rhsa-2013_0566
Vulnerability from csaf_redhat
Published
2013-03-06 19:16
Modified
2024-11-22 06:43
Summary
Red Hat Security Advisory: kernel-rt security and bug fix update

Notes

Topic
Updated kernel-rt packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise MRG 2.3. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Details
The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: * A buffer overflow flaw was found in the way UTF-8 characters were converted to UTF-16 in the utf8s_to_utf16s() function of the Linux kernel's FAT file system implementation. A local user able to mount a FAT file system with the "utf8=1" option could use this flaw to crash the system or, potentially, to escalate their privileges. (CVE-2013-1773, Important) * It was found that the RHSA-2012:0333 update did not correctly fix the CVE-2011-4131 issue. A malicious Network File System version 4 (NFSv4) server could return a crafted reply to a GETACL request, causing a denial of service on the client. (CVE-2012-2375, Moderate) * A memory disclosure flaw was found in the way the load_script() function in the binfmt_script binary format handler handled excessive recursions. A local, unprivileged user could use this flaw to leak kernel stack memory to user-space by executing specially-crafted scripts. (CVE-2012-4530, Low) * A flaw was found in the way file permission checks for the "/dev/kmsg" file were performed in restricted root environments (for example, when using a capability-based security model). A local user able to write to this file could cause a denial of service. (CVE-2013-1772, Low) The CVE-2012-2375 issue was discovered by Jian Li of Red Hat. This update also fixes multiple bugs. Documentation for these changes will be available shortly from the Technical Notes document linked to in the References section. Users should upgrade to these updated packages, which upgrade the kernel-rt kernel to version kernel-rt-3.6.11-rt28, correct these issues, and fix the bugs noted in the Red Hat Enterprise MRG 2 Technical Notes. The system must be rebooted for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated kernel-rt packages that fix several security issues and multiple\nbugs are now available for Red Hat Enterprise MRG 2.3.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The kernel-rt packages contain the Linux kernel, the core of any Linux\noperating system.\n\nThis update fixes the following security issues:\n\n* A buffer overflow flaw was found in the way UTF-8 characters were\nconverted to UTF-16 in the utf8s_to_utf16s() function of the Linux kernel\u0027s\nFAT file system implementation. A local user able to mount a FAT file\nsystem with the \"utf8=1\" option could use this flaw to crash the system or,\npotentially, to escalate their privileges. (CVE-2013-1773, Important)\n\n* It was found that the RHSA-2012:0333 update did not correctly fix the\nCVE-2011-4131 issue. A malicious Network File System version 4 (NFSv4)\nserver could return a crafted reply to a GETACL request, causing a denial\nof service on the client. (CVE-2012-2375, Moderate)\n\n* A memory disclosure flaw was found in the way the load_script() function\nin the binfmt_script binary format handler handled excessive recursions. A\nlocal, unprivileged user could use this flaw to leak kernel stack memory to\nuser-space by executing specially-crafted scripts. (CVE-2012-4530, Low)\n\n* A flaw was found in the way file permission checks for the \"/dev/kmsg\"\nfile were performed in restricted root environments (for example, when\nusing a capability-based security model). A local user able to write to\nthis file could cause a denial of service. (CVE-2013-1772, Low)\n\nThe CVE-2012-2375 issue was discovered by Jian Li of Red Hat.\n\nThis update also fixes multiple bugs. Documentation for these changes will\nbe available shortly from the Technical Notes document linked to in the\nReferences section.\n\nUsers should upgrade to these updated packages, which upgrade the kernel-rt\nkernel to version kernel-rt-3.6.11-rt28, correct these issues, and fix the\nbugs noted in the Red Hat Enterprise MRG 2 Technical Notes. The system must\nbe rebooted for this update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0566",
        "url": "https://access.redhat.com/errata/RHSA-2013:0566"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://rhn.redhat.com/errata/RHSA-2012-0333.html",
        "url": "https://rhn.redhat.com/errata/RHSA-2012-0333.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_MRG/2/html/Technical_Notes/RHSA-2013-0566.html",
        "url": "https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_MRG/2/html/Technical_Notes/RHSA-2013-0566.html"
      },
      {
        "category": "external",
        "summary": "773017",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=773017"
      },
      {
        "category": "external",
        "summary": "822869",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=822869"
      },
      {
        "category": "external",
        "summary": "866596",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=866596"
      },
      {
        "category": "external",
        "summary": "866600",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=866600"
      },
      {
        "category": "external",
        "summary": "868285",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=868285"
      },
      {
        "category": "external",
        "summary": "916075",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=916075"
      },
      {
        "category": "external",
        "summary": "916115",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=916115"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0566.json"
      }
    ],
    "title": "Red Hat Security Advisory: kernel-rt security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T06:43:53+00:00",
      "generator": {
        "date": "2024-11-22T06:43:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:0566",
      "initial_release_date": "2013-03-06T19:16:00+00:00",
      "revision_history": [
        {
          "date": "2013-03-06T19:16:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-03-06T19:24:01+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T06:43:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat MRG Realtime for RHEL 6 Server v.2",
                "product": {
                  "name": "Red Hat MRG Realtime for RHEL 6 Server v.2",
                  "product_id": "6Server-MRG-Realtime-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise MRG for RHEL-6"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
                "product": {
                  "name": "kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
                  "product_id": "kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-firmware@3.6.11-rt28.20.el6rt?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch",
                "product": {
                  "name": "mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch",
                  "product_id": "mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mrg-rt-release@3.6.11-rt28.20.el6rt?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
                "product": {
                  "name": "kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
                  "product_id": "kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-doc@3.6.11-rt28.20.el6rt?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace-devel@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-vanilla-devel@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace-debuginfo@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-vanilla@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-vanilla-debuginfo@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-devel@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-devel@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
                "product": {
                  "name": "kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_id": "kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@3.6.11-rt28.20.el6rt?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:3.6.11-rt28.20.el6rt.src",
                "product": {
                  "name": "kernel-rt-0:3.6.11-rt28.20.el6rt.src",
                  "product_id": "kernel-rt-0:3.6.11-rt28.20.el6rt.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@3.6.11-rt28.20.el6rt?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:3.6.11-rt28.20.el6rt.src as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src"
        },
