MGASA-2017-0258
Dashboard / Vulnerabilities / MGASA-2017-0258
Summary: Updated kernel-linus packages fixes security and other bugs
Details: This kernel-linus update is based on upstream 4.9.40 and fixes at least the following security issues: Linux kernel built with the VirtIO GPU driver(CONFIG_DRM_VIRTIO_GPU) support is vulnerable to a memory leakage issue. It could occur while creating a virtio gpu object in virtio_gpu_object_create(). A user/process could use this flaw to leak host kernel memory potentially resulting in Dos (CVE-2017-10810). It also contains followup fixes to the Stack Clash (CVE-2017-1000370, CVE-2017-1000371) security issues resolved in kernels released at end of June, 2017. Other Mageia kernel specific fixes in this updates: - enable support for NFS4_1 and NFS4_2 (mga#21182) For other upstream fixes in this update, read the referenced changelogs.
References: https://advisories.mageia.org/MGASA-2017-0258.html, https://bugs.mageia.org/show_bug.cgi?id=21388, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.36, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.37, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.38, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.39, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.40
Affected packages
Package
Name: kernel-linus
Purl: pkg:rpm/mageia/kernel-linus?arch=source&distro=mageia-6
Affected ranges
Type: ECOSYSTEM
Events:
