kernel Kernel Update for SUSE Linux 10.1 Kernel Update für SUSE Linux 10.1 This kernel update fixes the following security problems: CVE-2008-0007: Insufficient range checks in certain fault handlers could be used by local attackers to potentially read or write kernel memory. CVE-2008-0001: Incorrect access mode checks could be used by local attackers to corrupt directory contents and so cause denial of service attacks or potentially execute code. CVE-2007-5966: Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value. NOTE: some of these details are obtained from third party information. CVE-2007-6417: The shmem_getpage function (mm/shmem.c) in Linux kernel 2.6.11 through 2.6.23 does not properly clear allocated memory in some rare circumstances, which might allow local users to read sensitive kernel data or cause a denial of service (crash). Furthermore, this kernel catches up to the SLE 10 state of the kernel, with massive additional fixes. All platforms: - patches.suse/bootsplash: Bootsplash for current kernel (none). patch the patch for Bug number 345980. - patches.fixes/megaraid-fixup-driver-version: Megaraid driver version out of sync (299740). - OCFS2: Updated to version 1.2.8 - patches.fixes/ocfs2-1.2-svn-r3070.diff: [PATCH] ocfs2: Remove overzealous BUG_ON(). - patches.fixes/ocfs2-1.2-svn-r3072.diff: [PATCH] ocfs2: fix rename vs unlink race. - patches.fixes/ocfs2-1.2-svn-r3074.diff: [PATCH] ocfs2: Remove expensive local alloc bitmap scan code. - patches.fixes/ocfs2-1.2-svn-r3057.diff: [PATCH] ocfs2: Check for cluster locking in ocfs2_readpage. - patches.fixes/ocfs2-1.2-svn-r2975.diff: ocfs2_dlm: make functions static. - patches.fixes/ocfs2-1.2-svn-r2976.diff: [PATCH] ocfs2_dlm: make tot_backoff more descriptive. - patches.fixes/ocfs2-1.2-svn-r3002.diff: [PATCH] ocfs2: Remove the printing of harmless ERRORS like ECONNRESET, EPIPE.. - patches.fixes/ocfs2-1.2-svn-r3004.diff: [PATCH] ocfs2_dlm: Call cond_resched_lock() once per hash bucket scan. - patches.fixes/ocfs2-1.2-svn-r3006.diff: [PATCH] ocfs2_dlm: Silence compiler warnings. - patches.fixes/ocfs2-1.2-svn-r3062.diff: [PATCH] ocfs2_dlm: Fix double increment of migrated lockres' owner count. - patches.fixes/hugetlb-get_user_pages-corruption.patch: hugetlb: follow_hugetlb_page() for write access (345239). - enable patches.fixes/reiserfs-fault-in-pages.patch (333412) - patches.drivers/usb-update-evdo-driver-ids.patch: USB: update evdo driver ids. Get the module to build... - patches.drivers/usb-add-usb_device_and_interface_info.patch: USB: add USB_DEVICE_AND_INTERFACE_INFO(). This is needed to get the HUAWEI devices to work properly, and to get patches.drivers/usb-update-evdo-driver-ids.patch to build without errors. - patches.drivers/usb-update-evdo-driver-ids.patch: USB: update evdo driver ids on request from our IT department (345438). - patches.suse/kdump-dump_after_notifier.patch: Add dump_after_notifier sysctl (265764). - patches.drivers/libata-sata_nv-disable-ADMA: sata_nv: disable ADMA by default (346508). - patches.fixes/cpufreq-fix-ondemand-deadlock.patch: Cpufreq fix ondemand deadlock (337439). - patches.fixes/eliminate-cpufreq_userspace-scaling_setspeed-d eadlock.patch: Eliminate cpufreq_userspace scaling_setspeed deadlock (337439). - patches.xen/15181-dma-tracking.patch: Fix issue preventing Xen KMPs from building. - patches.drivers/r8169-perform-a-PHY-reset-before.patch: r8169: perform a PHY reset before any other operation at boot time (345658). - patches.drivers/r8169-more-alignment-for-the-0x8168: refresh. - patches.fixes/lockd-grant-shutdown: Stop GRANT callback from crashing if NFS server has been stopped. (292478). There was a problem with this patch which would cause apparently random crashes when lockd was in