kernel Linux Kernel update Linux Kernel update This kernel update fixes the following security problems: CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine. CVE-2008-1615: On x86_64 a denial of service attack could be used by local attackers to immediately panic / crash the machine. CVE-2008-2148: The permission checking in sys_utimensat was incorrect and local attackers could change the filetimes of files they do not own to the current time. CVE-2008-1669: Fixed a SMP ordering problem in fcntl_setlk could potentially allow local attackers to execute code by timing file locking. CVE-2008-1375: Fixed a dnotify race condition, which could be used by local attackers to potentially execute code. CVE-2007-6282: A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets (default filtered by the firewall). CVE-2008-1367: Clear the "direction" flag before calling signal handlers. For specific not yet identified programs under specific timing conditions this could potentially have caused memory corruption or code execution. And the following bugs (numbers are https://bugzilla.novell.com/ references): - patches.fixes/input-add-amilo-pro-v-to-nomux.patch: Update the patch to include also 2030 model to nomux list (bnc#389169). - patches.apparmor/fix-net.diff: AppArmor: fix Oops in apparmor_socket_getpeersec_dgram() (bnc#378608). - patches.fixes/input-alps-update.patch: Input: fix the AlpsPS2 driver (bnc#357881). - patches.arch/cpufreq_fix_acpi_driver_on_BIOS_changes.patch: CPUFREQ: Check against freq changes from the BIOS (334378). - patches.fixes/ieee1394-limit-early-node-speed-to-host-interf ace-speed: ieee1394: limit early node speed to host interface speed (381304). - patches.fixes/forcedeth_realtec_phy_fix: Fix a regression to the GA kernel for some forcedeth cards (bnc#379478) - pci-revert-SMBus-unhide-on-nx6110.patch: Do not unhide the SMBus on the HP Compaq nx6110, it's unsafe. - patches.drivers/e1000-disable-l1aspm.patch: Disable L1 ASPM power savings for 82573 mobile variants, it's broken (bnc#254713, LTC34077). - patches.drivers/libata-improve-hpa-error-handling: libata: improve HPA error handling (365534). - rpm/kernel-binary.spec.in: Added Conflicts: libc.so.6()(64bit) to i386 arch (364433). - patches.drivers/libata-disallow-sysfs-read-access-to-force-p aram: libata: don't allow sysfs read access to force param (362599). - patches.suse/bonding-workqueue: Update to fix a hang when closing a bonding device (342994). - patches.fixes/mptspi-dv-renegotiate-oops: mptlinux crashes on kernel 2.6.22 (bnc#271749). - patches.drivers/usb-update-sierra-and-option-device-ids-from -2.6.25-rc3.patch: USB: update sierra and option device ids from 2.6.25-rc3 (343167). - patches.arch/x86-nvidia-timer-quirk: Disable again (#302327) The PCI ID lists are not complete enough and let's have the same crap as mainline for this for now. - patches.fixes/input-add-lenovo-3000-n100-to-nomux.patch: Input: add Lenovo 3000 N100 to nomux blacklist (bnc#284013). - patches.suse/bonding-bh-locking: Add missing chunks. The SLES10 SP1 version of the patch was updated in May 2007 but the openSuse 10.3 version was forgotten (260069). - patches.fixes/knfsd-Allow-NFSv2-3-WRITE-calls-to-succeed-whe n-krb.patch: knfsd: Allow NFSv2/3 WRITE calls to succeed when krb5i etc is used. (348737). - patches.fixes/md-fix-an-occasional-deadlock-in-raid5.patch: md: fix an occasional deadlock in raid5 (357088). - patches.drivers/libata-quirk_amd_ide_mode: PCI: modify SATA IDE mode quirk (345124). - Fix section mismatch build failure w/ gcc 4.1.2. bug #361086. - patches.drivers/libata-implement-force-parameter: libata: implement libata.force module parameter (337610). Lots of XEN Fixes (not detailed listed). Lots of RT Fixes (not detailed listed). - Update to 2.6.22.18 - removes upstreamed patch: - patches.fixes/vmsplice-pipe-exploit (CVE-2008-0600) Dieses Kernel Update behebt folgende Sicherheitsprobleme (aufgelistet in englischer Sprache): This kernel update fixes the following security problems: CVE-2008-2136: A problem in SIT IPv6 tunnel handling could be used by remote attackers to immediately crash the machine. CVE-2008-1615: On x86_64 a denial of service attack could be used by local attackers to immediately panic / crash the machine. CVE-2008-2148: The permission checking in sys_utimensat was incorrect and local attackers could change the filetimes of files they do not own to the current time. CVE-2008-1669: Fixed a SMP ordering problem in fcntl_setlk could potentially allow local attackers to execute code by timing file locking. CVE-2008-1375: Fixed a dnotify race condition, which