.el5-1.5.1-4.0.23.x86_64.rpm


SRPMS:
http://oss.oracle.com/ol5/SRPMS-updates/kernel-2.6.32-100.21.1.el5.src.rpm
http://oss.oracle.com/ol5/SRPMS-updates/ofa-2.6.32-100.21.1.el5-1.5.1-4.0.23.src.rpm

Description of changes:

Following Security bug are fixed in this errata

CVE-2010-3904 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3904>
When copying data to userspace, the RDS protocol failed to verify that 
the user-provided address was a valid
userspace address.  A local unprivileged user could issue specially 
crafted socket calls to write arbitrary
values into kernel memory and potentially escalate privileges to root.

CVE-2010-3067 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3067>
Integer overflow in the do_io_submit function in fs/aio.c in the Linux 
kernel before 2.6.36-rc4-next-20100915
allows local users to cause a denial of service or possibly have 
unspecified other impact via crafted use of
the io_submit system call.

CVE-2010-3477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3477>
The tcf_act_police_dump function in net/sched/act_police.c in the 
actions implementation in the network queueing
functionality in the Linux kernel before 2.6.36-rc4 does not properly 
initialize certain structure members, which
allows local users to obtain potentially sensitive information from 
kernel memory via vectors involving a dump
operation. NOTE: this vulnerability exists because of an incomplete fix 
for CVE-2010-2942.

kernel:

[2.6.32-100.21.1.el5]
- [rds] fix access issue with rds (Chris Mason) {CVE-2010-3904}
- [fuse] linux-2.6.32-fuse-return-EGAIN-if-not-connected-bug-10154489.patch
- [net] linux-2.6.32-net-sched-fix-kernel-leak-in-act_police.patch
- [aio] 
linux-2.6.32-aio-check-for-multiplication-overflow-in-do_io_subm.patch

ofa:

[1.5.1-4.0.23]
- Fix rds permissions checks during copies

[1.5.1-4.0.21]
- Update to BXOFED 1.5.1-1.3.6-5
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.oracle.com/pipermail/el-errata/attachments/20101025/1336134d/attachment.html