Advisories ยป MGASA-2014-0336

Updated kernel-linus package fixes security vulnerabilities

Publication date: 18 Aug 2014
Modification date: 18 Aug 2014
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-0206 , CVE-2014-1739 , CVE-2014-3153 , CVE-2014-3917 , CVE-2014-4014 , CVE-2014-4171 , CVE-2014-4508 , CVE-2014-5045 , CVE-2014-5077

Description

Updated kernel-linus provides upstream 3.12.26 kernel and fixes the
following security issues:

Array index error in the aio_read_events_ring function in fs/aio.c in
the Linux kernel through 3.15.1 allows local users to obtain sensitive
information from kernel memory via a large head value (CVE-2014-0206).

media-device: fix infoleak in ioctl media_enum_entities()
(CVE-2014-1739)

The futex_requeue function in kernel/futex.c in the Linux kernel through
3.14.5 does not ensure that calls have two different futex addresses,
which allows local users to gain privileges via a crafted FUTEX_REQUEUE
command that facilitates unsafe waiter modification. (CVE-2014-3153)

kernel/auditsc.c in the Linux kernel through 3.14.5, when 
CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local
users to obtain potentially sensitive single-bit values from kernel memory
or cause a denial of service (OOPS) via a large value of a syscall number.
To avoid this and other issues CONFIG_AUDITSYSCALL has been disabled.
(CVE-2014-3917)

The capabilities implementation in the Linux kernel before 3.14.8 does
not properly consider that namespaces are inapplicable to inodes, which
allows local users to bypass intended chmod restrictions by first creating
a user namespace, as demonstrated by setting the setgid bit on a file with
group ownership of root (CVE-2014-4014)

mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement
the interaction between range notification and hole punching, which allows
local users to cause a denial of service (i_mutex hold) by using the mmap
system call to access a hole, as demonstrated by interfering with intended
shmem activity by blocking completion of (1) an MADV_REMOVE madvise call
or (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).

arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit
x86 platforms, when syscall auditing is enabled and the sep CPU feature
flag is set, allows local users to cause a denial of service (OOPS and
system crash) via an invalid syscall number, as demonstrated by number
1000 (CVE-2014-4508). 

A flaw was found in the way reference counting was handled in the Linux
kernels VFS subsystem when unmount on symlink was performed. An unprivileged
local user could use this flaw to cause OOM conditions leading to denial
of service or, potentially, trigger use-after-free error (CVE-2014-5045).

Linux kernel built with the support for Stream Control Transmission Protocol
(CONFIG_IP_SCTP) is vulnerable to a NULL pointer dereference flaw. It could
occur when simultaneous new connections are initiated between the same pair
of hosts. A remote user/program could use this flaw to crash the system
kernel resulting in DoS (CVE.2014-5077).

For other fixes, see the referenced changelogs.

References

SRPMS

4/core