the critical one getting some press is: CVE-2016-8655 Linux af_packet.c race condition (local root)

Priority: Normal => High

Advisory, also added to svn:

type: security
subject: Updated kernel packages fixes security vulnerabilities
CVE:
 - CVE-2016-8645
 - CVE-2016-8650
 - CVE-2016-8655
 - CVE-2016-9756
 - CVE-2016-9793
src:
  5:
   core:
     - kernel-4.4.36-2.mga5
     - kernel-userspace-headers-4.4.36-2.mga5
     - kmod-vboxadditions-5.1.10-2.1.mga5
     - kmod-virtualbox-5.1.10-2.1.mga5
     - kmod-xtables-addons-2.10-17.mga5
description: |
  This update is based on upstream 4.4.36 and fixes atleast the following
  security issues:

  The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation,
  which allows local users to cause a denial of service (system crash) via
  a crafted application that makes sendto system calls, related to 
  net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c (CVE-2016-8645).

  The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through
  4.8.11 does not ensure that memory is allocated for limb data, which allows
  local users to cause a denial of service (stack memory corruption and panic)
  via an add_key system call for an RSA key with a zero exponent
  (CVE-2016-8650).

  A race condition issue leading to a use-after-free flaw was found in the
  way the raw packet sockets implementation in the Linux kernel networking
  subsystem handled synchronization while creating the TPACKET_V3 ring
  buffer. A local user able to open a raw packet socket (requires the
  CAP_NET_RAW capability) could use this flaw to elevate their privileges
  on the system (CVE-2016-8655).

  Linux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM)
  support is vulnerable to an information leakage issue. It could occur
  on x86 platform, while emulating instructions in 32bit mode. A 
  user/process could use this flaw to leak host kernel memory bytes
  (CVE-2016-9756).

  A bug in SO_{SND|RCV}BUFFORCE setsockopt() implementation allows
  CAP_NET_ADMIN users to set negative sk_sndbuf or sk_rcvbuf values.
  A user could use this flaw to cause various memory corruptions,
  crashes and OOM (CVE-2016-9793).

  For other fixes in this update, see the referenced changelogs.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=19906
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.33
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.34
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.35
 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.36

Whiteboard: (none) => advisory

I have x86_64 server kernel installed on 4 live servers, and no problems so far...

on mga5-64

Packages installed:

- cpupower-4.4.36-2.mga5.x86_64
- kernel-desktop-4.4.36-2.mga5-1-1.mga5.x86_64
- kernel-desktop-latest-4.4.36-2.mga5.x86_64

Packages installed cleanly

System re-booted normally
$ uname -r
4.4.36-desktop-2.mga5

No regressions noted

OK for mga5-64 on this system:

mobo: ECS model: GeForce7050M-M v: 1.0
CPU:  Quad core AMD Phenom 9500 (-MCP-)
Graphics:  Card: NVIDIA GF108 [GeForce GT 630]
           Display Server: X.Org 1.16.4 drivers: v4l,nouveau 
Boot: legacy BIOS
Disk: GPT partitions

CC: (none) => jim

on mga5-64

Packages installed:

- cpupower-4.4.36-2.mga5.x86_64
- kernel-desktop-4.4.36-2.mga5-1-1.mga5.x86_64
- kernel-desktop-latest-4.4.36-2.mga5.x86_64
- kernel-userspace-headers-4.4.36-2.mga5.x86_64
- virtualbox-kernel-4.4.36-desktop-2.mga5-5.1.10-2.1.mga5.x86_64
- virtualbox-kernel-desktop-latest-5.1.10-2.1.mga5.x86_64

Packages installed cleanly

system re-booted normally
$ uname -r
4.4.36-desktop-2.mga5

No regressions noted

OK for mag5-64 on this system:

System: Hewlett-Packard product: CQ2925EA v: 1.00
Mobo: PEGATRON model: 2AE2 v: 1.02 
CPU:  Dual core Intel Pentium G645T (-MCP-) 
Graphics:  Card: Intel 2nd Generation Core Processor Family Integrated Graphics Controller
           Display Server: X.Org 1.16.4 drivers: v4l,intel 
Boot: EFI
Disk: GPT partitions

Since Mageia 5 64 bits seems fine, I'm testing the update on a 32bit real hardware.

CC: (none) => youpburden

(In reply to youpburden from comment #6)
> Since Mageia 5 64 bits seems fine, I'm testing the update on a 32bit real
> hardware.

Packages installed from the testing repo :

- cpupower-4.4.36-2.mga5.i586
- kernel-desktop-4.4.36-2.mga5-1-1.mga5.i586
- kernel-desktop-latest-4.4.36-2.mga5.i586
- kernel-userspace-headers-4.4.36-2.mga5.i586
- virtualbox-kernel-4.4.36-desktop-2.mga5-5.1.10-2.1.mga5.i586
- virtualbox-kernel-desktop-latest-5.1.10-2.1.mga5.i586

Installation works fine, no problem reported.
I reboot and start with the new kernel.

uname -r gives me :

Linux localhost 4.4.36-2desktop-1.mga5 #1 SMP ...

