Advisories ยป MGASA-2014-0103

Updated kernel fixes security vulnerabilities

Publication date: 26 Feb 2014
Modification date: 17 Feb 2022
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-0069 , CVE-2014-2038

Description

This kernel update provides an update to the upstream stable 3.12.13
maintenance release and fixes the following security issues:

A flaw was found in the way cifs handled iovecs with bogus pointers
userland passed down via writev() during uncached writes.
An unprivileged local user with access to cifs share could use this flaw
to crash the system or leak kernel memory. Privilege escalation cannot
be ruled out (since memory corruption is involved), but is unlikely.
(CVE-2014-0069)

Linux kernel build with the NFS file system(CONFIG_NFS_FS) along with the
support for NFSv4 protocol(CONFIG_NFS_V4) is vulnerable to an information
leakage flaw. It could occur while writing to a file wherein NFS server
has offered write delegation to the client. Such delegation allows NFS
client to perform the said operation locally without instant interaction
with the server.
A user/program could use this flaw to at least leak kernel memory bytes.
(CVE-2014-2038)

This update also enables MEMCG on server kernels (mga#12629)

For other changes, see the referenced changelogs.

References

SRPMS

4/core

4/nonfree