MGASA-2014-0103

Dashboard / Vulnerabilities / MGASA-2014-0103

MGASA-2014-0103

Summary: Updated kernel fixes security vulnerabilities

Details: This kernel update provides an update to the upstream stable 3.12.13 maintenance release and fixes the following security issues: A flaw was found in the way cifs handled iovecs with bogus pointers userland passed down via writev() during uncached writes. An unprivileged local user with access to cifs share could use this flaw to crash the system or leak kernel memory. Privilege escalation cannot be ruled out (since memory corruption is involved), but is unlikely. (CVE-2014-0069) Linux kernel build with the NFS file system(CONFIG_NFS_FS) along with the support for NFSv4 protocol(CONFIG_NFS_V4) is vulnerable to an information leakage flaw. It could occur while writing to a file wherein NFS server has offered write delegation to the client. Such delegation allows NFS client to perform the said operation locally without instant interaction with the server. A user/program could use this flaw to at least leak kernel memory bytes. (CVE-2014-2038) This update also enables MEMCG on server kernels (mga#12629) For other changes, see the referenced changelogs.

References: https://advisories.mageia.org/MGASA-2014-0103.html, https://bugs.mageia.org/show_bug.cgi?id=12629, https://bugs.mageia.org/show_bug.cgi?id=12850, https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.10, https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.11, https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.12, https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.13