I checked with the command : 
# cat /proc/kmsg

No hardware problem reported using the free driver for AMD cards.

No problem so far, I ran a few apps and put the system on freeze/wake mode.

To be sure, I installed Mageia 5 32 bits from a netinstall and installed the kernel from the testing only.

It's ok on 32 bits.

CVE: (none) => CVE-2016-8645 CVE-2016-8650 CVE-2016-8655 CVE-2016-9756 CVE-2016-9793
Whiteboard: advisory => advisory MGA5-64-OK MGA5-32-OK

I think that kernels should be tested on a wide range of hardware before they are OK'd

I have removed the OK's for the present.

If team leaders disagree they'll restore the OK's

Whiteboard: advisory MGA5-64-OK MGA5-32-OK => advisory

In a vbox VM running mga5-64
(host mga5-64 running 4.4.36-desktop-2)

Packages installed:

- cpupower-4.4.36-2.mga5.x86_64
- kernel-desktop-4.4.36-2.mga5-1-1.mga5.x86_64
- kernel-desktop-latest-4.4.36-2.mga5.x86_64
- vboxadditions-kernel-4.4.36-desktop-2.mga5-5.1.10-2.1.mga5.x86_64
- vboxadditions-kernel-desktop-latest-5.1.10-2.1.mga5.x86_64

VM re-booted normally
$ uname -r
4.4.36-desktop-2.mga5

No regressions noted

OK for mga5-64 in this VM

In VirtualBox, M5, KDE, 32-bit

boot with "nomodeset" kernel option

Package(s) under test:
kernel-desktop586-latest vboxadditions-kernel-desktop586-latest

default install of kernel-desktop586-latest

[root@localhost wilcal]# uname -a
Linux localhost.localdomain 4.4.32-desktop586-1.mga5 #1 SMP Tue Nov 15 09:07:49 UTC 2016 i686 i686 i686 GNU/Linux
[root@localhost wilcal]# urpmi kernel-desktop586-latest
Package kernel-desktop586-latest-4.4.32-1.mga5.i586 is already installed
[root@localhost wilcal]# urpmi vboxadditions-kernel-desktop586-latest
Package vboxadditions-kernel-desktop586-latest-5.1.10-1.1.mga5.i586 is already installed

System boots to a working desktop. Common apps work. Screen dimensions are correct.

install kernel-desktop-latest & vboxadditions-kernel-desktop586-latest from updates_testing

[root@localhost wilcal]# uname -a
Linux localhost.localdomain 4.4.36-desktop586-2.mga5 #1 SMP Tue Dec 6 16:56:15 UTC 2016 i686 i686 i686 GNU/Linux
[root@localhost wilcal]# urpmi kernel-desktop586-latest
Package kernel-desktop586-latest-4.4.36-2.mga5.i586 is already installed
[root@localhost wilcal]# urpmi vboxadditions-kernel-desktop586-latest
Package vboxadditions-kernel-desktop586-latest-5.1.10-2.1.mga5.i586 is already installed

System boots to a working desktop. Common apps work. Screen dimensions are correct.

CC: (none) => wilcal.int

In VirtualBox, M5, KDE, 64-bit

boot with "nomodeset" kernel option

Package(s) under test:
kernel-desktop-latest vboxadditions-kernel-desktop-latest

default install of kernel-desktop-latest & vboxadditions-kernel-desktop-latest

[root@localhost wilcal]# uname -a
Linux localhost.localdomain 4.4.32-desktop-1.mga5 #1 SMP Tue Nov 15 09:08:15 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-desktop-latest
Package kernel-desktop-latest-4.4.32-1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi vboxadditions-kernel-desktop-latest
Package vboxadditions-kernel-desktop-latest-5.1.10-1.1.mga5.x86_64 is already installed

System boots to a working desktop. Common apps work. Screen dimensions are correct.

install kernel-desktop-latest & vboxadditions-kernel-desktop-latest from updates_testing

[root@localhost wilcal]# uname -a
Linux localhost.localdomain 4.4.36-desktop-2.mga5 #1 SMP Tue Dec 6 16:56:06 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-desktop-latest
Package kernel-desktop-latest-4.4.36-2.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi vboxadditions-kernel-desktop-latest
Package vboxadditions-kernel-desktop-latest-5.1.10-2.1.mga5.x86_64 is already installed

System boots to a working desktop. Common apps work. Screen dimensions are correct.

