Bug 16903 - Update request: nvidia proprietary drivers security issue
Summary: Update request: nvidia proprietary drivers security issue
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/658597/
Whiteboard: advisory MGA5-32-OK MGA5-64-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-10-04 20:11 CEST by Thomas Backlund
Modified: 2015-10-26 20:57 CET (History)
6 users (show)

See Also:
Source RPM: nvidia-current, nvidia340, nvidia304
CVE:
Status comment:


Attachments

Description Thomas Backlund 2015-10-04 20:11:49 CEST
Advisory:
A vulnerability has been found in the nvidia proprietary driver that could
be used to allow a local, non-privileged user to corrupt kernel memory.
This could be used to gain local root privileges.
A local user can issue a specially crafted IOCTL to write a 32-bit integer
value stored in the kernel driver to a user-specified memory location,
potentially in the kernel address space. The user has a limited ability
to influence the value of the integer that is written. (CVE-2015-5950)

Reference:
http://nvidia.custhelp.com/app/answers/detail/a_id/3763/~/cve-2015-5950-memory-corruption-due-to-an-unsanitized-pointer-in-the-nvidia


SRPMS:
ldetect-lst-0.1.346.1-1.mga5.src.rpm

kmod-nvidia304-304.128-1.mga5.nonfree.src.rpm
nvidia304-304.128-1.mga5.nonfree.src.rpm

kmod-nvidia340-340.93-1.mga5.nonfree.src.rpm
nvidia340-340.93-1.mga5.nonfree.src.rpm

kmod-nvidia-current-346.96-1.mga5.nonfree.src.rpm
nvidia-current-346.96-1.mga5.nonfree.src.rpm



i586:
ldetect-lst-0.1.346.1-1.mga5.i586.rpm
ldetect-lst-devel-0.1.346.1-1.mga5.i586.rpm

dkms-nvidia-current-346.96-1.mga5.nonfree.i586.rpm

nvidia304-cuda-opencl-304.128-1.mga5.nonfree.i586.rpm
nvidia304-devel-304.128-1.mga5.nonfree.i586.rpm
nvidia304-doc-html-304.128-1.mga5.nonfree.i586.rpm
nvidia304-kernel-4.1.8-desktop-1.mga5-304.128-1.mga5.nonfree.i586.rpm
nvidia304-kernel-4.1.8-desktop586-1.mga5-304.128-1.mga5.nonfree.i586.rpm
nvidia304-kernel-4.1.8-server-1.mga5-304.128-1.mga5.nonfree.i586.rpm
nvidia304-kernel-desktop586-latest-304.128-1.mga5.nonfree.i586.rpm
nvidia304-kernel-desktop-latest-304.128-1.mga5.nonfree.i586.rpm
nvidia304-kernel-server-latest-304.128-1.mga5.nonfree.i586.rpm
x11-driver-video-nvidia304-304.128-1.mga5.nonfree.i586.rpm

dkms-nvidia340-340.93-1.mga5.nonfree.i586.rpm
nvidia340-cuda-opencl-340.93-1.mga5.nonfree.i586.rpm
nvidia340-devel-340.93-1.mga5.nonfree.i586.rpm
nvidia340-doc-html-340.93-1.mga5.nonfree.i586.rpm
nvidia340-kernel-4.1.8-desktop-1.mga5-340.93-1.mga5.nonfree.i586.rpm
nvidia340-kernel-4.1.8-desktop586-1.mga5-340.93-1.mga5.nonfree.i586.rpm
nvidia340-kernel-4.1.8-server-1.mga5-340.93-1.mga5.nonfree.i586.rpm
nvidia340-kernel-desktop586-latest-340.93-1.mga5.nonfree.i586.rpm
nvidia340-kernel-desktop-latest-340.93-1.mga5.nonfree.i586.rpm
nvidia340-kernel-server-latest-340.93-1.mga5.nonfree.i586.rpm
x11-driver-video-nvidia340-340.93-1.mga5.nonfree.i586.rpm

