kernel security and bug fix update (RHSA-2008-0211)

Original Release Date: May 14, 2008
Last Revised: July 18, 2008
Number: ASA-2008-203
Risk Level: Medium
Advisory Version: 2.0
Advisory Status: Final

1. Overview:

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated packages fix the following security issues:

The absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. A local unprivileged user could be allowed to simultaneously execute code which would otherwise be protected against parallel execution. In addition a race condition when handling locks in the Linux kernel fcntl functionality may have allowed a process belonging to a local unprivileged user to gain re-ordered access to the descriptor table. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-1669 to this issue.

The absence of a protection mechanism when attempting to access a critical section of code, as well as a race condition, have been found in the Linux kernel file system event notifier, dnotify. A local unprivileged user could then get inconsistent data or send arbitrary signals to arbitrary system processes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-1375 to this issue.

When accessing kernel memory locations, certain Linux kernel drivers registering a fault handler did not perform required range checks. A local unprivileged user could use this flaw to gain read or write access to arbitrary kernel memory, or possibly cause a kernel crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-0007 to this issue.

A flaw was found when performing asynchronous input or output operations on a FIFO special file. A local unprivileged user could the use this to cause a kernel panic. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-5001 to this issue.

If a local user could get a root-owned process to dump a core file into a directory which the user has write access to they could gain read access to that core file, due to a flaw in the way core files are created. This could potentially grant unauthorized access to sensitive information. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-6206 to this issue.

A local unprivileged user could use a flaw found in the Linux kernel ISDN subsystem to cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-6151 to this issue.

A local user could cause a denial of service (system hang) due to a race condition found in the mincore subsystem. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2006-4814 to this issue.

A local unprivileged user to cause memory corruption because the Linux kernel handles string operations in the opposite way to the GNU Compiler Collection (GCC). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-1367 to this issue.

As well, these updated packages fix the following bugs:

A bug which caused long delays when unmounting mounts containing a large number of unused dentries has been resolved.

In the previous kernel packages the kernel was unable to handle certain floating point instructions on Itanium(R) architectures.

On certain Intel CPUs, the Translation Lookaside Buffer (TLB) was not flushed correctly which caused machine check errors.

More information about these vulnerabilities can be found in the security advisory issued by RedHat Linux:

2. Avaya System Products with kernel installed:

Product: Affected Version(s): Risk Level: Actions:
Avaya AES 3.1.5 and earlier Medium Install AES 3.1.5 patch 1 as described in PSN002026U available from support.avaya.com

3. Avaya Software-Only Products:

Avaya software-only products operate on general-purpose operating systems. Occasionally vulnerabilities may be discovered in the underlying operating system or applications that come with the operating system. These vulnerabilities often do not impact the software-only product directly but may threaten the integrity of the underlying platform.

In the case of this advisory Avaya software-only products are not affected by the vulnerability directly but the underlying Linux platform may be. Customers should determine on which Linux operating system the product was installed and then follow that vendor's guidance.

Product: Actions:
CVLAN Depending on the Operating System provided by customers, the affected package may be installed on the underlying Operating System supporting the CVLAN application.
Avaya Integrated Management Suite (IMS) Depending on the Operating System provided by customers, the affected package may be installed on the underlying Operating System supporting the IMS application.
Voice Portal Depending on the Operating System provided by customers, the affected package may be installed on the underlying Operating System supporting the Voice Portal application.

Recommended Actions:
In the event that the affected package is installed, Avaya recommends that customers follow recommended actions supplied by RedHat Linux.

4. Additional Information:

Additional information may also be available via the Avaya support website and through your Avaya account representative. Please contact your Avaya product support representative, or dial 1-800-242-2121, with any questions.

5. Disclaimer:

ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION AND IS PROVIDED "AS IS". AVAYA INC., ON BEHALF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS "AVAYA"), DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS' SYSTEMS. IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, INCLUDING DIRECT, INDIRECT, INCIDENTAL, STATUTORY, CONSEQUENTIAL DAMAGES, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER EXISTING AGREEMENTS WITH AVAYA.

6. Revision History:

V 1.0 - May 14, 2008 - Initial Statement issued.
V 2.0 - July 18, 2008 - Changed recommended actions and status.

Send information regarding any discovered security problems with Avaya products to either the contact noted in the product's documentation or securityalerts@avaya.com.

© 2008 Avaya Inc. All Rights Reserved. All trademarks identified by the ® or ™ are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners.