Moderate: kernel security and bug fix update

Synopsis

Moderate: kernel security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

Updated kernel packages that fix one security issue and several bugs are
now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

• A flaw was found in the way the Linux kernel's splice() system call
  validated its parameters. On certain file systems, a local, unprivileged
  user could use this flaw to write past the maximum file size, and thus
  crash the system. (CVE-2014-7822, Moderate)
  

Red Hat would like to thank Akira Fujita of NEC for reporting this issue.

This update also fixes the following bugs:

• Previously, hot-unplugging of a virtio-blk device could in some cases
  lead to a kernel panic, for example during in-flight I/O requests.
  This update fixes race condition in the hot-unplug code in the
  virtio_blk.ko module. As a result, hot unplugging of the virtio-blk device
  no longer causes the guest kernel oops when there are in-flight I/O
  requests. (BZ#1006536)
  
• Before this update, due to a bug in the error-handling path, a corrupted
  metadata block could be used as a valid block. With this update, the error
  handling path has been fixed and more checks have been added to verify the
  metadata block. Now, when a corrupted metadata block is encountered, it is
  properly marked as corrupted and handled accordingly. (BZ#1034403)
  
• Previously, an incorrectly initialized variable resulted in a random
  value being stored in the variable that holds the number of default ACLs,
  and is sent in the SET_PATH_INFO data structure. Consequently, the setfacl
  command could, under certain circumstances, fail with an "Invalid argument"
  error. With this update, the variable is correctly initialized to zero,
  thus fixing the bug. (BZ#1105625)
  

All kernel users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The system must be
rebooted for this update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 1163792 - CVE-2014-7822 kernel: splice: lack of generic write checks

CVEs

• CVE-2014-7822

References

• https://access.redhat.com/security/updates/classification/#moderate