Download/kernel/rhel6/042stab124.2/changes

ChangesEdit

Since 042stab123.9:

• Rebase to RHEL6u9 kernel 2.6.32-696.10.1.el6 (security, bug fixes, and enhancements)
• [Important] An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function. (CVE-2017-7542)
• [Important] Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing. (CVE-2017-10661)
• [Important] A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets are implemented in the Linux kernel networking subsystem handling synchronization. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) could use this flaw to elevate their privileges on the system. (CVE-2017-1000111)
• [Important] Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload (UFO) code in the Linux kernel. A local attacker could use this to cause a denial of service or execute arbitrary code. (CVE-2017-1000112)
• [Moderate] Kernel memory corruption due to a buffer overflow was found in brcmf_cfg80211_mgmt_tx() function in Linux kernels from v3.9-rc1 to v4.13-rc1. The vulnerability can be triggered by sending a crafted NL80211_CMD_FRAME packet via netlink. This flaw is unlikely to be triggered remotely as certain userspace code is needed for this. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. (CVE-2017-7541)
• [Moderate] The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to possibly cause a situation where a value may be used after being freed (use after free) which may lead to memory corruption or other unspecified other impact. (CVE-2017-11176)
• [Moderate] The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path. (CVE-2017-14106)
• Stopping a container with NFS server inside could crash the host with BUG at kernel/bc/dcache.c:370. (PSBM-34802, PSBM-43499, PSBM-68560, OVZ-5610)
• Under certain circumstances container could crash the host after the skb_under_panic error message. (OVZ-6908)
• cpt: support for inotify watches on Unix sockets. (OVZ-6918)
• Ploop improvements.

See alsoEdit

• RHSA-2017-0892
• RHSA-2017-1372
• RHSA-2017-1486
• RHSA-2017-1723
• RHBA-2017-2504
• CVE-2017-7541
• CVE-2017-7542
• CVE-2017-10661
• CVE-2017-11176
• CVE-2017-14106
• CVE-2017-1000111
• CVE-2017-1000112