Bug 16654 - Update request: kernel-linus-4.1.8-1.mga5
Summary: Update request: kernel-linus-4.1.8-1.mga5
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: advisory mga5-64-ok mga5-32-ok
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-08-26 21:57 CEST by Thomas Backlund
Modified: 2015-10-09 20:48 CEST (History)
4 users (show)

See Also:
Source RPM: kernel-linus-4.1.8-1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description Thomas Backlund 2015-08-26 21:57:24 CEST
Lets start the 4.1 LTSI update tests... advisory will follow... rpms to test:

Note that for testing you need to enable nonfree testing too at the same time (if you use nonfree drivers or firmwares that is) as the kernel conflicts older versions to ensure we get the latest drivers/firmwares in initrd and so on...


SRPMS:
kernel-linus-4.1.6-1.mga5.src.rpm

i586:
kernel-linus-4.1.6-1.mga5-1-1.mga5.i586.rpm
kernel-linus-devel-4.1.6-1.mga5-1-1.mga5.i586.rpm
kernel-linus-devel-latest-4.1.6-1.mga5.i586.rpm
kernel-linus-doc-4.1.6-1.mga5.noarch.rpm
kernel-linus-latest-4.1.6-1.mga5.i586.rpm
kernel-linus-source-4.1.6-1.mga5-1-1.mga5.noarch.rpm
kernel-linus-source-latest-4.1.6-1.mga5.noarch.rpm

x86_64:
kernel-linus-4.1.6-1.mga5-1-1.mga5.x86_64.rpm
kernel-linus-devel-4.1.6-1.mga5-1-1.mga5.x86_64.rpm
kernel-linus-devel-latest-4.1.6-1.mga5.x86_64.rpm
kernel-linus-doc-4.1.6-1.mga5.noarch.rpm
kernel-linus-latest-4.1.6-1.mga5.x86_64.rpm
kernel-linus-source-4.1.6-1.mga5-1-1.mga5.noarch.rpm
kernel-linus-source-latest-4.1.6-1.mga5.noarch.rpm


Reproducible: 

Steps to Reproduce:
Comment 1 Thomas Backlund 2015-09-13 12:47:58 CEST
Taking  this back, has some regressions 4.1.7 will fix.

Whiteboard: (none) => feedback
Assignee: qa-bugs => tmb

Comment 2 Thomas Backlund 2015-09-17 18:16:27 CEST
Lets try again... advisory will follow later...


SRPMS:
kernel-linus-4.1.7-1.mga5.src.rpm

i586:
kernel-linus-4.1.7-1.mga5-1-1.mga5.i586.rpm
kernel-linus-devel-4.1.7-1.mga5-1-1.mga5.i586.rpm
kernel-linus-devel-latest-4.1.7-1.mga5.i586.rpm
kernel-linus-doc-4.1.7-1.mga5.noarch.rpm
kernel-linus-latest-4.1.7-1.mga5.i586.rpm
kernel-linus-source-4.1.7-1.mga5-1-1.mga5.noarch.rpm
kernel-linus-source-latest-4.1.7-1.mga5.noarch.rpm

x86_64:
kernel-linus-4.1.7-1.mga5-1-1.mga5.x86_64.rpm
kernel-linus-devel-4.1.7-1.mga5-1-1.mga5.x86_64.rpm
kernel-linus-devel-latest-4.1.7-1.mga5.x86_64.rpm
kernel-linus-doc-4.1.7-1.mga5.noarch.rpm
kernel-linus-latest-4.1.7-1.mga5.x86_64.rpm
kernel-linus-source-4.1.7-1.mga5-1-1.mga5.noarch.rpm
kernel-linus-source-latest-4.1.7-1.mga5.noarch.rpm

Assignee: tmb => qa-bugs
Whiteboard: feedback => (none)
Summary: Update request: kernel-linus-4.1.6-1.mga5 => Update request: kernel-linus-4.1.7-1.mga5
Source RPM: kernel-linus-4.1.6-1.mga5.src.rpm => kernel-linus-4.1.7-1.mga5.src.rpm

Comment 3 William Kenney 2015-09-18 17:36:40 CEST
In VirtualBox, M5, KDE, 32-bit

Package(s) under test:
kernel-linus-latest

default install of kernel-linus-latest

[root@localhost wilcal]# uname -a
Linux localhost 3.19.8-desktop586-3.mga5 #1 SMP Sat Jun 13 17:22:19 UTC 2015 i686 i686 i686 GNU/Linux
[root@localhost wilcal]# urpmi kernel-linus-latest
Package kernel-linus-latest-3.19.8-2.mga5.i586 is already installed

System boots to a working desktop. Common apps work. Screen dimensions are correct.

install kernel-linus-latest from updates_testing

[root@localhost wilcal]# uname -a
Linux localhost 4.1.7-1.mga5 #1 SMP Wed Sep 16 19:36:35 UTC 2015 i686 i686 i686 GNU/Linux
[root@localhost wilcal]# urpmi kernel-linus-latest
Package kernel-linus-latest-4.1.7-1.mga5.i586 is already installed

System boots to a working desktop. Common apps work. Screen dimensions can be set to 1920x1080.

CC: (none) => wilcal.int

Comment 4 William Kenney 2015-09-18 22:30:53 CEST
In VirtualBox, M5, KDE, 64-bit

Package(s) under test:
kernel-linus-latest

default install of kernel-linus-latest

root@localhost wilcal]# uname -a
Linux localhost 3.19.8-desktop-3.mga5 #1 SMP Sat Jun 13 17:05:48 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-linus-latest
Package kernel-linus-latest-3.19.8-2.mga5.x86_64 is already installed

System boots to a working desktop. Common apps work. Screen dimensions are correct.

install kernel-linus-latest from updates_testing

[root@localhost wilcal]# uname -a
Linux localhost 4.1.7-1.mga5 #1 SMP Wed Sep 16 19:55:11 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-linus-latest
Package kernel-linus-latest-4.1.7-1.mga5.x86_64 is already installed

System boots to a working desktop. Common apps work. Screen dimensions can be set to 1920x1080.
Comment 5 Thomas Backlund 2015-09-20 17:58:09 CEST
Switched to 4.1.8 to match core kernel:

SRPMS:
kernel-linus-4.1.8-1.mga5.src.rpm

i586:
kernel-linus-4.1.8-1.mga5-1-1.mga5.i586.rpm
kernel-linus-devel-4.1.8-1.mga5-1-1.mga5.i586.rpm
kernel-linus-devel-latest-4.1.8-1.mga5.i586.rpm
kernel-linus-doc-4.1.8-1.mga5.noarch.rpm
kernel-linus-latest-4.1.8-1.mga5.i586.rpm
kernel-linus-source-4.1.8-1.mga5-1-1.mga5.noarch.rpm
kernel-linus-source-latest-4.1.8-1.mga5.noarch.rpm

x86_64:
kernel-linus-4.1.8-1.mga5-1-1.mga5.x86_64.rpm
kernel-linus-devel-4.1.8-1.mga5-1-1.mga5.x86_64.rpm
kernel-linus-devel-latest-4.1.8-1.mga5.x86_64.rpm
kernel-linus-doc-4.1.8-1.mga5.noarch.rpm
kernel-linus-latest-4.1.8-1.mga5.x86_64.rpm
kernel-linus-source-4.1.8-1.mga5-1-1.mga5.noarch.rpm
kernel-linus-source-latest-4.1.8-1.mga5.noarch.rpm

Source RPM: kernel-linus-4.1.7-1.mga5.src.rpm => kernel-linus-4.1.8-1.mga5.src.rpm
Summary: Update request: kernel-linus-4.1.7-1.mga5 => Update request: kernel-linus-4.1.8-1.mga5

Comment 6 Len Lawrence 2015-09-20 23:50:28 CEST
Testing on mga5 x86_64 - Mate - ext4 - UEFI  
nvidia GTX 770 with 346.82 driver, 3K Iiyama monitor on DVI
Gigabyte Z97 motherboard

Installed the default linus kernel then enabled updates testing and non-free updates testing.  MageiaUpdate as root.

- kernel-linus-4.1.8-1.mga5-1-1.mga5.x86_64
- kernel-linus-latest-4.1.8-1.mga5.x86_64
- kernel-userspace-headers-4.1.8-1.mga5.x86_64

Had to install these individually, presumably because the defaults had not been installed already:

- kernel-linus-devel-4.1.8-1.mga5-1-1.mga5.x86_64
- kernel-linus-devel-latest-4.1.8-1.mga5.x86_64
- kernel-linus-source-4.1.8-1.mga5-1-1.mga5.noarch
- kernel-linus-source-latest-4.1.8-1.mga5.noarch

Rebooted smoothly, panel as was.

uname -r => "4.1.8-1.mga5"

Sound worked via USB bluetooth.  Freeview TV played fine in vlc via USB DVB-T2 adapter.  LAN OK on Atheros Killer E220x Gigabit ethernet.  First impressions are that general desktop applications all work.

Letting it run for 24 hours.

CC: (none) => tarazed25

Comment 7 Len Lawrence 2015-09-21 21:03:51 CEST
3.19.8-desktop-3.mga5 - ext4 - CSM boot
Intel Core2 Duo - 2.5 GHz
GeForce 8700M GT - nvidia 340.76 - 1600x1200 monitor
PRO/Wireless 3945ABG [Golan] PCI Express card
Sound: 82801H (ICH8)
 
