(RHSA-2014:0913) Important: kernel-rt security update

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

• A flaw was found in the way the Linux kernel’s futex subsystem handled
  the requeuing of certain Priority Inheritance (PI) futexes. A local,
  unprivileged user could use this flaw to escalate their privileges on the
  system. (CVE-2014-3153, Important)

• It was found that the Linux kernel’s ptrace subsystem allowed a traced
  process’ instruction pointer to be set to a non-canonical memory address
  without forcing the non-sysret code path when returning to user space.
  A local, unprivileged user could use this flaw to crash the system or,
  potentially, escalate their privileges on the system. (CVE-2014-4699,
  Important)

Note: The CVE-2014-4699 issue only affected systems using an Intel CPU.

• It was found that the permission checks performed by the Linux kernel
  when a netlink message was received were not sufficient. A local,
  unprivileged user could potentially bypass these restrictions by passing a
  netlink socket as stdout or stderr to a more privileged process and
  altering the output of this process. (CVE-2014-0181, Moderate)

• It was found that the aio_read_events_ring() function of the Linux
  kernel’s Asynchronous I/O (AIO) subsystem did not properly sanitize the AIO
  ring head received from user space. A local, unprivileged user could use
  this flaw to disclose random parts of the (physical) memory belonging to
  the kernel and/or other processes. (CVE-2014-0206, Moderate)

• An out-of-bounds memory access flaw was found in the Netlink Attribute
  extension of the Berkeley Packet Filter (BPF) interpreter functionality in
  the Linux kernel’s networking implementation. A local, unprivileged user
  could use this flaw to crash the system or leak kernel memory to user space
  via a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145,
  Moderate)

• An out-of-bounds memory access flaw was found in the Linux kernel’s
  system call auditing implementation. On a system with existing audit rules
  defined, a local, unprivileged user could use this flaw to leak kernel
  memory to user space or, potentially, crash the system. (CVE-2014-3917,
  Moderate)

• A flaw was found in the way Linux kernel’s Transparent Huge Pages (THP)
  implementation handled non-huge page migration. A local, unprivileged user
  could use this flaw to crash the kernel by migrating transparent hugepages.
  (CVE-2014-3940, Moderate)

• An integer underflow flaw was found in the way the Linux kernel’s Stream
  Control Transmission Protocol (SCTP) implementation processed certain
  COOKIE_ECHO packets. By sending a specially crafted SCTP packet, a remote
  attacker could use this flaw to prevent legitimate connections to a
  particular SCTP server socket to be made. (CVE-2014-4667, Moderate)

• An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp)
  backend driver of the iSCSI Target subsystem of the Linux kernel.
  A privileged user could use this flaw to leak the contents of kernel memory
  to an iSCSI initiator remote client. (CVE-2014-4027, Low)

Red Hat would like to thank Kees Cook of Google for reporting
CVE-2014-3153, Andy Lutomirski for reporting CVE-2014-4699 and
CVE-2014-0181, and Gopal Reddy Kodudula of Nokia Siemens Networks for
reporting CVE-2014-4667. Google acknowledges Pinkie Pie as the original
reporter of CVE-2014-3153. The CVE-2014-0206 issue was discovered by
Mateusz Guzik of Red Hat.

Users are advised to upgrade to these updated packages, which upgrade the
kernel-rt kernel to version kernel-rt-3.10.33-rt32.43 and correct these
issues. The system must be rebooted for this update to take effect.