dkms-nvidia304-304.128-1.mga5.nonfree.i586.rpm
nvidia-current-cuda-opencl-346.96-1.mga5.nonfree.i586.rpm
nvidia-current-devel-346.96-1.mga5.nonfree.i586.rpm
nvidia-current-doc-html-346.96-1.mga5.nonfree.i586.rpm
nvidia-current-kernel-4.1.8-desktop-1.mga5-346.96-1.mga5.nonfree.i586.rpm
nvidia-current-kernel-4.1.8-desktop586-1.mga5-346.96-1.mga5.nonfree.i586.rpm
nvidia-current-kernel-4.1.8-server-1.mga5-346.96-1.mga5.nonfree.i586.rpm
nvidia-current-kernel-desktop586-latest-346.96-1.mga5.nonfree.i586.rpm
nvidia-current-kernel-desktop-latest-346.96-1.mga5.nonfree.i586.rpm
nvidia-current-kernel-server-latest-346.96-1.mga5.nonfree.i586.rpm
x11-driver-video-nvidia-current-346.96-1.mga5.nonfree.i586.rpm



x86_64:
ldetect-lst-0.1.346.1-1.mga5.x86_64.rpm
ldetect-lst-devel-0.1.346.1-1.mga5.x86_64.rpm

dkms-nvidia304-304.128-1.mga5.nonfree.x86_64.rpm
nvidia304-cuda-opencl-304.128-1.mga5.nonfree.x86_64.rpm
nvidia304-devel-304.128-1.mga5.nonfree.x86_64.rpm
nvidia304-doc-html-304.128-1.mga5.nonfree.x86_64.rpm
nvidia304-kernel-4.1.8-desktop-1.mga5-304.128-1.mga5.nonfree.x86_64.rpm
nvidia304-kernel-4.1.8-server-1.mga5-304.128-1.mga5.nonfree.x86_64.rpm
nvidia304-kernel-desktop-latest-304.128-1.mga5.nonfree.x86_64.rpm
nvidia304-kernel-server-latest-304.128-1.mga5.nonfree.x86_64.rpm
x11-driver-video-nvidia304-304.128-1.mga5.nonfree.x86_64.rpm

dkms-nvidia340-340.93-1.mga5.nonfree.x86_64.rpm
nvidia340-cuda-opencl-340.93-1.mga5.nonfree.x86_64.rpm
nvidia340-devel-340.93-1.mga5.nonfree.x86_64.rpm
nvidia340-doc-html-340.93-1.mga5.nonfree.x86_64.rpm
nvidia340-kernel-4.1.8-desktop-1.mga5-340.93-1.mga5.nonfree.x86_64.rpm
nvidia340-kernel-4.1.8-server-1.mga5-340.93-1.mga5.nonfree.x86_64.rpm
nvidia340-kernel-desktop-latest-340.93-1.mga5.nonfree.x86_64.rpm
nvidia340-kernel-server-latest-340.93-1.mga5.nonfree.x86_64.rpm
x11-driver-video-nvidia340-340.93-1.mga5.nonfree.x86_64.rpm

dkms-nvidia-current-346.96-1.mga5.nonfree.x86_64.rpm
nvidia-current-cuda-opencl-346.96-1.mga5.nonfree.x86_64.rpm
nvidia-current-devel-346.96-1.mga5.nonfree.x86_64.rpm
nvidia-current-doc-html-346.96-1.mga5.nonfree.x86_64.rpm
nvidia-current-kernel-4.1.8-desktop-1.mga5-346.96-1.mga5.nonfree.x86_64.rpm
nvidia-current-kernel-4.1.8-server-1.mga5-346.96-1.mga5.nonfree.x86_64.rpm
nvidia-current-kernel-desktop-latest-346.96-1.mga5.nonfree.x86_64.rpm
nvidia-current-kernel-server-latest-346.96-1.mga5.nonfree.x86_64.rpm
x11-driver-video-nvidia-current-346.96-1.mga5.nonfree.x86_64.rpm




