kernel security update

CentOS Errata and Security Advisory CESA-2011:0833

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

This update fixes the following security issues:

• A flaw in the dccp_rcv_state_process() function could allow a remote
  attacker to cause a denial of service, even when the socket was already
  closed. (CVE-2011-1093, Important)

• Multiple buffer overflow flaws were found in the Linux kernel’s
  Management Module Support for Message Passing Technology (MPT) based
  controllers. A local, unprivileged user could use these flaws to cause a
  denial of service, an information leak, or escalate their privileges.
  (CVE-2011-1494, CVE-2011-1495, Important)

• A missing validation of a null-terminated string data structure element
  in the bnep_sock_ioctl() function could allow a local user to cause an
  information leak or a denial of service. (CVE-2011-1079, Moderate)

• Missing error checking in the way page tables were handled in the Xen
  hypervisor implementation could allow a privileged guest user to cause the
  host, and the guests, to lock up. (CVE-2011-1166, Moderate)

• A flaw was found in the way the Xen hypervisor implementation checked for
  the upper boundary when getting a new event channel port. A privileged
  guest user could use this flaw to cause a denial of service or escalate
  their privileges. (CVE-2011-1763, Moderate)

• The start_code and end_code values in “/proc/[pid]/stat” were not
  protected. In certain scenarios, this flaw could be used to defeat Address
  Space Layout Randomization (ASLR). (CVE-2011-0726, Low)

• A missing initialization flaw in the sco_sock_getsockopt() function could
  allow a local, unprivileged user to cause an information leak.
  (CVE-2011-1078, Low)

• A missing validation of a null-terminated string data structure element
  in the do_replace() function could allow a local user who has the
  CAP_NET_ADMIN capability to cause an information leak. (CVE-2011-1080, Low)

• A buffer overflow flaw in the DEC Alpha OSF partition implementation in
  the Linux kernel could allow a local attacker to cause an information leak
  by mounting a disk that contains specially-crafted partition tables.
  (CVE-2011-1163, Low)

• Missing validations of null-terminated string data structure elements in
  the do_replace(), compat_do_replace(), do_ipt_get_ctl(), do_ip6t_get_ctl(),
  and do_arpt_get_ctl() functions could allow a local user who has the
  CAP_NET_ADMIN capability to cause an information leak. (CVE-2011-1170,
  CVE-2011-1171, CVE-2011-1172, Low)

• A heap overflow flaw in the Linux kernel’s EFI GUID Partition Table (GPT)
  implementation could allow a local attacker to cause a denial of service
  by mounting a disk that contains specially-crafted partition tables.
  (CVE-2011-1577, Low)

Red Hat would like to thank Dan Rosenberg for reporting CVE-2011-1494 and
CVE-2011-1495; Vasiliy Kulikov for reporting CVE-2011-1079, CVE-2011-1078,
CVE-2011-1080, CVE-2011-1170, CVE-2011-1171, and CVE-2011-1172; Kees Cook
for reporting CVE-2011-0726; and Timo Warns for reporting CVE-2011-1163
and CVE-2011-1577.

This update also fixes several bugs. Documentation for these bug fixes will
be available shortly from the Technical Notes document linked to in the
References section.

Users should upgrade to these updated packages, which contain backported
patches to correct these issues, and fix the bugs noted in the Technical
Notes. The system must be rebooted for this update to take effect.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2011-May/079771.html
https://lists.centos.org/pipermail/centos-announce/2011-May/079772.html

Affected packages:
kernel
kernel-PAE
kernel-PAE-devel
kernel-debug
kernel-debug-devel
kernel-devel
kernel-doc
kernel-headers
kernel-xen
kernel-xen-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2011:0833