Advisories ยป MGASA-2017-0089

Updated kernel-tmb packages fixes security vulnerabilities

Publication date: 25 Mar 2017
Modification date: 17 Feb 2022
Type: security
Affected Mageia releases : 5
CVE: CVE-2017-2636 , CVE-2017-6346 , CVE-2017-6347 , CVE-2017-6348

Description

This kernel-tmb update is based on upstream 4.4.55 and fixes at least
the following security issues:

Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1
allows local users to gain privileges or cause a denial of service (double
free) by setting the HDLC line discipline (CVE-2017-2636).

Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13
allows local users to cause a denial of service (use-after-free) or possibly
have unspecified other impact via a multithreaded application that makes
PACKET_FANOUT setsockopt system calls (CVE-2017-6346).

The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux
kernel before 4.10.1 has incorrect expectations about skb data layout,
which allows local users to cause a denial of service (buffer over-read)
or possibly have unspecified other impact via crafted system calls, as
demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP
transmission (CVE-2017-6347).

The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before
4.9.13 improperly manages lock dropping, which allows local users to cause a
denial of service (deadlock) via crafted operations on IrDA devices
(CVE-2017-6348).

For other upstream fixes in this update, see the referenced changelogs.

References

SRPMS

5/core