Date: Thu, 07 Aug 2014 12:16:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2014:155 ] kernel

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:155
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : kernel
 Date    : August 7, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in the Linux
 kernel:
 
 Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c
 in the Linux kernel before 3.12 allow local users to cause a
 denial of service or possibly have unspecified other impact
 by leveraging the CAP_NET_ADMIN capability and providing a long
 station-name string, related to the (1) wvlan_uil_put_info and (2)
 wvlan_set_station_nickname functions (CVE-2013-4514).
 
 Use-after-free vulnerability in the skb_segment function in
 net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers
 to obtain sensitive information from kernel memory by leveraging the
 absence of a certain orphaning operation (CVE-2014-0131).
 
 The rd_build_device_space function in drivers/target/target_core_rd.c
 in the Linux kernel before 3.14 does not properly initialize a
 certain data structure, which allows local users to obtain sensitive
 information from ramdisk_mcp memory by leveraging access to a SCSI
 initiator (CVE-2014-4027).
 
 Multiple integer overflows in the lzo1x_decompress_safe function in
 lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux
 kernel before 3.15.2 allow context-dependent attackers to cause
 a denial of service (memory corruption) via a crafted Literal Run
 (CVE-2014-4608).
 
 Race condition in the tlv handler functionality in the
 snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA
 control implementation in the Linux kernel before 3.15.2 allows local
 users to obtain sensitive information from kernel memory by leveraging
 /dev/snd/controlCX access (CVE-2014-4652).
 
 sound/core/control.c in the ALSA control implementation in the Linux
 kernel before 3.15.2 does not ensure possession of a read/write lock,
 which allows local users to cause a denial of service (use-after-free)
 and obtain sensitive information from kernel memory by leveraging
 /dev/snd/controlCX access (CVE-2014-4653).
 
 The snd_ctl_elem_add function in sound/core/control.c in the ALSA
 control implementation in the Linux kernel before 3.15.2 does not check
 authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows
 local users to remove kernel controls and cause a denial of service
 (use-after-free and system crash) by leveraging /dev/snd/controlCX
 access for an ioctl call (CVE-2014-4654).
 
 The snd_ctl_elem_add function in sound/core/control.c in the ALSA
 control implementation in the Linux kernel before 3.15.2 does not
 properly maintain the user_ctl_count value, which allows local users
 to cause a denial of service (integer overflow and limit bypass)
 by leveraging /dev/snd/controlCX access for a large number of
 SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls (CVE-2014-4655).
 
 Multiple integer overflows in sound/core/control.c in the ALSA control
 implementation in the Linux kernel before 3.15.2 allow local users
 to cause a denial of service by leveraging /dev/snd/controlCX access,
 related to (1) index values in the snd_ctl_add function and (2) numid
 values in the snd_ctl_remove_numid_conflict function (CVE-2014-4656).
 
 The sctp_association_free function in net/sctp/associola.c in the
 Linux kernel before 3.15.2 does not properly manage a certain backlog
 value, which allows remote attackers to cause a denial of service
 (socket outage) via a crafted SCTP packet (CVE-2014-4667).
 
 The Linux kernel before 3.15.4 on Intel processors does not properly
 restrict use of a non-canonical value for the saved RIP address in
 the case of a system call that does not use IRET, which allows local
 users to leverage a race condition and gain privileges, or cause
 a denial of service (double fault), via a crafted application that
 makes ptrace and fork system calls (CVE-2014-4699).
 
 The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel
 through 3.15.6 allows local users to gain privileges by leveraging
 data-structure differences between an l2tp socket and an inet socket
 (CVE-2014-4943).
 
 The updated packages provides a solution for these security issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4514
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0131
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4027
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4608
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4652
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4653
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4654
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4655
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4656
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4699
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4943
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 c2f39cb08d096b60bc8bbd2ae8f11e19  mbs1/x86_64/cpupower-3.4.100-1.1.mbs1.x86_64.rpm
 3db9df4dbdd04f72ef30734bbb001322  mbs1/x86_64/kernel-firmware-3.4.100-1.1.mbs1.noarch.rpm
 c4abbe488cd50058ee544f6c39c8ea95  mbs1/x86_64/kernel-headers-3.4.100-1.1.mbs1.x86_64.rpm
 aee7594e36d538798a7d0ac4f0ba4c47  mbs1/x86_64/kernel-server-3.4.100-1.1.mbs1.x86_64.rpm
 a2cfe35a3117b2cfe3de75589612b540  mbs1/x86_64/kernel-server-devel-3.4.100-1.1.mbs1.x86_64.rpm
 75fffbe82cefb6e8cfdc502c8dfdbd9a  mbs1/x86_64/lib64cpupower0-3.4.100-1.1.mbs1.x86_64.rpm
 fe94d08a35090e84cec11a1d03cd38d8  mbs1/x86_64/lib64cpupower-devel-3.4.100-1.1.mbs1.x86_64.rpm
 0a9dab31e19cf4740e0f10dd58ae031c  mbs1/x86_64/perf-3.4.100-1.1.mbs1.x86_64.rpm 
 f34e4ceff2962eb6e7177043e4b0fd2f  mbs1/SRPMS/cpupower-3.4.100-1.1.mbs1.src.rpm
 9ee8ebf3071324459be1970d8dc3c3e0  mbs1/SRPMS/kernel-firmware-3.4.100-1.1.mbs1.src.rpm
 faefe75b8ba9efdc50f8028700991a7c  mbs1/SRPMS/kernel-headers-3.4.100-1.1.mbs1.src.rpm
 845229627d2cb959547db1cbfe81753f  mbs1/SRPMS/kernel-server-3.4.100-1.1.mbs1.src.rpm
 30b1055810489c6b4e89623c7768e182  mbs1/SRPMS/perf-3.4.100-1.1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFT4yfXmqjQ0CJFipgRAuk5AKDbuUKogDrhb4iKIs1yOP4IQdpAcwCgodf8
OMQTfJFCDxSAMSI8iUevOkc=
=mxBf
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists