A security issue and some vulnerabilities have been reported in the Linux Kernel, which can be exploited by malicious, local users to manipulate certain data and cause a DoS (Denial of Service), and by malicious people to potentially compromise a vulnerable system.

1) The security issue is caused due to insecure permissions being set to driver attributes in sysfs ("/sys/bus/pci/drivers/megaraid_sas/poll_mode_io") and can be exploited to manipulate driver behaviour.

2) A locking error within the TTY subsystem can be exploited to cause a NULL pointer dereference.

3) A boundary error within the "hfs_bnode_read()" function in fs/hfs/bnode.c can be exploited to cause a buffer overflow by e.g. tricking a user into mounting and accessing a specially crafted HFS file system.

4) A vulnerability is caused due to an unspecified error when handling the EXT4_IOC_MOVE_EXT IOCTL. This can be exploited to e.g. cause a file system corruption by sending a specially crafted IOCTL.

Solution
Update to version 2.6.33, which fixes vulnerabilities #1, #2, and #3.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Bryn M. Reeves, reported in a Red Hat bugreport.
2) Kyle Bader
3) Amerigo Wan, Red Hat
4) Brad Spengler

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) https://bugzilla.redhat.com/show_bug.cgi?id=526068
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bb7d3f24c71e528989501617651b669fbed798cb
2) http://bugzilla.kernel.org/show_bug.cgi?id=14605
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=80e1e823989ec44d8e35bdfddadbddcffec90424
3) https://bugzilla.redhat.com/show_bug.cgi?id=540736
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ec81aecb29668ad71f699f4e7b96ec46691895b6
4) http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html
http://twitter.com/spendergrsec/status/6567167692
http://twitter.com/spendergrsec/status/6569596339

Deep Links
Links available to Secunia VIM customers