SuSE: 2010-023: Linux kernel Security Update
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Announcement
Package: kernel
Announcement ID: SUSE-SA:2010:023
Date: Thu, 06 May 2010 13:00:00 +0000
Affected Products: SLE SDK 10 SP2
SUSE Linux Enterprise Desktop 10 SP2
SUSE Linux Enterprise Server 10 SP2
Vulnerability Type: remote denial of service
CVSS v2 Base Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
SUSE Default Package: yes
Cross-References: CVE-2009-4020, CVE-2009-4537, CVE-2010-0410
CVE-2010-1083, CVE-2010-1086, CVE-2010-1088
Content of This Advisory:
1) Security Vulnerability Resolved:
Linux kernel security update
Problem Description
2) Solution or Work-Around
3) Special Instructions and Notes
4) Package Location and Checksums
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
See SUSE Security Summary Report.
6) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Problem Description and Brief Discussion
This update fixes several security issues and various bugs in the
SUSE Linux Enterprise 10 SP 2 kernel. The bugs fixed include a serious
data corruption regression in NFSv4 introduced by the previous update.
Following security issues were fixed:
CVE-2009-4537: drivers/net/r8169.c in the r8169 driver in the Linux
kernel does not properly check the size of an Ethernet frame that
exceeds the MTU, which allows remote attackers to (1) cause a denial
of service (temporary network outage) via a packet with a crafted
size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of
service (system crash) via a packet with a crafted size, in conjunction
with certain packets containing '0' characters, related to the value
of the status register and erroneous behavior associated with the
RxMaxSize register.
CVE-2010-1086: The ULE decapsulation functionality in
drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in the Linux kernel
earlier allows attackers to cause a denial of service (infinite loop)
via a crafted MPG2-TS frame, related to an invalid Payload Pointer
ULE.
CVE-2010-1088: fs/namei.c in Linux kernel does not always follow NFS
automount "symlinks," which allows attackers to have an unknown impact,
related to LOOKUP_FOLLOW.
CVE-2009-4020: Stack-based buffer overflow in the hfs subsystem in the
Linux kernel allows remote attackers to have an unspecified impact
via a crafted Hierarchical File System (HFS) filesystem, related to
the hfs_readdir function in fs/hfs/dir.c.
CVE-2010-1083: The processcompl_compat function in
drivers/usb/core/devio.c in the Linux kernel does not clear the
transfer buffer before returning to user space when a USB command
fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory).
CVE-2010-0410: drivers/connector/connector.c in the Linux kernel
allows local users to cause a denial of service (memory consumption and
system crash) by sending the kernel many NETLINK_CONNECTOR messages.
2) Solution or Work-Around
There is no known workaround, please install the update packages.
3) Special Instructions and Notes
Please reboot the machine after installing the update.
4) Package Location and Checksums
The preferred method for installing security updates is to use the YaST
Online Update (YOU) tool. YOU detects which updates are required and
automatically performs the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command
rpm -Fhv
References
