Security update for Linux kernel

Knowledgebase

(Last modified: 18DEC2006)

solutions Security update for Linux kernel SuSE Linux Maintenance Web (8d1bb2f1def9904433821604ff90783e)

Applies to

Package: kernel-default
kernel-source
kernel-syms
Product(s): SUSE SLE 10 DEBUGINFO for IBM zSeries 64bit
SUSE SLES 10 for IBM zSeries 64bit

Release: 20061218
Obsoletes: 3681897a438bf798b938ff818b83dd7e

Indications

Everyone using the Linux Kernel on s390x architecture should update.

Contraindications

None.

Problem description

This kernel update fixes the following security problems:

CVE-2006-4145: A bug within the UDF filesystem that caused machine hangs when truncating files on the filesystem was fixed. [#186226]
A potential crash when receiving IPX packets was fixed. This problem is thought not to be exploitable. [#197809]
CVE-2006-4623: A problem in DVB packet handling could be used to crash the machine when receiving DVB net packages is active. [#201429]
CVE-2006-3741: A struct file leak was fixed in the perfmon(2) system call on the Itanium architecture. [#202269]
CVE-2006-4538: A malformed ELF image can be used on the Itanium architecture to trigger a kernel crash (denial of service) when a local attacker can supply it to be started. [#203822]
CVE-2006-4997: A problem in the ATM protocol handling clip_mkip function could be used by remote attackers to potentially crash the machine. [#205383]
CVE-2006-5757/CVE-2006-6060: A problem in the grow_buffers function could be used to crash or hang the machine using a corrupted filesystem. This affects filesystem types ISO9660 and NTFS. [#205384]
CVE-2006-5173: On the i386 architecture the ELFAGS content was not correctly saved, which could be used by local attackers to crash other programs using the AC and NT flag or to escalate privileges by waiting for iopl privileges to be leaked. [#209386]
CVE-2006-5174: On the S/390 architecture copy_from_user() could be used by local attackers to read kernel memory. [#209880]
CVE-2006-5619: A problem in IPv6 flowlabel handling can be used by local attackers to hang the machine. [#216590]
CVE-2006-5648: On the PowerPC architecture a syscall has been wired without the proper futex implementation that can be exploited by a local attacker to hang the machine. [#217295]
CVE-2006-5649: On the PowerPC architecture the proper futex implementation was missing a fix for alignment check which could be used by a local attacker to crash the machine. [#217295]
CVE-2006-5823: A problem in cramfs could be used to crash the machine during mounting a crafted cramfs image. This requires an attacker to supply such a crafted image and have a user mount it. [#218237]
CVE-2006-6053: A problem in the ext3 filesystem could be used by attackers able to supply a crafted ext3 image to cause a denial of service or further data corruption if a user mounts this image. [#220288]
CVE-2006-6056: Missing return code checking in the HFS could be used to crash machine when a user complicit attacker is able to supply a specially crafted HFS image. [#221230]
CVE-2006-4572: Multiple unspecified vulnerabilities in netfilter for IPv6 code allow remote attackers to bypass intended restrictions via fragmentation attack vectors, aka (1) "ip6_tables protocol bypass bug" and (2) "ip6_tables extension header bypass bug". [#221313]
CVE-2006-5751: An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges [#222656]

and the following non security bugs:

