Bug 21854

Mageia release 5 (Official) for x86_64
4.4.88-desktop-1.mga5
Intel(R) Core(TM) i7-5700HQ CPU @ 2.70GHz
NVIDIA Corporation GM204M [GeForce GTX 965M] 
nvidia 384.59
Mobo: GIGABYTE model: X5
UEFI and wifi.
RAM 15.61 GB
monitor panel 2880x1620 pixels

Installed the update packages without any problems.

$ drakboot --boot

Rebooted to the Mate desktop, kmods for nvidia and virtualbox rebuilt on the way.
$ uname -r
4.4.92-tmb-desktop-1.mga5

The stress tests ran fine.  glmark2.
Ran pending updates and installed various needed media packages and ruby gems.
Common applications working.  Sound working via pulseaudio and bluetooth.
Video OK - mplayer via mplayer-ruby.  Network shares mounted.  msec working in the background.

CC: (none) => tarazed25

On real hardware, M5.1, Plasma, 64-bit

Testing: kernel-tmb-desktop-latest

[root@localhost wilcal]# uname -a
Linux localhost 4.4.92-tmb-desktop-1.mga5 #1 SMP PREEMPT Thu Oct 12 21:28:14 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-tmb-desktop-latest
Package kernel-tmb-desktop-latest-4.4.92-1.mga5.x86_64 is already installed

Boots to a working desktop. Screen resolution is correct. Common apps work.

Whiteboard: (none) => MGA5-64-OK
CC: (none) => wilcal.int

Advisory (also added to svn)


This kernel update is based on upstream 4.4.92 and fixes atleast the
following security issues:

A security flaw was discovered in nl80211_set_rekey_data() function in the
Linux kernel since v3.1-rc1 through v4.13. This function does not check
whether the required attributes are present in a netlink request. This
request can be issued by a user with CAP_NET_ADMIN privilege and may result
in NULL dereference and a system crash (CVE-2017-12153).

Linux kernel built with the KVM visualization support (CONFIG_KVM), with
nested visualization (nVMX) feature enabled (nested=1), is vulnerable to a
crash due to disabled external interrupts. As L2 guest could acce s (r/w)
hardware CR8 register of the host(L0). In a nested visualization setup,
L2 guest user could use this flaw to potentially crash the host(L0)
resulting in DoS (CVE-2017-12154).

The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before
4.12 allows local users to cause a denial of service (__tcp_select_window
divide-by-zero error and system crash) by triggering a disconnect within a
certain tcp_recvmsg code path (CVE-2017-14106).

The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the
Linux kernel through 4.12.10 does not initialize a certain data structure,
which allows local users to obtain sensitive information from kernel stack
memory by reading locations associated with padding bytes (CVE-2017-14156).

It was found that the iscsi_if_rx() function in scsi_transport_iscsi.c in
the Linux kernel since v2.6.24-rc1 through 4.13.2 allows local users to
cause a denial of service (a system panic) by making a number of certain
syscalls by leveraging incorrect length validation in the kernel code
(CVE-2017-14489).

The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4
allows local users to obtain sensitive information from uninitialized kernel
heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0
(CVE-2017-14991).

A reachable assertion failure flaw was found in the Linux kernel built with
KVM virtualisation(CONFIG_KVM) support with Virtual Function I/O feature
(CONFIG_VFIO) enabled. This failure could occur if a malicious guest device
sent a virtual interrupt (guest IRQ) with a larger (>1024) index value
(CVE-2017-1000252).

Keywords: (none) => advisory

In a Vbox client, M5.1, KDE, 32-bit

Testing: kernel-tmb-desktop-latest

[root@localhost wilcal]# uname -a
Linux localhost 4.4.92-tmb-desktop-1.mga5 #1 SMP PREEMPT Thu Oct 12 21:25:52 UTC 2017 i686 i686 i686 GNU/Linux
[root@localhost wilcal]# urpmi kernel-tmb-desktop-latest
Package kernel-tmb-desktop-latest-4.4.92-1.mga5.i586 is already installed

Boots to a working desktop. Screen resolution is correct. Common apps work.

This update works fine.
Testing complete for MGA5, 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push to updates.
Thanks

Keywords: (none) => validated_update
Whiteboard: MGA5-64-OK => MGA5-32-OK MGA5-64-OK
CC: (none) => sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2017-0388.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED