Advisories ยป MGASA-2015-0070

Updated kernel packages fix security vulnerabilities

Publication date: 17 Feb 2015
Modification date: 17 Feb 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-8989 , CVE-2014-9428 , CVE-2014-9529 , CVE-2014-9584 , CVE-2014-9585 , CVE-2013-7421 , CVE-2014-9644 , CVE-2015-1421 , CVE-2015-1465

Description

This kernel update is based on upstream -longterm 3.14.32 and fixes the 
following security issues:

The Linux kernel through 3.17.4 does not properly restrict dropping of
supplemental group memberships in certain namespace scenarios, which allows
local users to bypass intended file permissions by leveraging a POSIX ACL
containing an entry for the group category that is more restrictive than
the entry for the other category, aka a "negative groups" issue, related to
kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).

The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in
the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an
incorrect length field during a calculation of an amount of memory, which
allows remote attackers to cause a denial of service (mesh-node system crash)
via fragmented packets (CVE-2014-9428).

Race condition in the key_gc_unused_keys function in security/keys/gc.c
in the Linux kernel through 3.18.2 allows local users to cause a denial
of service (memory corruption or panic) or possibly have unspecified other
impact via keyctl commands that trigger access to a key structure member
during garbage collection of a key (CVE-2014-9529).

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux
kernel before 3.18.2 does not validate a length value in the Extensions
Reference (ER) System Use Field, which allows local users to obtain sensitive
information from kernel memory via a crafted iso9660 image (CVE-2014-9584).

The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through
3.18.2 does not properly choose memory locations for the vDSO area, which
makes it easier for local users to bypass the ASLR protection mechanism by
guessing a location at the end of a PMD (CVE-2014-9585).

Linux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API
that allows any local user to load any installed kernel module on systems
where CONFIG_CRYPTO_USER_API=y by abusing the request_module() call
(CVE-2013-7421, CVE-2014-9644).

When hitting an sctp INIT collision case during the 4WHS with AUTH enabled,
it can create a local denial of service by triggerinf a panic on server side
(CVE-2015-1421).

It was found that routing packets to too many different dsts/too fast can
lead to a excessive resource consumption. A remote attacker can use this
flaw to crash the system (CVE-2015-1465).

For other fixes in this update, see the referenced changelogs.

References

SRPMS

4/nonfree

4/core