use. The offending change has been removed. - patches.fixes/usb_336850.diff: fix missing quirk leading to a device disconnecting under load (336850). - patches.fixes/cifs-incomplete-recv.patch: fix incorrect session reconnects (279783). - patches.fixes/megaraid_mbox-dell-cerc-support: Fix so that it applies properly. I extended the context to 6 lines to help patch find where to apply the patch (267134). - patches.fixes/md-idle-test: md: improve the is_mddev_idle test fix (326591). AMD64/Intel EM64T (x86_64) specific: - patches.arch/x86_64-mce-loop: x86_64: fix misplaced `continue' in mce.c (344239). Dieses Kernel Update behebt folgende Sicherheitsprobleme (aufgelistet in englischer Sprache): CVE-2008-0007: Insufficient range checks in certain fault handlers could be used by local attackers to potentially read or write kernel memory. CVE-2008-0001: Incorrect access mode checks could be used by local attackers to corrupt directory contents and so cause denial of service attacks or potentially execute code. CVE-2007-5966: Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value. NOTE: some of these details are obtained from third party information. CVE-2007-6417: The shmem_getpage function (mm/shmem.c) in Linux kernel 2.6.11 through 2.6.23 does not properly clear allocated memory in some rare circumstances, which might allow local users to read sensitive kernel data or cause a denial of service (crash). Weiterhin enthält dieses Update alle Änderungen des SLE 10 Kernel. All platforms: - patches.suse/bootsplash: Bootsplash for current kernel (none). patch the patch for Bug number 345980. - patches.fixes/megaraid-fixup-driver-version: Megaraid driver version out of sync (299740). - OCFS2: Updated to version 1.2.8 - patches.fixes/ocfs2-1.2-svn-r3070.diff: [PATCH] ocfs2: Remove overzealous BUG_ON(). - patches.fixes/ocfs2-1.2-svn-r3072.diff: [PATCH] ocfs2: fix rename vs unlink race. - patches.fixes/ocfs2-1.2-svn-r3074.diff: [PATCH] ocfs2: Remove expensive local alloc bitmap scan code. - patches.fixes/ocfs2-1.2-svn-r3057.diff: [PATCH] ocfs2: Check for cluster locking in ocfs2_readpage. - patches.fixes/ocfs2-1.2-svn-r2975.diff: ocfs2_dlm: make functions static. - patches.fixes/ocfs2-1.2-svn-r2976.diff: [PATCH] ocfs2_dlm: make tot_backoff more descriptive. - patches.fixes/ocfs2-1.2-svn-r3002.diff: [PATCH] ocfs2: Remove the printing of harmless ERRORS like ECONNRESET, EPIPE.. - patches.fixes/ocfs2-1.2-svn-r3004.diff: [PATCH] ocfs2_dlm: Call cond_resched_lock() once per hash bucket scan. - patches.fixes/ocfs2-1.2-svn-r3006.diff: [PATCH] ocfs2_dlm: Silence compiler warnings. - patches.fixes/ocfs2-1.2-svn-r3062.diff: [PATCH] ocfs2_dlm: Fix double increment of migrated lockres' owner count. - patches.fixes/hugetlb-get_user_pages-corruption.patch: hugetlb: follow_hugetlb_page() for write access (345239). - enable patches.fixes/reiserfs-fault-in-pages.patch (333412) - patches.drivers/usb-update-evdo-driver-ids.patch: USB: update evdo driver ids. Get the module to build... - patches.drivers/usb-add-usb_device_and_interface_info.patch: USB: add USB_DEVICE_AND_INTERFACE_INFO(). This is needed to get the HUAWEI devices to work properly, and to get patches.drivers/usb-update-evdo-driver-ids.patch to build without errors. - patches.drivers/usb-update-evdo-driver-ids.patch: USB: update evdo driver ids on request from our IT department (345438). - patches.suse/kdump-dump_after_notifier.patch: Add dump_after_notifier sysctl (265764). - patches.drivers/libata-sata_nv-disable-ADMA: sata_nv: disable ADMA by default (346508). - patches.fixes/cpufreq-fix-ondemand-deadlock.patch: Cpufreq fix ondemand deadlock (337439). - patches.fixes/eliminate-cpufreq_userspace-scaling_setspeed-d eadlock.patch: Eliminate cpufreq_userspace