kernel security update

CentOS Errata and Security Advisory CESA-2008:0973

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update addresses the following security issues:

• Tavis Ormandy discovered a deficiency in the Linux kernel 32-bit and
  64-bit emulation. This could allow a local, unprivileged user to prepare
  and run a specially-crafted binary which would use this deficiency to leak
  uninitialized and potentially sensitive data. (CVE-2008-0598, Important)

• a possible kernel memory leak was found in the Linux kernel Simple
  Internet Transition (SIT) INET6 implementation. This could allow a local,
  unprivileged user to cause a denial of service. (CVE-2008-2136, Important)

• missing capability checks were found in the SBNI WAN driver which could
  allow a local user to bypass intended capability restrictions.
  (CVE-2008-3525, Important)

• the do_truncate() and generic_file_splice_write() functions did not clear
  the setuid and setgid bits. This could allow a local, unprivileged user to
  obtain access to privileged information. (CVE-2008-4210, Important)

• a buffer overflow flaw was found in Integrated Services Digital Network
  (ISDN) subsystem. A local, unprivileged user could use this flaw to cause a
  denial of service. (CVE-2007-6063, Moderate)

• multiple NULL pointer dereferences were found in various Linux kernel
  network drivers. These drivers were missing checks for terminal validity,
  which could allow privilege escalation. (CVE-2008-2812, Moderate)

• a deficiency was found in the Linux kernel virtual filesystem (VFS)
  implementation. This could allow a local, unprivileged user to attempt file
  creation within deleted directories, possibly causing a denial of service.
  (CVE-2008-3275, Moderate)

This update also fixes the following bugs:

• the incorrect kunmap function was used in nfs_xdr_readlinkres. kunmap()
  was used where kunmap_atomic() should have been. As a consequence, if an
  NFSv2 or NFSv3 server exported a volume containing a symlink which included
  a path equal to or longer than the local system’s PATH_MAX, accessing the
  link caused a kernel oops. This has been corrected in this update.

• mptctl_gettargetinfo did not check if pIoc3 was NULL before using it as a
  pointer. This caused a kernel panic in mptctl_gettargetinfo in some
  circumstances. A check has been added which prevents this.

• lost tick compensation code in the timer interrupt routine triggered
  without apparent cause. When running as a fully-virtualized client, this
  spurious triggering caused the 64-bit version of Red Hat Enterprise Linux 3
  to present highly inaccurate times. With this update the lost tick
  compensation code is turned off when the operating system is running as a
  fully-virtualized client under Xen or VMWare®.

All Red Hat Enterprise Linux 3 users should install this updated kernel
which addresses these vulnerabilities and fixes these bugs.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2008-December/077663.html
https://lists.centos.org/pipermail/centos-announce/2008-December/077664.html
https://lists.centos.org/pipermail/centos-announce/2009-February/077740.html
https://lists.centos.org/pipermail/centos-announce/2009-February/077741.html

Affected packages:
kernel
kernel-BOOT
kernel-doc
kernel-hugemem
kernel-hugemem-unsupported
kernel-smp
kernel-smp-unsupported
kernel-source
kernel-unsupported

Upstream details at:
https://access.redhat.com/errata/RHSA-2008:0973