linux-kernel - Linux 2.6.21.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 8 Jun 2007 00:02:48 -0700
From:	Chris Wright <chrisw@...s-sol.org>
To:	linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	torvalds@...ux-foundation.org, stable@...nel.org
Subject: Linux 2.6.21.4

We (the -stable team) are announcing the release of the 2.6.21.4 kernel.
This release has three security fixes in it:
 
374f167d: random: fix error in entropy extraction (CVE-2007-2453 1 of 2)
7bd369b1: random: fix seeding with zero entropy (CVE-2007-2453 2 of 2)
c23e7e4c: cpuset: prevent information leak in cpuset_tasks_read (CVE-2007-2875)
8c640bd0: NETFILTER: {ip, nf}_conntrack_sctp: fix remotely triggerable NULL ptr dereference (CVE-2007-2876)

The /dev/[u]random fix is especially important for machines with no
entropy source (e.g. keyboard, mice, or disk drives) and no realtime clock
since successive boots could generate same output from RNG.  The cpuset
bug is a possible information leak when reading from /dev/cpuset/tasks
(assuming cpusets support is compiled in and the cpuset fs mounted
on /dev/cpuset).  The SCTP bug is remotely triggerable when using SCTP
conntrack.


I'll also be replying to this message with a copy of the patch between
2.6.21.3 and 2.6.21.4

The updated 2.6.21.y git tree can be found at:
        git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.21.y.git
and can be browsed at the normal kernel.org git web browser:
        http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.21.y.git;a=summary

thanks,
-chris

---------

 Makefile                                     |    2 
 drivers/char/random.c                        |   67 +++++++++++++++------------
 kernel/cpuset.c                              |    7 --
 net/ipv4/netfilter/ip_conntrack_proto_sctp.c |    3 -
 net/netfilter/nf_conntrack_proto_sctp.c      |    3 -
 5 files changed, 44 insertions(+), 38 deletions(-)

Summary of changes from v2.6.21.3 to v2.6.21.4
==============================================

Chris Wright (2):
      cpuset: prevent information leak in cpuset_tasks_read (CVE-2007-2875)
      Linux 2.6.21.4

Matt Mackall (2):
      random: fix error in entropy extraction (CVE-2007-2453 1 of 2)
      random: fix seeding with zero entropy (CVE-2007-2453 2 of 2)

Patrick McHardy (1):
      NETFILTER: {ip, nf}_conntrack_sctp: fix remotely triggerable NULL ptr dereference (CVE-2007-2876)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/