Lucene search

K
redhatRedHatRHSA-2008:0508
HistoryJun 25, 2008 - 12:00 a.m.

(RHSA-2008:0508) Important: kernel security and bug fix update

2008-06-2500:00:00
access.redhat.com
35

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

85.6%

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

These updated packages fix the following security issues:

  • A security flaw was found in the Linux kernel memory copy routines, when
    running on certain AMD64 systems. If an unsuccessful attempt to copy kernel
    memory from source to destination memory locations occurred, the copy
    routines did not zero the content at the destination memory location. This
    could allow a local unprivileged user to view potentially sensitive data.
    (CVE-2008-2729, Important)

  • Alexey Dobriyan discovered a race condition in the Linux kernel
    process-tracing system call, ptrace. A local unprivileged user could
    use this flaw to cause a denial of service (kernel hang).
    (CVE-2008-2365, Important)

  • Tavis Ormandy discovered a deficiency in the Linux kernel 32-bit and
    64-bit emulation. This could allow a local unprivileged user to prepare and
    run a specially crafted binary, which would use this deficiency to leak
    uninitialized and potentially sensitive data. (CVE-2008-0598, Important)

  • It was discovered that the Linux kernel handled string operations in the
    opposite way to the GNU Compiler Collection (GCC). This could allow a local
    unprivileged user to cause memory corruption. (CVE-2008-1367, Low)

As well, these updated packages fix the following bug:

  • On systems with a large number of CPUs (more than 16), multiple
    applications calling the “times()” system call may have caused a system
    hang.

Red Hat Enterprise Linux 4 users are advised to upgrade to these updated
packages, which contain backported patches to resolve these issues.

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

85.6%

Related for RHSA-2008:0508