| Description: | Summary:
The remote host is missing an update for the 'kernel'
package(s) announced via the referenced advisory.
Vulnerability Insight:
The kernel packages contain the Linux kernel, the core of any Linux
operating system.
This update fixes the following security issues:
* A flaw was found in the way file permission checks for the
/dev/cpu/[x]/msr files were performed in restricted root environments
(for example, when using a capability-based security model). A local user
with the ability to write to these files could use this flaw to escalate
their privileges to kernel level, for example, by writing to the
SYSENTER_EIP_MSR register. (CVE-2013-0268, Important)
* A race condition was found in the way the Linux kernel's ptrace
implementation handled PTRACE_SETREGS requests when the debuggee was woken
due to a SIGKILL signal instead of being stopped. A local, unprivileged
user could use this flaw to escalate their privileges. (CVE-2013-0871,
Important)
Users should upgrade to these updated packages, which contain backported
patches to correct these issues. The system must be rebooted for this
update to take effect.
Affected Software/OS:
kernel on Red Hat Enterprise Linux (v. 5 server)
Solution:
Please Install the Updated Packages.
CVSS Score:
6.9
CVSS Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C
|
