Test ID:	1.3.6.1.4.1.25623.1.0.881763
Category:	CentOS Local Security Checks
Title:	CentOS Update for kernel CESA-2013:1034 centos5
Summary:	The remote host is missing an update for the 'kernel'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'kernel' package(s) announced via the referenced advisory. Vulnerability Insight: The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: * Information leaks in the Linux kernel could allow a local, unprivileged user to leak kernel memory to user-space. (CVE-2012-6544, CVE-2012-6545, CVE-2013-3222, CVE-2013-3224, CVE-2013-3231, CVE-2013-3235, Low) * An information leak was found in the Linux kernel's POSIX signals implementation. A local, unprivileged user could use this flaw to bypass the Address Space Layout Randomization (ASLR) security feature. (CVE-2013-0914, Low) * A heap-based buffer overflow in the way the tg3 Ethernet driver parsed the vital product data (VPD) of devices could allow an attacker with physical access to a system to cause a denial of service or, potentially, escalate their privileges. (CVE-2013-1929, Low) This update also fixes the following bugs: * Previously on system boot, devices with associated Reserved Memory Region Reporting (RMRR) information had lost their RMRR information after they were removed from the static identity (SI) domain. Consequently, a system unexpectedly terminated in an endless loop due to unexpected NMIs triggered by DMA errors. This problem was observed on HP ProLiant Generation 7 (G7) and 8 (Gen8) systems. This update prevents non-USB devices that have RMRR information associated with them from being placed into the SI domain during system boot. HP ProLiant G7 and Gen8 systems that contain devices with the RMRR information now boot as expected. (BZ#957606) * Previously, the kernel's futex wait code used timeouts that had granularity in milliseconds. Also, when passing these timeouts to system calls, the kernel converted the timeouts to 'jiffies'. Consequently, programs could time out inaccurately which could lead to significant latency problems in certain environments. This update modifies the futex wait code to use a high-resolution timer (hrtimer) so the timeout granularity is now in microseconds. Timeouts are no longer converted to when passed to system calls. Timeouts passed to programs are now accurate and the programs time out as expected. (BZ#958021) * A recent change modified the size of the task_struct structure in the floating point unit (fpu) counter. However, on Intel Itanium systems, this change caused the kernel Application Binary Interface (kABI) to stop working properly when a previously compiled module was loaded, resulting in a kernel panic. With this update the change causing this bug has been reverted ... Description truncated, please see the referenced URL(s) for more information. Affected Software/OS: kernel on CentOS 5 Solution: Please install the updated packages. CVSS Score: 4.9 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-6544 http://www.openwall.com/lists/oss-security/2013/03/05/13 RedHat Security Advisories: RHSA-2013:1173 http://rhn.redhat.com/errata/RHSA-2013-1173.html http://www.ubuntu.com/usn/USN-1805-1 http://www.ubuntu.com/usn/USN-1808-1 Common Vulnerability Exposure (CVE) ID: CVE-2012-6545 RedHat Security Advisories: RHSA-2013:1645 http://rhn.redhat.com/errata/RHSA-2013-1645.html Common Vulnerability Exposure (CVE) ID: CVE-2013-0914 http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 http://www.openwall.com/lists/oss-security/2013/03/11/8 RedHat Security Advisories: RHSA-2013:1051 http://rhn.redhat.com/errata/RHSA-2013-1051.html SuSE Security Announcement: openSUSE-SU-2013:1187 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html SuSE Security Announcement: openSUSE-SU-2013:1971 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html http://www.ubuntu.com/usn/USN-1787-1 http://www.ubuntu.com/usn/USN-1788-1 http://www.ubuntu.com/usn/USN-1792-1 http://www.ubuntu.com/usn/USN-1793-1 http://www.ubuntu.com/usn/USN-1794-1 http://www.ubuntu.com/usn/USN-1795-1 http://www.ubuntu.com/usn/USN-1796-1 http://www.ubuntu.com/usn/USN-1797-1 http://www.ubuntu.com/usn/USN-1798-1 Common Vulnerability Exposure (CVE) ID: CVE-2013-1929 FEDORA-2013-5368 http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101836.html MDVSA-2013:176 RHSA-2013:1645 SUSE-SU-2013:1473 http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html SUSE-SU-2013:1474 http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html USN-1834-1 http://www.ubuntu.com/usn/USN-1834-1 USN-1835-1 http://www.ubuntu.com/usn/USN-1835-1 USN-1836-1 http://www.ubuntu.com/usn/USN-1836-1 USN-1838-1 http://www.ubuntu.com/usn/USN-1838-1 [oss-security] 20130405 Re: CVE Request: tg3 VPD firmware -> driver injection http://www.openwall.com/lists/oss-security/2013/04/06/3 http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=715230a44310a8cf66fbfb5a46f9a62a9b2de424 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6 https://bugzilla.redhat.com/show_bug.cgi?id=949932 https://github.com/torvalds/linux/commit/715230a44310a8cf66fbfb5a46f9a62a9b2de424 openSUSE-SU-2013:1971 Common Vulnerability Exposure (CVE) ID: CVE-2013-3222 http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103750.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104480.html https://lkml.org/lkml/2013/4/14/107 http://www.openwall.com/lists/oss-security/2013/04/14/3 SuSE Security Announcement: SUSE-SU-2013:1182 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html http://www.ubuntu.com/usn/USN-1837-1 Common Vulnerability Exposure (CVE) ID: CVE-2013-3224 Common Vulnerability Exposure (CVE) ID: CVE-2013-3231 Common Vulnerability Exposure (CVE) ID: CVE-2013-3235
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.