Advisories ยป MGASA-2015-0006

Updated kernel packages fix security vulnerabilities

Publication date: 07 Jan 2015
Modification date: 07 Jan 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-8133 , CVE-2014-8134 , CVE-2014-9090 , CVE-2014-9322 , CVE-2014-9419 , CVE-2014-9420

Description

This kernel update is based on upstream -longterm 3.14.27 and fixes the 
following security issues:

arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in
the Linux kernel through 3.18.1 allows local users to bypass the espfix
protection mechanism, and consequently makes it easier for local users to
bypass the ASLR protection mechanism, via a crafted application that makes
a set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel
through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,
which makes it easier for guest OS users to bypass the ASLR protection
mechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).

The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel
through 3.17.4 does not properly handle faults associated with the Stack
Segment (SS) segment register, which allows local users to cause a denial
of service (panic) via a modify_ldt system call, as demonstrated by
sigreturn_32 in the linux-clock-tests test suite (CVE-2014-9090).

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not
properly handle faults associated with the Stack Segment (SS) segment
register, which allows local users to gain privileges by triggering an
IRET instruction that leads to access to a GS Base address from the wrong
space (CVE-2014-9322).

On x86_64 Linux kernels a malicious user program can do a partial ASLR
bypass through TLS base addresses leak when attacking other programs
(CVE-2014-9419)

Linux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support
is vulnerable to an infinite recursion loop flaw, which could lead to a
crash or render a system unresponsive/unusable after a while. This occurs
while mounting an iso9660 image. An unprivileged user/process could use
this flaw to crash the system resulting in DoS (CVE-2014-9420).

For other fixes in this update, see the referenced changelogs.

References

SRPMS

4/core

4/nonfree