RHSA-2015:1221Medium

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Published
July 14, 2015
Last Modified
November 7, 2026

🔗 CVE IDs covered (5)

CVE-2011-5321 →CVE-2015-1593 →CVE-2015-2830 →CVE-2015-2922 →CVE-2015-3636 →

📋 Description

CVE-2011-5321 — Kernel: tty: driver reference leakage in tty_open CVE-2015-1593 — kernel: Linux stack ASLR implementation Integer overflow CVE-2015-2830 — kernel: int80 fork from 64-bit tasks mishandling CVE-2015-2922 — kernel: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements. CVE-2015-3636 — kernel: ping sockets: use-after-free leading to local privilege escalation

🎯 Affected products182

  • Red Hat Enterprise Linux Desktop (v. 6)
  • Red Hat Enterprise Linux Desktop Optional (v. 6)
  • Red Hat Enterprise Linux HPC Node (v. 6)
  • Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Enterprise Linux Server Optional (v. 6)
  • Red Hat Enterprise Linux Workstation (v. 6)
  • Red Hat Enterprise Linux Workstation Optional (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.src as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • kernel-0:2.6.32-504.30.3.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • kernel-abi-whitelists-0:2.6.32-504.30.3.el6.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • kernel-abi-whitelists-0:2.6.32-504.30.3.el6.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • kernel-abi-whitelists-0:2.6.32-504.30.3.el6.noarch as a component of Red Hat Enterprise Linux Server (v. 6)
  • kernel-abi-whitelists-0:2.6.32-504.30.3.el6.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • kernel-bootwrapper-0:2.6.32-504.30.3.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • kernel-debug-0:2.6.32-504.30.3.el6.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • kernel-debug-0:2.6.32-504.30.3.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • kernel-debug-0:2.6.32-504.30.3.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • kernel-debug-0:2.6.32-504.30.3.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • +152 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: You can check whether ping socket functionality is enabled by examining the net.ipv4.ping_group_range sysctl value: ~]# sysctl net.ipv4.ping_group_range net.ipv4.ping_group_range = 1 0 "1 0" is the default value and disables the ping socket functionality even for root user. Any other value means that the ping socket functionality might be enabled for certain users on the system. To mitigate this vulnerability make sure that you either allow the functionality to trusted local users (groups) only or set the net.ipv4.ping_group_range sysctl to the default and disabled state: ~]# sysctl net.ipv4.ping_group_range="1 0" Please note that this might prevent some programs relying on this functionality from functioning properly.

🔗 References (9)