scaling_setspeed deadlock (337439). - patches.xen/15181-dma-tracking.patch: Fix issue preventing Xen KMPs from building. - patches.drivers/r8169-perform-a-PHY-reset-before.patch: r8169: perform a PHY reset before any other operation at boot time (345658). - patches.drivers/r8169-more-alignment-for-the-0x8168: refresh. - patches.fixes/lockd-grant-shutdown: Stop GRANT callback from crashing if NFS server has been stopped. (292478). There was a problem with this patch which would cause apparently random crashes when lockd was in use. The offending change has been removed. - patches.fixes/usb_336850.diff: fix missing quirk leading to a device disconnecting under load (336850). - patches.fixes/cifs-incomplete-recv.patch: fix incorrect session reconnects (279783). - patches.fixes/megaraid_mbox-dell-cerc-support: Fix so that it applies properly. I extended the context to 6 lines to help patch find where to apply the patch (267134). - patches.fixes/md-idle-test: md: improve the is_mddev_idle test fix (326591). AMD64/Intel EM64T (x86_64) specific: - patches.arch/x86_64-mce-loop: x86_64: fix misplaced `continue' in mce.c (344239). security This update can be used to install a new kernel. If you decide to use the kernel update, we recommend that you reboot your system upon completion of the YaST Online Update, as additional kernel modules may be needed which can only be loaded after the system is rebooted. If you are in the course of performing a new installation, the installer will reboot the machine after installing the patch. If you do not want to reboot, deselect this patch. kernel-bigsmp i586 6cd45579c61c00c5bb7e996b9e46c3402c89fed5 kernel-debug i586 4df23e97941325fd5a6ec959fab210ab311477c0 kernel-debug x86_64 f766bb5e9b0a89b7aa7fafbe4accb5f97964aea6 kernel-default i586 bb5adc2c349cfb9646859573a043f73ef5f42590 kernel-default ppc f6f9ce77411cc92c3ba9c23235d43b166203f3d9 kernel-default x86_64 67cbd1009b05d9e323aa31564e834de47072d90f kernel-iseries64 ppc 0cba41321bed1fd05f12f0dbcfb2eca76d91cdb1 kernel-kdump i586 522837c64637f6ba018dcff70ed6eefd9a41f659 kernel-kdump ppc 26ec4fed3bc581ab53f729c55eabd90614d5a7bc kernel-kdump x86_64 f6f39cb0f9c445cd5831eeb0a4548143ac4eb3ca kernel-ppc64 ppc 5bbfb6f2571352fe7d1290a578c5ab61e22201d9 kernel-smp i586 5b5f8ed2633ee26b7cd14d4a79b894bc483ab197 kernel-smp x86_64 748e05d0d0546b5cf955e434d74a08381ead8afb kernel-source i586 8e0e274e08e24fc4acc8dc8f4a80bb6f197a09b9 kernel-source ppc 80be341bd9dae5037580af0e8bb9a908c2873747 kernel-source x86_64 cca0d57449f9ced3677d4c4463fa324a559caeb9 kernel-syms i586 01841e3147c4d0a10f175220d2a177079224a8a2 kernel-syms ppc a51385c07702dc28938cc4093ebb4fc9db219c2d kernel-syms x86_64 908b0c0b7d724bce50f1ab7dee82992837e1abe5 kernel-um i586 a9f2c075561f66712997b2637cb71c55324f5fed kernel-xen i586 4c7dcced7c89d9f2b4bf3bd3c42a8a38207c5c6d kernel-xen x86_64 9c5696739426d8e5951fd3c4620435e8911c06c0 kernel-xenpae i586 c68c99abaabf7160f0e458deeeee48a2307d08d1 kexec-tools i586 06bb3dcc44ff79db599409b38cd59bbcab425568 kexec-tools x86_64 e22d0c0504a0f69c278f15c6347e0bffb64ee821 mkinitrd i586 99394d98f518d51984741eacb4bae483dc9e669f mkinitrd ppc c0e7ebac9c0dded633073b5a679b7a6f0f1c8807 mkinitrd x86_64 264321869dcfc5d9a32e84cbbad8189fd0d6470e multipath-tools i586 b8e0108401e5784be81c7fe8ea29aefd1eb06793 multipath-tools ppc 8d7be7de9d802b1b4bb9c8a8b1882ba1f3da954a multipath-tools x86_64 058940019773f8e79250a94db8a80a83f78945db open-iscsi i586 428c65c0ac42f7d53ea6629bcccf3725be1ecd35 open-iscsi ppc c35596869f9542ba0097e18e13852e9a51793939 open-iscsi x86_64 f85391c39e052d6d56e0f6326fb2a65456ddfbee udev i586 ee634f300663634daaafb31fdfc332428b897692 udev ppc 365715bac32f1a3af05f5bf9ae46f588f03e4480 udev x86_64 59786e0f5e7989632e292a8a1e795a46f35b8d94