Secunia

Some vulnerabilities have been reported in the Linux Kernel, which can be exploited by malicious, local users to bypass certain security restrictions and cause a DoS (Denial of Service), and malicious people to cause a DoS.

1) An error within the "decode_choice()" function in net/netfilter/bf_conntrack_h323_asn1.c when handling choices that are still encoded in the fixed-size bitfield can be exploited to cause access to undefined types, resulting in a crash.

2) MSR bits are cleared after copying the state into the thread_struct. This can be exploited to cause corruption of the floating point state after returning from signal handlers, resulting in a DoS.

Successful exploitation requires a PowerPC based architecture.

3) The "do_change_type()" function in fs/namespace.c does not properly check for "CAP_SYS_ADMIN" privileges before performing certain operations. This can be exploited to e.g. mark private mounts as shared or mark a mount as unbindable.

Solution
Update to version 2.6.22.
Further details available in Customer Area

Provided and/or discovered by
1) Zhongling Wen
2) Reported by the vendor
3) Reported in a Red Hat bug.

Changelog
Further details available in Customer Area

Original Advisory
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22

3) https://bugzilla.redhat.com/show_bug.cgi?id=454388

Deep Links
Links available in Customer Area