could be used by local attackers to potentially execute code. CVE-2007-6282: A remote attacker could crash the IPSec/IPv6 stack by sending a bad ESP packet. This requires the host to be able to receive such packets (default filtered by the firewall). CVE-2008-1367: Clear the "direction" flag before calling signal handlers. For specific not yet identified programs under specific timing conditions this could potentially have caused memory corruption or code execution. Und behebt folgende Fehler (aufgelistet in englischer Sprache mit Novell Bugzilla Nummern): - patches.fixes/input-add-amilo-pro-v-to-nomux.patch: Update the patch to include also 2030 model to nomux list (bnc#389169). - patches.apparmor/fix-net.diff: AppArmor: fix Oops in apparmor_socket_getpeersec_dgram() (bnc#378608). - patches.fixes/input-alps-update.patch: Input: fix the AlpsPS2 driver (bnc#357881). - patches.arch/cpufreq_fix_acpi_driver_on_BIOS_changes.patch: CPUFREQ: Check against freq changes from the BIOS (334378). - patches.fixes/ieee1394-limit-early-node-speed-to-host-interf ace-speed: ieee1394: limit early node speed to host interface speed (381304). - patches.fixes/forcedeth_realtec_phy_fix: Fix a regression to the GA kernel for some forcedeth cards (bnc#379478) - pci-revert-SMBus-unhide-on-nx6110.patch: Do not unhide the SMBus on the HP Compaq nx6110, it's unsafe. - patches.drivers/e1000-disable-l1aspm.patch: Disable L1 ASPM power savings for 82573 mobile variants, it's broken (bnc#254713, LTC34077). - patches.drivers/libata-improve-hpa-error-handling: libata: improve HPA error handling (365534). - rpm/kernel-binary.spec.in: Added Conflicts: libc.so.6()(64bit) to i386 arch (364433). - patches.drivers/libata-disallow-sysfs-read-access-to-force-p aram: libata: don't allow sysfs read access to force param (362599). - patches.suse/bonding-workqueue: Update to fix a hang when closing a bonding device (342994). - patches.fixes/mptspi-dv-renegotiate-oops: mptlinux crashes on kernel 2.6.22 (bnc#271749). - patches.drivers/usb-update-sierra-and-option-device-ids-from -2.6.25-rc3.patch: USB: update sierra and option device ids from 2.6.25-rc3 (343167). - patches.arch/x86-nvidia-timer-quirk: Disable again (#302327) The PCI ID lists are not complete enough and let's have the same crap as mainline for this for now. - patches.fixes/input-add-lenovo-3000-n100-to-nomux.patch: Input: add Lenovo 3000 N100 to nomux blacklist (bnc#284013). - patches.suse/bonding-bh-locking: Add missing chunks. The SLES10 SP1 version of the patch was updated in May 2007 but the openSuse 10.3 version was forgotten (260069). - patches.fixes/knfsd-Allow-NFSv2-3-WRITE-calls-to-succeed-whe n-krb.patch: knfsd: Allow NFSv2/3 WRITE calls to succeed when krb5i etc is used. (348737). - patches.fixes/md-fix-an-occasional-deadlock-in-raid5.patch: md: fix an occasional deadlock in raid5 (357088). - patches.drivers/libata-quirk_amd_ide_mode: PCI: modify SATA IDE mode quirk (345124). - Fix section mismatch build failure w/ gcc 4.1.2. bug #361086. - patches.drivers/libata-implement-force-parameter: libata: implement libata.force module parameter (337610). Lots of XEN Fixes (not detailed listed). Lots of RT Fixes (not detailed listed). - Update to 2.6.22.18 - removes upstreamed patch: - patches.fixes/vmsplice-pipe-exploit (CVE-2008-0600) security This update can be used to install a new kernel. If you decide to use the kernel update, we recommend that you reboot your system upon completion of the YaST Online Update, as additional kernel modules may be needed which can only be loaded after the system is rebooted. kernel-bigsmp i586 8c19b264d6da2481ff7ef57fd12821763610ff06 kernel-debug i586 a5d678cf16fd1dd41f81fa6dbe18ae56a69b692f kernel-debug x86_64 f0cf62b7b402b7d6cd110e262047c710c4a3f42d kernel-default i586 0556f7d60d51ddf9d1a1d2baffb616427d43ec62 kernel-default ppc d1b96873c836cb36dfc6cc854f728ef87a569354 kernel-default x86_64 e0a88bccea717f91712b2f35c62c1b108816d225 kernel-kdump ppc f65942cb54d8812d4324c28176e3c87766dcdb6f kernel-ppc64 ppc d748fde787d25cea0f7c2f8b905ab628f29a52ae kernel-source i586 d13220914008bab146288740d403733d75ad4c84 kernel-source ppc 26cde30ed7db52a826f68b36a9b3ddcd19357bd1 kernel-source x86_64 2f052d5bcd5508f0e559ec4d51365ee703a84cda kernel-syms i586 e19a47dc53a3b8ccc0ac3ae4e2783520ff3b806f kernel-syms ppc 0c73bcac495cf662a478271896a78ea801594277 kernel-syms x86_64 5fc756af1a9d8916669c70aba062a154ee4b3500 kernel-xen i586 4f1d335d5098047be2118167b1ff8c02ac8cc6fa kernel-xen x86_64 0799e42357c9d6e03a35c76249eae909888994dc kernel-xenpae i586 c238cf948993c7a4797006f5bb86b404eaf1ad8d