Reproducible: 

Steps to Reproduce:
Comment 1 William Kenney 2015-10-06 19:41:37 CEST
On real hardware, M5, KDE, 64-bit

Package(s) under test:
kernel-desktop-latest
virtualbox vboxadditions-kernel-desktop-latest dkms-virtualbox
virtualbox-guest-additions virtualbox-kernel-desktop-latest x11-driver-video-vboxvideo
nvidia-current-kernel-desktop-latest

default install of nvidia-current-kernel-desktop-latest

[root@localhost wilcal]# uname -a
Linux localhost 4.1.8-desktop-1.mga5 #1 SMP Sun Sep 20 12:39:07 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi nvidia-current-kernel-desktop-latest
Package nvidia-current-kernel-desktop-latest-346.82-3.mga5.nonfree.x86_64 is already installed
[root@localhost wilcal]# urpmi dkms-nvidia-current
Package dkms-nvidia-current-346.82-1.mga5.nonfree.x86_64 is already installed
[root@localhost wilcal]# urpmi x11-driver-video-nvidia-current
Package x11-driver-video-nvidia-current-346.82-1.mga5.nonfree.x86_64 is already installed
[root@localhost wilcal]# urpmi ldetect-lst
Package ldetect-lst-0.1.346-1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox
Package virtualbox-5.0.4-1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi x11-driver-video-vboxvideo
Package x11-driver-video-vboxvideo-5.0.4-1.mga5.x86_64 is already installed
[wilcal@localhost ~]$ lspci -k
01:00.0 VGA compatible controller: NVIDIA Corporation GF108 [GeForce GT 440] (rev a1)
        Subsystem: Gigabyte Technology Co., Ltd Device 3518
        Kernel driver in use: nvidia
        Kernel modules: nvidiafb, nouveau, nvidia_current

Boots to a working desktop. Screen sizes are correct. Vbox runs M5 i586 Live-DVD as a client.

Install nvidia-current-kernel-desktop-latest from updates_testing

[root@localhost wilcal]# uname -a
Linux localhost 4.1.8-desktop-1.mga5 #1 SMP Sun Sep 20 12:39:07 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi nvidia-current-kernel-desktop-latest
Package nvidia-current-kernel-desktop-latest-346.96-1.mga5.nonfree.x86_64 is already installed
[root@localhost wilcal]# urpmi dkms-nvidia-current
Package dkms-nvidia-current-346.96-1.mga5.nonfree.x86_64 is already installed
[root@localhost wilcal]# urpmi x11-driver-video-nvidia-current
Package x11-driver-video-nvidia-current-346.96-1.mga5.nonfree.x86_64 is already installed
[root@localhost wilcal]# urpmi ldetect-lst
Package ldetect-lst-0.1.346.1-1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox
Package virtualbox-5.0.4-1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi x11-driver-video-vboxvideo
Package x11-driver-video-vboxvideo-5.0.6-1.mga5.x86_64 is already installed
[wilcal@localhost ~]$ lspci -k
01:00.0 VGA compatible controller: NVIDIA Corporation GF108 [GeForce GT 440] (rev a1)
        Subsystem: Gigabyte Technology Co., Ltd Device 3518
        Kernel driver in use: nvidia
        Kernel modules: nvidiafb, nouveau, nvidia_current
        
Boots to a working desktop. Screen sizes are correct. Vbox runs M5 x86_64 Live-DVD as a client.
Vbox runs previously installed M5 i586 Live-DVD as a client.

