kernel Linux Kernel security update Linux Kernel security update This kernel update fixes the following security problems: - CVE-2007-1861: The nl_fib_lookup function in net/ipv4/fib_frontend.c allows attackers to cause a denial of service (kernel panic) via NETLINK_FIB_LOOKUP replies, which trigger infinite recursion and a stack overflow. - CVE-2007-1496: nfnetlink_log in netfilter allows attackers to cause a denial of service (crash) via unspecified vectors involving the (1) nfulnl_recv_config function, (2) using "multiple packets per netlink message", and (3) bridged packets, which trigger a NULL pointer dereference. - CVE-2007-1497: nf_conntrack in netfilter does not set nfctinfo during reassembly of fragmented packets, which leaves the default value as IP_CT_ESTABLISHED and might allow remote attackers to bypass certain rulesets using IPv6 fragments. Please note that the connection tracking option for IPv6 is not enabled in any currently shipping SUSE Linux kernel, so it does not affect SUSE Linux default kernels. - CVE-2007-2242: The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers (IPV6_RTHDR_TYPE_0) that create network amplification between two routers. The behaviour has been disabled by default, and the patch introduces a new sysctl with which the administrator can reenable it again. - CVE-2006-7203: The compat_sys_mount function in fs/compat.c allows local users to cause a denial of service (NULL pointer dereference and oops) by mounting a smbfs file system in compatibility mode ("mount -t smbfs"). - CVE-2007-2453: Seeding of the kernel random generator on boot did not work correctly due to a programming mistake and so the kernel might have more predictable random numbers than assured. - CVE-2007-2876: A NULL pointer dereference in SCTP connection tracking could be caused by a remote attacker by sending specially crafted packets. Note that this requires SCTP set-up and active to be exploitable. and the following non security bugs: - - patches.fixes/cpufreq_fix_limited_on_battery.patch: Fix limited freq when booted on battery. [#231107] - - patches.fixes/usb-keyspan-regression-fix.patch: USB: keyspan regression fix [#240919] - - patches.fixes/hpt366-dont-check-enablebits-for-hpt36x.patch: hpt366: don't check enablebits for HPT36x [#278696] Dieses Kernel Update behebt folgende Sicherheitsprobleme (aufgelistet in englischer Sprache): - CVE-2007-1861: The nl_fib_lookup function in net/ipv4/fib_frontend.c allows attackers to cause a denial of service (kernel panic) via NETLINK_FIB_LOOKUP replies, which trigger infinite recursion and a stack overflow. - CVE-2007-1496: nfnetlink_log in netfilter allows attackers to cause a denial of service (crash) via unspecified vectors involving the (1) nfulnl_recv_config function, (2) using "multiple packets per netlink message", and (3) bridged packets, which trigger a NULL pointer dereference. - CVE-2007-1497: nf_conntrack in netfilter does not set nfctinfo during reassembly of fragmented packets, which leaves the default value as IP_CT_ESTABLISHED and might allow remote attackers to bypass certain rulesets using IPv6 fragments. Please note that the connection tracking option for IPv6 is not enabled in any currently shipping SUSE Linux kernel, so it does not affect SUSE Linux default kernels. - CVE-2007-2242: The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers (IPV6_RTHDR_TYPE_0) that create network amplification between two routers. The behaviour has been disabled by default, and the patch introduces a new sysctl with which the administrator can reenable it again. - CVE-2006-7203: The compat_sys_mount function in fs/compat.c allows local users to cause a denial of service (NULL pointer dereference and oops) by mounting a smbfs file system in compatibility mode ("mount -t smbfs"). - CVE-2007-2453: Seeding of the kernel random generator on boot did not work correctly due to a programming mistake and so the kernel might have more predictable random numbers than assured. - CVE-2007-2876: A NULL pointer dereference in SCTP connection tracking could be caused by a remote attacker by sending specially crafted packets. Note that this requires SCTP set-up and active to be exploitable. Des weiteren wurden folgende Fehler behoben: - patches.fixes/cpufreq_fix_limited_on_battery.patch: Fix limited freq when booted on battery. [#231107] - patches.fixes/usb-keyspan-regression-fix.patch: USB: keyspan regression fix [#240919] - patches.fixes/hpt366-dont-check-enablebits-for-hpt36x.patch: hpt366: don't check enablebits for HPT36x [#278696] security This update can be used to install a new kernel. If you decide to use the kernel update, we recommend that you reboot your system upon completion of the YaST Online Update, as additional kernel modules may be needed which can only be loaded after the system is rebooted. kernel-bigsmp i586 4ba2bd873a6c33f39ecdbd66c6dd02e914d4c042 kernel-default i586 f1345978a75eee79d1b056aefcce06e4b39f4737 kernel-default ppc 586771aaef8a8ee1f6d9cbf31afae56a55281006 kernel-default x86_64 f12a625c2ae9fdceb97a0d5bb4a75b2fd57a522b kernel-iseries64 ppc 1e3990e03f164b49685cc41cab074e514d8f7991 kernel-ppc64 ppc 2ee8d2d25831749b87f9b1de7d8cf7c96d4ca4ad kernel-source i586 343d378cf893eafe2f4896e5cafeac5b01164d3c kernel-source ppc 6dac2f59f6879a4707e21534538ab4d6c3367299 kernel-source x86_64 29c54d243bb571d5d1bc09c6f65425f344231693 kernel-syms i586 3c9ce72d103ab0b58b3ccbe42fcbe458f580ddfa kernel-syms ppc 6758923ab72d56144f557125be59eabdcaaa23fe kernel-syms x86_64 3d11117ed4b2ae9349a03266d081637d39906adc kernel-xen i586 51bae75135471f0db67e4a14f049a26d1caad736 kernel-xen x86_64 3a18eb93935a35bd01dc1ba75506f6ff7cb6d026 kernel-xenpae i586 490d6ec8e0496267061de3a0b18d949e3926f05d