MGASA-2015-0171
- Source
- https://advisories.mageia.org/MGASA-2015-0171.html
- Import Source
- https://advisories.mageia.org/MGASA-2015-0171.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2015-0171
- Related
- Published
- 2015-04-30T21:57:25Z
- Modified
- 2015-04-30T22:37:55Z
- Summary
- Updated kernel package fixes security vulnerabilities
- Details
-
This kernel update is based on upstream -longterm 3.14.39 and fixes the following security issues:
It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system (CVE-2014-8159)
The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomizestacktop function in fs/binfmtelf.c and the stackmaxrandom_size function in arch/x86/mm/mmap.c (CVE-2015-1593)
Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (CVE-2015-2150)
Sasha Levin discovered that the LLC subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this possibly allows privilege escalation from a process with CAPNETADMIN capability; it also results in a trivial information leak (CVE-2015-2041).
Sasha Levin discovered that the RDS subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this results in a trivial information leak (CVE-2015-2042).
Andrew Lutomirski discovered that when a 64-bit task on an amd64 kernel makes a fork(2) or clone(2) system call using int $0x80, the 32-bit compatibility flag is set (correctly) but is not cleared on return. As a result, both seccomp and audit will misinterpret the following system call by the task(s), possibly leading to a violation of security policy (CVE-2015-2830).
Stephan Mueller discovered that the optimised implementation of RFC4106 GCM for x86 processors that support AESNI miscalculated buffer addresses in some cases. If an IPsec tunnel is configured to use this mode (also known as AES-GCM-ESP) this can lead to memory corruption and crashes (even without malicious traffic). This could potentially also result in remote code execution (CVE-2015-3331).
Ben Hutchings discovered that the TCP Fast Open feature regressed in Linux 3.16.7-ckt9, resulting in a kernel BUG when it is used. This can be used as a local denial of service (CVE-2015-3332)
For other fixes in this update, see the referenced changelogs.
- References
-
- https://advisories.mageia.org/MGASA-2015-0171.html
- https://bugs.mageia.org/show_bug.cgi?id=15612
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.33
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.34
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.35
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.36
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.37
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.38
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.39
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:4 / kernel
Package
- Name
- kernel
- Purl
- pkg:rpm/mageia/kernel?distro=mageia-4
Mageia:4 / kernel-userspace-headers
Package
- Name
- kernel-userspace-headers
- Purl
- pkg:rpm/mageia/kernel-userspace-headers?distro=mageia-4
Mageia:4 / kmod-vboxadditions
Package
- Name
- kmod-vboxadditions
- Purl
- pkg:rpm/mageia/kmod-vboxadditions?distro=mageia-4
Mageia:4 / kmod-virtualbox
Package
- Name
- kmod-virtualbox
- Purl
- pkg:rpm/mageia/kmod-virtualbox?distro=mageia-4
Mageia:4 / kmod-xtables-addons
Package
- Name
- kmod-xtables-addons
- Purl
- pkg:rpm/mageia/kmod-xtables-addons?distro=mageia-4
Mageia:4 / kmod-broadcom-wl
Package
- Name
- kmod-broadcom-wl
- Purl
- pkg:rpm/mageia/kmod-broadcom-wl?distro=mageia-4
Mageia:4 / kmod-fglrx
Package
- Name
- kmod-fglrx
- Purl
- pkg:rpm/mageia/kmod-fglrx?distro=mageia-4
Mageia:4 / kmod-nvidia173
Package
- Name
- kmod-nvidia173
- Purl
- pkg:rpm/mageia/kmod-nvidia173?distro=mageia-4
Mageia:4 / kmod-nvidia304
Package
- Name
- kmod-nvidia304
- Purl
- pkg:rpm/mageia/kmod-nvidia304?distro=mageia-4
Mageia:4 / kmod-nvidia-current
Package
- Name
- kmod-nvidia-current
- Purl
- pkg:rpm/mageia/kmod-nvidia-current?distro=mageia-4