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 5 64-bit, Nvidia driver
virtualbox-4.3.26-1.mga4.x86_64
virtualbox-guest-additions-4.3.26-1.mga4.x86_64

CC: (none) => wilcal.int

Comment 2 Rémi Verschelde 2015-10-06 20:09:57 CEST
Installed on Mageia 5 x86_64 optimus laptop, using nvidia-current through bumblebee, works fine so far.
Dave Hodgins 2015-10-07 00:57:45 CEST

CC: (none) => davidwhodgins
Whiteboard: (none) => advisory

Comment 3 Len Lawrence 2015-10-07 23:08:34 CEST
Mageia 5 on x86-64 real hardware, GeForce GTX 770
8 x Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Gigabyte Sniper.Z97 motherboard
Mate desktop

Updates testing:
ldetect-lst-0.1.346.1-1.mga5.x86_64
ldetect-lst-devel-0.1.346.1-1.mga5.x86_64
Non-free updates testing:
dkms-nvidia-current-346.96-1.mga5.nonfree.x86_64
nvidia-current-cuda-opencl-346.96-1.mga5.nonfree.x86_64
nvidia-current-devel-346.96-1.mga5.nonfree.x86_64
nvidia-current-doc-html-346.96-1.mga5.nonfree.x86_64
nvidia-current-kernel-4.1.8-desktop-1.mga5-346.96-1.mga5.nonfree.x86_64
nvidia-current-kernel-desktop-latest-346.96-1.mga5.nonfree.x86_64
x11-driver-video-nvidia-current-346.96-1.mga5.nonfree.x86_64

The system rebooted OK with the nvidia 346.96 driver.
Running smoothly so far.

CC: (none) => tarazed25

Comment 4 James Kerr 2015-10-15 22:51:36 CEST
Testing on mga5-32

Installed packages from testing:
$ rpm -q ldetect-lst
ldetect-lst-0.1.346.1-1.mga5

$ rpm -qa | grep nvidia
dkms-nvidia-current-346.96-1.mga5.nonfree
nvidia-current-doc-html-346.96-1.mga5.nonfree
nvidia-current-kernel-server-latest-346.96-1.mga5.nonfree
x11-driver-video-nvidia-current-346.96-1.mga5.nonfree
nvidia-current-kernel-4.1.8-server-1.mga5-346.96-1.mga5.nonfree

$ inxi -G
Graphics:  Card: NVIDIA GF108 [GeForce GT 630]
Display Server: X.Org 1.16.4 drivers: nvidia,v4l Resolution: 1440x900@59.89hz
GLX Renderer: GeForce GT 630/PCIe/SSE2/3DNOW! GLX Version: 4.5.0 NVIDIA 346.96


nvidia-current is OK for me on mga5-32
Comment 5 Lewis Smith 2015-10-16 20:14:43 CEST
As noted in the last IRC meeting, this update needs pushing to clear the way for forthcoming kernel updates. All the Comments above (to which I cannot add, not having nVidia) are favourable; so I am putting in the OKs.

Whiteboard: advisory => advisory MGA5-32-OK MGA5-64-OK
CC: (none) => lewyssmith

Comment 6 Brian Rockwell 2015-10-17 22:56:12 CEST
I noticed the nvidia304-kernel-desktop-latest-304.128-1.mga5.nonfree.i586.rpm (The nvidia304 drivers hadn't been tested).  I happen to have an old box that uses them.

It worked, though the first boot after installing it was SLOW to get to log-in.  Is it downloading something?

Seems to be working fine.  Visited heavily graphic web-sites and it managed its way through them.

nvidia304-kernel-desktop-latest-304.128-1.mga5.nonfree.i586.rpm
x11-driver-video-nvidia304-304.128-1.mga5.nonfree.i586.rpm

tested out fine.  It added the html one was well

nvidia304-doc-html-304.128-1.mga5.nonfree.i586.rpm


Brian

CC: (none) => brtians1

Comment 7 William Kenney 2015-10-25 15:20:32 CET
Validating this update

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2015-10-25 15:39:01 CET
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0407.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2015-10-26 20:57:56 CET

URL: (none) => http://lwn.net/Vulnerabilities/658597/


Note You need to log in before you can comment on or make changes to this bug.