        "product_reference": "kernel-rt-0:3.6.11-rt28.20.el6rt.src",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch"
        },
        "product_reference": "kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch"
        },
        "product_reference": "kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64 as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64"
        },
        "product_reference": "kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch as a component of Red Hat MRG Realtime for RHEL 6 Server v.2",
          "product_id": "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
        },
        "product_reference": "mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch",
        "relates_to_product_reference": "6Server-MRG-Realtime-2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jian Li"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2012-2375",
      "discovery_date": "2012-03-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "822869"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: incomplete fix for CVE-2011-4131",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
          "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
          "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
          "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-2375"
        },
        {
          "category": "external",
          "summary": "RHBZ#822869",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=822869"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2375",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-2375"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2375",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2375"
        }
      ],
      "release_date": "2012-03-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-06T19:16:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not\nuse \"rpm -Uvh\" as that will remove the running kernel binaries from\nyour system. You may use \"rpm -e\" to remove old kernels after\ndetermining that the new kernel functions properly on your system.",
          "product_ids": [
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0566"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 4.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "products": [
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: incomplete fix for CVE-2011-4131"
    },
    {
      "cve": "CVE-2012-4530",
      "discovery_date": "2012-10-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "868285"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: stack disclosure in binfmt_script load_script()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5.\n\nThis issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6.\n\nThis issue did affect the version of Linux kernel as shipped with Red Hat Enterprise MRG 2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
          "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
          "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
          "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-4530"
        },
        {
          "category": "external",
          "summary": "RHBZ#868285",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=868285"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-4530",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-4530"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-4530",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4530"
        }
      ],
      "release_date": "2012-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-06T19:16:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not\nuse \"rpm -Uvh\" as that will remove the running kernel binaries from\nyour system. You may use \"rpm -e\" to remove old kernels after\ndetermining that the new kernel functions properly on your system.",
          "product_ids": [
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0566"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "kernel: stack disclosure in binfmt_script load_script()"
    },
    {
      "cve": "CVE-2013-1772",
      "discovery_date": "2013-02-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "916075"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: call_console_drivers() function log prefix stripping DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect the versions of kernel package as shipped with Red Hat Enterprise Linux 5 and 6. Future kernel updates for Red Hat Enterprise MRG 2 may address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
          "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
          "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
          "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-1772"
        },
        {
          "category": "external",
          "summary": "RHBZ#916075",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=916075"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1772",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-1772"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1772",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1772"
        }
      ],
      "release_date": "2013-02-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-06T19:16:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not\nuse \"rpm -Uvh\" as that will remove the running kernel binaries from\nyour system. You may use \"rpm -e\" to remove old kernels after\ndetermining that the new kernel functions properly on your system.",
          "product_ids": [
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0566"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "SINGLE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 3.8,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:H/Au:S/C:N/I:N/A:C",
            "version": "2.0"
          },
          "products": [
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "kernel: call_console_drivers() function log prefix stripping DoS"
    },
    {
      "cve": "CVE-2013-1773",
      "discovery_date": "2013-02-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "916115"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: VFAT slab-based buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue does not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5.\n\nThis issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
          "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
          "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
          "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
          "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-1773"
        },
        {
          "category": "external",
          "summary": "RHBZ#916115",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=916115"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1773",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-1773"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1773",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1773"
        }
      ],
      "release_date": "2012-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-06T19:16:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258\n\nTo install kernel packages manually, use \"rpm -ivh [package]\". Do not\nuse \"rpm -Uvh\" as that will remove the running kernel binaries from\nyour system. You may use \"rpm -e\" to remove old kernels after\ndetermining that the new kernel functions properly on your system.",
          "product_ids": [
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0566"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.2,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "products": [
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.src",
            "6Server-MRG-Realtime-2:kernel-rt-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debug-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-debuginfo-common-x86_64-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-doc-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-firmware-0:3.6.11-rt28.20.el6rt.noarch",
            "6Server-MRG-Realtime-2:kernel-rt-trace-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-trace-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-debuginfo-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:kernel-rt-vanilla-devel-0:3.6.11-rt28.20.el6rt.x86_64",
            "6Server-MRG-Realtime-2:mrg-rt-release-0:3.6.11-rt28.20.el6rt.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: VFAT slab-based buffer overflow"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.