Bug 13957 - grub2 new security issue CVE-2014-4607
Summary: grub2 new security issue CVE-2014-4607
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/604237/
Whiteboard: MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32...
Keywords: validated_update
Depends on:
Blocks: 13943
  Show dependency tree / graph
 
Reported: 2014-08-20 20:36 CEST by David Walser
Modified: 2014-08-27 01:05 CEST (History)
3 users (show)

See Also:
Source RPM: grub2-2.00-59.mga4.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2014-08-20 20:36:07 CEST 
grub2 bundles minilzo, which is affected by the CVE-2014-4607 issue from the LZO library.

Patched packages uploaded for Mageia 3, Mageia 4, and Cauldron.

Advisory:
========================

Updated grub2 packages fix security vulnerability:

An integer overflow in liblzo before 2.07 allows attackers to cause a denial
of service or possibly code execution in applications using performing LZO
decompression on a compressed payload from the attacker (CVE-2014-4607).

The grub2 package is built with a bundled copy of minilzo, which is a
part of liblzo containing the vulnerable code.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4607
http://advisories.mageia.org/MGASA-2014-0290.html
========================

Updated packages in core/updates_testing:
========================
grub2-2.00-46.3.mga3
grub2-efi-2.00-46.3.mga3
grub2-mageia-theme-2.00-46.3.mga3
grub2-2.00-59.1.mga4
grub2-efi-2.00-59.1.mga4
grub2-mageia-theme-2.00-59.1.mga4

from SRPMS:
grub2-2.00-46.3.mga3.src.rpm
grub2-2.00-59.1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
David Walser 2014-08-20 20:36:21 CEST

Blocks: (none) => 13943
Whiteboard: (none) => MGA3TOO

Comment 1 William Kenney 2014-08-22 17:24:38 CEST 
In VirtualBox, M3, KDE, 32-bit

Package(s) under test:
grub2 grub2-mageia-theme

default install of grub2

[root@localhost wilcal]# urpmi grub2
Package grub2-2.00-46.2.mga3.i586 is already installed
[root@localhost wilcal]# uname -a
Linux localhost 3.10.50-desktop-1.mga3 #1 SMP Sun Jul 27 19:36:34 UTC 2014 i686 i686 i686 GNU/Linux

System books to a working desktop

install grub2 from updates_testing

System rebooks to a working desktop

[root@localhost wilcal]# urpmi grub2
Package grub2-2.00-46.3.mga3.i586 is already installed
[root@localhost wilcal]# urpmi grub2-mageia-theme
Package grub2-mageia-theme-2.00-46.3.mga3.i586 is already installed
[root@localhost wilcal]# uname -a
Linux localhost 3.10.50-desktop-1.mga3 #1 SMP Sun Jul 27 19:36:34 UTC 2014 i686 i686 i686 GNU/Linux

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64

CC: (none) => wilcal.int

Comment 2 William Kenney 2014-08-22 17:24:54 CEST 
In VirtualBox, M3, KDE, 64-bit

Package(s) under test:
grub2 grub2-mageia-theme

default install of grub2

[root@localhost wilcal]# urpmi grub2
Package grub2-2.00-46.2.mga3.x86_64 is already installed
[root@localhost wilcal]# uname -a
Linux localhost 3.10.50-desktop-1.mga3 #1 SMP Sun Jul 27 19:10:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

System books to a working desktop

install grub2 from updates_testing

System rebooks to a working desktop

[root@localhost wilcal]# urpmi grub2
Package grub2-2.00-46.3.mga3.x86_64 is already installed
[root@localhost wilcal]# urpmi grub2-mageia-theme
Package grub2-mageia-theme-2.00-46.3.mga3.x86_64 is already installed
[root@localhost wilcal]# uname -a
Linux localhost 3.10.50-desktop-1.mga3 #1 SMP Sun Jul 27 19:10:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64
Comment 3 William Kenney 2014-08-22 17:25:08 CEST 
In VirtualBox, M4, KDE, 32-bit

Package(s) under test:
grub2 grub2-mageia-theme

default install of grub2

[root@localhost wilcal]# urpmi grub2
Package grub2-2.00-59.mga4.i586 is already installed
[root@localhost wilcal]# uname -a
Linux localhost 3.12.25-desktop-3.mga4 #1 SMP Mon Jul 28 00:00:03 UTC 2014 i686 i686 i686 GNU/Linux

System books to a working desktop

install grub2 from updates_testing

System rebooks to a working desktop

[root@localhost wilcal]# urpmi grub2
Package grub2-2.00-59.1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi grub2-mageia-theme
Package grub2-mageia-theme-2.00-59.1.mga4.noarch is already installed
[root@localhost wilcal]# uname -a
Linux localhost 3.12.25-desktop-3.mga4 #1 SMP Mon Jul 28 00:00:03 UTC 2014 i686 i686 i686 GNU/Linux

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64
Comment 4 William Kenney 2014-08-22 17:25:24 CEST 
In VirtualBox, M4, KDE, 64-bit

Package(s) under test:
grub2 grub2-mageia-theme

default install of grub2

[root@localhost wilcal]# urpmi grub2
Package grub2-2.00-59.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi grub2-mageia-theme
Package grub2-mageia-theme-2.00-59.mga4.noarch is already installed
[root@localhost wilcal]# uname -a
Linux localhost 3.12.25-desktop-3.mga4 #1 SMP Sun Jul 27 23:33:54 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

System books to a working desktop

install grub2 from updates_testing

System rebooks to a working desktop

[root@localhost wilcal]# urpmi grub2
Package grub2-2.00-59.1.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi grub2-mageia-theme
Package grub2-mageia-theme-2.00-59.1.mga4.noarch is already installed
[root@localhost wilcal]# uname -a
Linux localhost 3.12.25-desktop-3.mga4 #1 SMP Sun Jul 27 23:33:54 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64
Comment 5 William Kenney 2014-08-22 17:27:06 CEST 
For me this update works fine.
Testing complete for mga3 32-bit & 64-bit
Testing complete for mga4 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push this to updates.
Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO => MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK
CC: (none) => sysadmin-bugs

Comment 6 Dave Hodgins 2014-08-26 10:05:45 CEST 
Advisory 13957.adv added to svn

CC: (none) => davidwhodgins
Whiteboard: MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK => MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory

Comment 7 Mageia Robot 2014-08-27 01:05:48 CEST 
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0358.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.