patches.fixes/dm-bio_list_merge-fix.diff: device-mapper snapshot: bio_list fix [#117435]
patches.fixes/statd-refcount-fix: Fix refcounting problems in host management in lockd. [#148009]
patches.fixes/i8042-reentry: Prevents i8042_interrupt() from being reentered. [#167187]
patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196]
patches.arch/i386-profile-pc: i386: Account spinlocks to the caller during profiling for !FP kernels [#176770]
patches.arch/add-user-mode: i386/x86-64: Add user_mode checks to profile_pc for oprofile [#176770]
patches.drivers/aic7xxx-max-sectors-adjust: Adjust .max_sectors to 8192 for aic7xxx [#177059]
patches.xen/xen-x86-dcr-fallback: Add fallback when XENMEM_exchange fails to replace contiguous region [#181869]
patches.suse/lkcd-support-large-minor-number: LKCD should support minor numbers > 256 [#185125]
patches.fixes/scsi-scan-limit-luns-seqscan-16k: Limit sequential scan to 16k LUNs [#185164]
patches.drivers/powernow-ext-mask: Handle extended powernow vid mask properly [#185654]
patches.fixes/xfs-unlink-recovery-fix: [XFS] unlink recovery fix. ([#185796]
patches.suse/lkcd-dont-lose-one-page: Fix incorrect dumps on machines with memory holes [#186169]
patches.fixes/ieee80211-orinoco_ap_workaround.diff: ieee80211: workaround for broken Orinoco access points [#186879]
patches.fixes/sched-group-exclusive: Fix scheduler crash with exclusive cpusets [#188921]
patches.fixes/bdev-imapping-race.diff: Fix race between sync_single_inode() and iput() [#188950]
patches.fixes/scsi-scan-blist-update: Update blacklist entries for EMC Symmetrix and HP EVA [#191648]
patches.arch/ia64-mce-output: Save/restore oops_in_progress around printing machine checks [#191901]
patches.fixes/scsi-add-device-oops-during-eh: Fix Oops in scsi_add_device during EH [#195050]
Included a set of fixes for [#195940]
- patches.fixes/dm-fix-alloc_dev-error_path.patch: call free_minor in alloc_dev error path.
- patches.fixes/dm-snapshot-fix-origin_write-pe-submission.patch: fix origin_write pending_exception submission.
- patches.fixes/dm-snapshot-replace-sibling-list.patch: replace sibling list.
- patches.fixes/dm-snapshot-fix-pending-pe-ref.patch: fix references to pending pe.
- patches.fixes/dm-snapshot-fix-invalidation.patch: fix invalidation.
- patches.fixes/dm-kcopyd-error-accumulation-fix.patch: kcopyd should accumulate errors.
- patches.fixes/dm-snapshot-fix-metadata-error-handling.patch: fix read_metadata error handling.
- patches.fixes/dm-snapshot-fix-metadata-writing-when-suspending.patch: fix metadata writing when suspending.
patches.fixes/nat-t-pskb-pull.patch: Fix NAT-T VPN with certain ethernet chips, in particular recent e1000 chips. [#196747]
patches.drivers/e1000-update: Update so that we no longer break the "Disable Packet Split for PCI express adapters" driver option.
patches.fixes/e1000-no-packet-split: Discard, no longer needed.
patches.arch/acpi_T60_ultrabay.patch: Add T60 ACPI dock station path to ibm_acpi module [#196884]
patches.fixes/acpi_battery_hotplug_fix.patch: Workaround ACPI misdesign to recon dock station when booting undocked.
patches.fixes/acpi_ibm_dock_fix_not_present.patch: Workaround ACPI misdesign to recon dock station when booting undocked [#196884]
patches.arch/x86_64-monotonic-clock: Fix monotonic clock on x86-64 [#197548]
patches.fixes/nfs-truncate-race: Fix a race when truncating over NFS and writing via mmap [#198023]
patches.drivers/libata-no-spindown-on-shutdown: Don't spindown SCSI disks when rebooting [#198687]
patches.drivers/qla2xxx-reset-fix: allow reset for qla2xxx via sg_reset [#200325]
kabi/s390/symvers-default: Update kABI symbols [#202134]
patches.suse/bond_alb_deadlock_fix: bonding: fix deadlock on high loads in bond_alb_monitor(). [#202512]
patches.arch/i386-fix-tsc-selection: Fix TSC timer selection on i386 [#203713]
patches.drivers/aic94xx-remove-flash-manfid-reliance: Remove reliance on the FLASH MANFID [#203768]
patches.fixes/xfs-kern-205110-xfs_dio_locking: Fix ABBA deadlock between i_mutex and iolock [#205110]
patches.suse/bonding-workqueue: Replace system timer with work queue in monitor functions. Remove rtnl_lock calls in monitor functions added in original version. [#174843] [#205196]
add patches.fixes/fix-incorrect-hugepage-interleaving.patch fix NUMA interleaving for huge pages [#205268]
patches.suse/bondalb-hashtbl.patch: fix hang in bonding ALB driver. [#206629]
patches.drivers/usb-add-raritan-kvm-usb-dongle-to-the-hid_quirk_noget-blacklist.patch: USB: add Raritan KVM USB Dongle to the HID_QUIRK_NOGET blacklist [#206932]
patches.arch/ia64-mca_asm-set_kernel_registers: [IA64] set ar.fpsr on MCA/INIT kernel entry. [#206967]
patches.fixes/md-bitmap-ffz: Use ffz instead of find_first_set to convert multiplier to shift. [#207679]
patches.fixes/md-bitmap-compat-ioctl: Allow SET_BITMAP_FILE to work on 64bit kernel with 32bit userspace. [#207688]
patches.drivers/mpt-rport-stall: Fix MPT oops during aborting commands [#207768]
patches.drivers/libata-jmicron-update: Fix handling of JMicron controller [#207939]
patches.arch/i386-mmconfig-flush: arch/i386/pci/mmconfig.c tlb flush fix [#208414]
patches.fixes/scsi-fix-req-page-count: scsi_lib.c: properly count the number of pages in scsi_req_map_sg() [#208782]
patches.fixes/fix-processor-placement.diff: sched: Fix longstanding load balancing bug in the scheduler [#209460].
patches.arch/x86_64-fpu-corruption: Fix FPU corruption [#209903]
patches.drivers/qla1280-bus-reset-handling: performance slowdown after bus reset on qla12160 HBA [#213717]
patches.drivers/qla1280-scb-timeout: qla1280 times out on long operations such as tape rewind [#214695]
patches.fixes/slab-per-cpu-data: Make slab initialization use per cpu data of correction CPU [#216316]
patches.fixes/ocfs2-network-send-lock.diff: ocfs2: introduce sc->sc_send_lock to protect outbound network messages [#216912]
marked module megaraid_sas as supported
marked module jsm as supported [#218969]
patches.suse/ocfs2-13-fix-quorum-work.diff: ocfs2: outstanding scheduled work can oops when quorum is shut down [#220694]
patches.xen/xen-x86_64-agp: add missing header [#222174] [#224170]
patches.fixes/md-rebuild-fix: md: Fix bug where a rebuild of spares, when interrupted by a rebuild, doesn't always get properly completed once the system is back up, leading to filesystem corruption. [#224960].
patches.fixes/scsi-sdev-initialisation-block-race: SCSI midlayer race: scan vs block/unblock deadlocks sdev [#225770]

Fixes for S/390:

IBM Patchcluster 8
- Problem-ID: 26648 - cio: incorrect detection of unsol. interrupts during sense pgid
- Problem-ID: 26756 - qeth: After cable pull (out/in) device does not work
- Problem-ID: 26754 - kernel: incorrect copy_in_user.
- Problem-ID: 26829 - cio: modalias missing from ccw bus uevent environment
- Problem-ID: 27254 - cio: subchannel scan loop for reappearing channel paths ends early
- Problem-ID: 27255 - cio: incorrect no-path indication after machine check
- Problem-ID: 27256 - cio: race condition leaves device in inaccessible state
- Problem-ID: 27257 - cio: path group not updated by CHPID vary operation
- Problem-ID: 27258 - cio: path verification ignores reappearing channel paths
- Problem-ID: 27068 - qeth: VLAN header reordering does not work on packets received through qeth interface in layer 2 mode.
- Problem-ID: 25692 - z90crypt: Logfile flooding when no crypto hardware is available.
- Problem-ID: 19109 - zfcp: excess commands in statistic for pending read I/O
- Problem-ID: 28087 - zfcp: problems occured with larger block-sizes (e.g. from tape driver) while using default max_sector (512)
- Problem-ID: 28177 - cio: incorrect device operational notification
- Problem-ID: 27654 - cio: 0 is a valid chpid.
- Problem-ID: 27706 - kernel: user readable uninitialised kernel memory.
- Problem-ID: 28122 - dasd: clean up timer when DASD device is set off-line
- Problem-ID: 28316 - statistics: buffer overflow in histogram
- Problem-ID: 28120 - qeth: do not manipulate outgoing cloned skbs
- Problem-ID: 28522 - cio: css_probe_device() must be called enabled.
- Problem-ID: 28547 - cio: inaccessible device after CHPID deactivation
- Problem-ID: 28548 - cio: I/O request failure after CHPID deactivation
- Problem-ID: 28550 - zfcp: dimension error on latency calculation
- Problem-ID: 28623 - qeth: kernel panic after module unload
IBM Patchcluster 9
- Problem-ID: 28747 - zfcp: deadlock during error recovery
- Problem-ID: 29122 - zfcp: improve handling of adapter failures
IBM Patchcluster 11
- Problem-ID: 29341 - kernel: Misaligned wait-PSW.
- Problem-ID: 28121 - qeth: device functions are not callable in atomic context.

For further description of the named Problem-IDs, please have a look at http://www-128.ibm.com/developerworks/linux/linux390/october2005_recommended.html

Solution

Please install the updates provided at the location noted below.

Installation notes

This update is provided as a RPM packages that can easily be installed onto a running system by the following command:
rpm -Fvh kernel-syms*.rpm kernel-default*.rpm
Afterwards, reboot the system with
shutdown -r now
to load the new kernel (replace "now" with the appropriate amount of time to allow local users to cleanly log out, for example "+5" for five minutes.)

links to download packages

Download Source Packages

Download the source code of the patches for maintained products.

Disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.

Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.