Installed:
  kernel-linus-3.19.8-2.mga5     1            1.mga5        x86_64  
  kernel-linus-latest            3.19.8       2.mga5        x86_64  
  kernel-linus-devel-latest
  kernel-linus-devel-3.19.8-2.mga5
Rebooted
Installed the following:
- cpupower-4.1.8-1.mga5.x86_64
- dkms-nvidia340-340.76-2.mga5.nonfree.x86_64
- iproute2-4.1.1-1.mga5.x86_64
- kernel-firmware-20150722-1.mga5.noarch
- kernel-firmware-nonfree-20150824-1.mga5.nonfree.noarch
- kernel-linus-4.1.8-1.mga5-1-1.mga5.x86_64
- kernel-linus-devel-4.1.8-1.mga5-1-1.mga5.x86_64
- kernel-linus-devel-latest-4.1.8-1.mga5.x86_64
- kernel-linus-latest-4.1.8-1.mga5.x86_64
- radeon-firmware-20150824-1.mga5.nonfree.noarch
Clean reboot
LAN inter-communication working
Normal updates ran fine
Tested reboot because heretofore restart from login screen always hung and needed a power cycle.  This time it worked properly.
Sound and video working.
Comment 8 Thomas Backlund 2015-09-25 22:50:08 CEST
Advisory:

Updated kernel-linus packages provides 4.1 longterm and fixes security issues

This update provides an upgrade to the upstream 4.1 longterm kernel
series, currently based on 4.1.8 and resolves atleast the following
security issues:

It was found that the Linux kernel's keyring implementation would leak
memory when adding a key to a keyring via the add_key() function. A
local attacker could use this flaw to exhaust all available memory on
the system. (CVE-2015-1333)

A flaw was found in the Linux kernel where the deletion of a file or
directory could trigger an unmount and reveal data under a mount point.
This flaw was inadvertently introduced with the new feature of being able
to lazily unmount a mount tree when using file system user namespaces. 
(CVE-2015-4176)

A flaw was discovered in the kernel's collect_mounts function. If the kernel
audit subsystem called collect_mounts to audit an unmounted path, it could
panic the system. With this flaw, an unprivileged user could call umount
(MNT_DETACH) to launch a denial-of-service attack. (CVE-2015-4177)

A flaw was found in the Linux kernel which is related to the user namespace
lazily unmounting file systems. The fs_pin struct has two members (m_list
and s_list) which are usually initialized on use in the pin_insert_group
function. However, these members might go unmodified; in this case, the
system panics when it attempts to destroy or free them. This flaw could be
used to launch a denial-of-service attack. (CVE-2015-4178)

A DoS flaw was found for a Linux kernel built for the x86 architecture which
had the KVM virtualization support(CONFIG_KVM) enabled. The kernel would be
vulnerable to a NULL pointer dereference flaw in Linux kernel's
kvm_apic_has_events() function while doing an ioctl. An unprivileged user
able to access the "/dev/kvm" device could use this flaw to crash the system
kernel. (CVE-2015-4692)

A flaw was found in the kernel's implementation of the Berkeley Packet
Filter (BPF). A local attacker could craft BPF code to crash the system
by creating a situation in which the JIT compiler would fail to correctly
optimize the JIT image on the last pass. This would lead to the CPU
executing instructions that were not part of the JIT code. (CVE-2015-4700)

The get_bitmap_file function in drivers/md/md.c in the Linux kernel before
4.1.6 does not initialize a certain bitmap data structure, which allows
local users to obtain sensitive information from kernel memory via a
GET_BITMAP_FILE ioctl call. (CVE-2015-5697)

Use-after-free vulnerability in the path_openat function in fs/namei.c in
the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a
denial of service or possibly have unspecified other impact via O_TMPFILE
filesystem operations that leverage a duplicate cleanup operation.
(CVE-2015-5706)

It was discovered that an integer overflow error existed in the SCSIgeneric
(sg) driver in the Linux kernel. A local attacker with writepermission to a
SCSI generic device could use this to cause a denial of service (system
crash) or potentially escalate their privileges. (CVE-2015-5707)

For other changes, see the referenced changelogs:

References:
http://kernelnewbies.org/Linux_4.0
http://kernelnewbies.org/Linux_4.1
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.1
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.2
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.3
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.5
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.7
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.8
Comment 9 Thomas Backlund 2015-09-25 23:38:02 CEST
advisory added

Whiteboard: (none) => advisory

Comment 10 claire robinson 2015-10-01 15:42:27 CEST
Testing mga5 64 on nvidia-current system

dkms modules for broadcom-wl, fglrx, nvidia304, nvidia-current, vboxadditions, virtualbox & xtables-addons
Comment 11 claire robinson 2015-10-01 15:44:52 CEST
After reboot, everything is ok.

Whiteboard: advisory => advisory mga5-64-ok

Comment 12 claire robinson 2015-10-01 15:55:07 CEST
When uninstalling the kernel branch it still doesn't dkms uninstall the modules properly before removing the kernel (bug 10771) eg..

broadcom-wl, 6.30.223.248-2.1.mga5.nonfree, 4.1.8-1.mga5, x86_64: installed  (WARNING! Diff between built and installed module!)
Comment 13 Dave Hodgins 2015-10-09 02:19:19 CEST
Tested on i586 (real hardware) and x86_64 under vb.

Whiteboard: advisory mga5-64-ok => advisory mga5-64-ok mga5-32-ok
Keywords: (none) => validated_update
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 14 Mageia Robot 2015-10-09 20:48:49 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0390.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.