huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2010-4080: kernel: drivers/sound/pci/rme9652/hdsp.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-09-25T00:00:00+00:00

The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3 as it did not include support for RME Hammerfall DSP Audio.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e68d3b316ab7b02a074edc4f770e6a746390cb7d
CVE-2010-4081: kernel: drivers/sound/pci/rme9652/hdspm.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-09-25T00:00:00+00:00

The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 3 and 4 as they did not include support for RME Hammerfall DSP
MADI Audio interface.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e68d3b316ab7b02a074edc4f770e6a746390cb7d
CVE-2010-4082: kernel: drivers/video/via/ioctl.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-09-15T00:00:00+00:00

The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, and 5 as they did not include support for VIA UniChrome (Pro) and Chrome9 graphics boards.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: b4aaa78f4c2f9cde2f335b14f4ca30b01f9651ca
CVE-2010-4083: kernel: ipc/sem.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-09-23T00:00:00+00:00

The copy_semid_to_user function in ipc/sem.c in the Linux kernel before 2.6.36 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call.

Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 3,
due to this product being in Extended Life Cycle Phase of its
maintenance life-cycle, where only qualified security errata of critical
impact are addressed.

For further information about the Errata Support Policy, visit:
http://www.redhat.com/security/updates/errata

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 982f7c2b2e6a28f8f266e075d92e19c0dd4c6e56
CVE-2010-4157: kernel: gdth: integer overflow in ioc_general()
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2010-11-08T00:00:00+00:00

Integer overflow in the ioc_general function in drivers/scsi/gdth.c in the Linux kernel before 2.6.36.1 on 64-bit platforms allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large argument in an ioctl call.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3 did not include the vulnerable code, and therefore is not affected by this issue. Future kernel updates in Red Hat Enterprise Linux 4, 5 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: f63ae56e4e97fb12053590e41a4fa59e7daa74a4
CVE-2010-4158: kernel: socket filters infoleak
Component: kernel
Severity: Low
Public date: 2010-11-10T00:00:00+00:00

The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 57fe93b374a6b8711995c2d466c502af9f3a08bb
CVE-2010-4160: kernel: L2TP send buffer allocation size overflows
Component: kernel
Severity: Important
Public date: 2010-11-01T00:00:00+00:00

Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and 5 did not
include L2TP functionality, and therefore are not affected by this
issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat
Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0007.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 8acfe468b0384e834a303f08ebc4953d72fb690a
CVE-2010-4162: kernel: bio: integer overflow page count when mapping/copying user data
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2010-11-10T00:00:00+00:00

Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4 and 5 as they did not backport the upstream commit c5dec1c3 that introduced the issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0007.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: cb4644cac4a2797afc847e6c92736664d4b0ea34
CVE-2010-4163: kernel: panic when submitting certain 0-length I/O requests
Component: kernel
Severity: Moderate
Public date: 2010-11-10T00:00:00+00:00

The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.36.2 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4 and 5 as they did not backport the upstream commit c5dec1c3
that introduced the issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0007.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9284bcf4e335e5f18a8bc7b26461c33ab60d0689
CVE-2010-4165: kernel: possible kernel oops from user MSS
Component: kernel
Severity: Moderate
Public date: 2010-11-10T00:00:00+00:00

The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as they did not backport the upstream commit that introduced the issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0283.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2
CVE-2010-4169: kernel: perf bug
Component: kernel
Severity: Moderate
Public date: 2010-11-09T00:00:00+00:00

Use-after-free vulnerability in mm/mprotect.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors involving an mprotect system call.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and 5 did not backport the upstream commit dab5855 that introduced the issue. Future kernel updates in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 63bfd7384b119409685a17d5c58f0b56e5dc03da
CVE-2010-4170: Systemtap: Insecure loading of modules
Component: Systemtap
Severity: Important
CWE: CWE-284 (Improper Access Control)
Public date: 2010-11-17T00:00:00+00:00

The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.


Affected upstream versions: n/a
Upstream repository: https://sources.redhat.com/git/systemtap.git
Upstream fix commit: b7565b41228bea196cefa3a7d43ab67f8f9152e2
CVE-2010-4171: Systemtap: Ability to remove unused modules by unprivileged user
Component: Systemtap
Severity: Low
Public date: 2010-11-17T00:00:00+00:00

The staprun runtime tool in SystemTap 1.3 does not verify that a module to unload was previously loaded by SystemTap, which allows local users to cause a denial of service (unloading of arbitrary kernel modules).

Statement: This issue does not affect the version of the systemtap package as shipped
with Red Hat Enterprise Linux 4.

Affected upstream versions: n/a
Upstream repository: https://sources.redhat.com/git/systemtap.git
Upstream fix commit: b7565b41228bea196cefa3a7d43ab67f8f9152e2
CVE-2010-4203: libvpx: memory corruption flaw
Component: libvpx
Severity: Moderate
Public date: 2010-11-04T00:00:00+00:00

WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via invalid frames.


Affected upstream versions: n/a
Upstream repository: https://review.webmproject.org/libvpx.git
Upstream fix commit: 09bcc1f710ea65dc158639479288fb1908ff0c53
CVE-2010-4243: kernel: mm: mem allocated invisible to oom_kill() when not attached to any threads
Component: kernel
Severity: Moderate
Public date: 2010-08-13T00:00:00+00:00

fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an "OOM dodging issue," a related issue to CVE-2010-3858.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 3c77f845722158206a7209c45ccddc264d19319c
CVE-2010-4248: kernel: posix-cpu-timers: workaround to suppress the problems with mt exec
Component: kernel
Severity: Moderate
Public date: 2010-11-05T00:00:00+00:00

Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader in the de_thread function in fs/exec.c.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not have support for CPU time clocks for the POSIX clock interface. This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0004.html, https://rhn.redhat.com/errata/RHSA-2011-0007.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e0a70217107e6f9844628120412cb27bb4cea194
CVE-2010-4249: kernel: unix socket local dos
Component: kernel
Severity: Moderate
Public date: 2010-11-24T00:00:00+00:00

The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage collection of inflight sockets, which allows local users to cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for SOCK_SEQPACKET sockets.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/davem/net-2.6.git
Upstream fix commit: 9915672d41273f5b77f1b3c29b391ffb7732b84b
CVE-2010-4250: kernel: inotify memory leak
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
Public date: 2010-11-24T00:00:00+00:00

Memory leak in the inotify_init1 function in fs/notify/inotify/inotify_user.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory consumption) via vectors involving failed attempts to create files.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5. It was addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0330.html. A future kernel update in Red Hat Enterprise Linux 6 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: a2ae4cc9a16e211c8a128ba10d22a85431f093ab
CVE-2010-4251: kernel: unlimited socket backlog DoS
Component: kernel
Severity: Moderate
Public date: 2010-11-25T00:00:00+00:00

The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG as they have already backported the fixes for this issue. Future kernel updates in Red Hat Enterprise Linux 6 may address this flaw. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.34
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 8eae939f1400326b06d0c9afe53d2a484a326871
CVE-2010-4263: kernel: igb panics when receiving tag vlan packet
Component: kernel
Severity: Important
Public date: 2010-03-19T00:00:00+00:00

The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 4 and Red Hat Enterprise MRG as they did not include support for PCI I/O Virtualization (IOV). Future updates in Red Hat Enterprise Linux 5 and 6 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.34
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 31b24b955c3ebbb6f3008a6374e61cf7c05a193c
CVE-2010-4343: kernel: bfa driver sysfs crash
Component: kernel
Severity: Moderate
Public date: 2010-05-21T00:00:00+00:00

drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 4 as it did not include support for the Brocade Fibre Channel Host Bus Adapter driver. It did not affect the version of Linux kernels as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they have the included the fix for this issue. A future kernel update in Red Hat Enterprise Linux 5 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.35
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 7873ca4e4401f0ecd8868bf1543113467e6bae61
CVE-2010-4344: exim: remote code execution flaw
Component: exim
Severity: Critical
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
Public date: 2010-12-07T00:00:00+00:00

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.


Affected upstream versions: n/a
Upstream repository: https://git.exim.org/exim.git
Upstream fix commit: 24c929a27415c7cfc7126c47e4cad39acf3efa6b
CVE-2010-4346: kernel: install_special_mapping skips security_file_mmap check
Component: kernel
Severity: Low
Public date: 2010-12-09T00:00:00+00:00

The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 4 is not vulnerable because it checks for mmap_min_addr even in special cases.

The Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG have mmap_min_addr sysctl tunable set to 4096, and therefore are not affected by this issue. However, as a preventive measure (for example, for administrators who have increased mmap_min_addr), we have addressed this in Red Hat Enterprise Linux 5, 6 and MRG via https://rhn.redhat.com/errata/RHSA-2011-0429.html, https://rhn.redhat.com/errata/RHSA-2011-0421.html, and https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 462e635e5b73ba9a4c03913b77138cd57ce4b050
CVE-2010-4347: kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method
Component: kernel
Severity: Moderate
Public date: 2010-11-13T00:00:00+00:00

The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 4, 5, and 6 as they did not include upstream commit a1a541d8 and a25ee920 that introduced the problem. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Notes:

This requires debugfs to be mounted on a local system in order to have access to the custom_method file. Debugfs is not mounted by default. You need to run "mount -t debugfs nodev /sys/kernel/debug" as root first.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ed3aada1bf34c5a9e98af167f125f8a740fc726a
CVE-2010-4352: D-BUS: Stack overflow by validating message with excessive number of nested variants
Component: D-BUS
Severity: Moderate
Public date: 2010-12-11T00:00:00+00:00

Stack consumption vulnerability in D-Bus (aka DBus) before 1.4.1 allows local users to cause a denial of service (daemon crash) via a message containing many nested variants.


Affected upstream versions: n/a
Fixed upstream versions: dbus-1.4.1
Upstream repository: https://cgit.freedesktop.org/dbus/dbus
Upstream fix commit: 7d65a3a6ed8815e34a99c680ac3869fde49dbbd4
CVE-2010-4410: perl-CGI-Simple: - hardcoded MIME boundary value for multipart content, CVE-2010-4410 - CRLF injection allowing HTTP response splitting
Component: perl-CGI-Simple
Severity: Moderate
Public date: 2010-11-10T00:00:00+00:00

CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.


Affected upstream versions: n/a
Upstream repository: https://perl5.git.perl.org/perl.git
Upstream fix commit: 84601d63a7e34958da47dad1e61e27cb3bd467d1
CVE-2010-4526: kernel: sctp: a race between ICMP protocol unreachable and connect()
Component: kernel
Severity: Important
CWE: CWE-413 (Improper Resource Locking)
Public date: 2010-05-06T00:00:00+00:00

Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 4 did not include
upstream commit history:5aabd1fe268e850c2e93048a5ccc5eb6970ac49c, and therefore
is not affected by this issue. This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via http://rhn.redhat.com/errata/RHSA-2011-0163.html, https://rhn.redhat.com/errata/RHSA-2011-0421.html and https://rhn.redhat.com/errata/RHSA-2011-1253.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.34
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 50b5d6ad63821cea324a5a7a19854d4de1a0a819