x86_64  nvidia GTX 770, 367.57  quadcore(x2) Intel i7-4790K

- cpupower-4.4.36-2.mga5.x86_64
- cpupower-devel-4.4.36-2.mga5.x86_64
- kernel-desktop-4.4.36-2.mga5-1-1.mga5.x86_64
- kernel-desktop-devel-4.4.36-2.mga5-1-1.mga5.x86_64
- kernel-desktop-devel-latest-4.4.36-2.mga5.x86_64
- kernel-desktop-latest-4.4.36-2.mga5.x86_64
- kernel-userspace-headers-4.4.36-2.mga5.x86_64
- perf-4.4.36-2.mga5.x86_64
- virtualbox-kernel-4.4.36-desktop-2.mga5-5.1.10-2.1.mga5.x86_64
- virtualbox-kernel-desktop-latest-5.1.10-2.1.mga5.x86_64
- xtables-addons-kernel-4.4.36-desktop-2.mga5-2.10-17.mga5.x86_64
- xtables-addons-kernel-desktop-latest-2.10-17.mga5.x86_64

libafs, nvidia-current built and installed.

- vboxadditions-kernel-4.4.36-desktop-2.mga5
- vboxadditions-kernel-desktop-latest
- kernel-source-latest-4.4.36-2.mga5.noarch

Rebooted to Mate OK.  Desktop working fine but virtualbox fails to launch a guest.  Tried to install the latest extension pack but that failed as well.  This part never runs smoothly.

Searched the forums for earlier attempts at solving this problem.
$ sudo VBoxManage extpack cleanup
$ sudo VBoxManage extpack install Oracle_VM_VirtualBox_Extension_Pack-5.0.2-102096.vbox-extpack
0%...
Progress state: NS_ERROR_FAILURE
VBoxManage: error: Failed to install "/home/lcl/Downloads/Oracle_VM_VirtualBox_Extension_Pack-5.0.2-102096.vbox-extpack"
VBoxManage: error: Extension pack 'Oracle VM VirtualBox Extension Pack' is already installed. In case of a reinstallation, please uninstall it first
VBoxManage: error: Details: code NS_ERROR_FAILURE (0x80004005), component ExtPackManagerWrap, interface IExtPackManager
VBoxManage: error: Context: "RTEXITCODE handleExtPack(HandlerArg*)" at line 1158 of file VBoxManageMisc.cpp

Tried running things as root, rather than sudo...
# VBoxManage extpack uninstall 'Oracle VM VirtualBox Extension Pack'
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Successfully uninstalled "Oracle VM VirtualBox Extension Pack".
# sudo VBoxManage extpack install Oracle_VM_VirtualBox_Extension_Pack-5.0.2-102096.vbox-extpack
0%...
Progress state: NS_ERROR_FAILURE
VBoxManage: error: Failed to install "/home/lcl/Downloads/Oracle_VM_VirtualBox_Extension_Pack-5.0.2-102096.vbox-extpack"
VBoxManage: error: VBoxExtPackRegister returned VERR_VERSION_MISMATCH, pReg=0000000000000000 ErrInfo='VirtualBox version mismatch - expected 5.0 got 5.1'
VBoxManage: error: Details: code NS_ERROR_FAILURE (0x80004005), component ExtPackManagerWrap, interface IExtPackManager
VBoxManage: error: Context: "RTEXITCODE handleExtPack(HandlerArg*)" at line 1158 of file VBoxManageMisc.cpp

So why did Oracle offer me 5.0 as an *upgrade*?  $$%$££!  It said "You have an old version (5.0.2)..... Do you wish to download the latest one....?"
So, tried again and this time it downloaded 5.1.10 but that failed to install as well.

Again...
# VBoxManage extpack uninstall 'Oracle VM VirtualBox Extension Pack'
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Successfully uninstalled "Oracle VM VirtualBox Extension Pack".
# VBoxManage extpack install Oracle_VM_VirtualBox_Extension_Pack-5.1.10-112026.vbox-extpack
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Successfully installed "Oracle VM VirtualBox Extension Pack".

At last.  Sigh!

Guests now launch OK.

Coda: VirtualBox
The moral is; don't use sudo and make sure that cleanup is run.  Go to the VirtualBox site and pick the extpack you want to download then install it from the commandline.

CC: (none) => tarazed25

(In reply to James Kerr from comment #9)
> In a vbox VM running mga5-64
> (host mga5-64 running 4.4.36-desktop-2)
> 

I should have added that using the default Intel audio controller, sound is barely audible even with the volume at maximum. Switching to ICH AC97 restores normally volume, but IIRC that was also necessary before this update.

New kernel running in x86_64 in both the host system and a VirtualBox VM.
Multiple applications run on the guest and host for the last 2h30m.

No regressions noticed.

CC: (none) => mageia

Whole mageia buildsystem is now running kernel-server-4.4.36-2.mga5

By the time you wake up in the morning I'll be finished.
Looks good so far.

On mga5-32

Packages installed:

- cpupower-4.4.36-2.mga5.i586
- kernel-desktop-4.4.36-2.mga5-1-1.mga5.i586
- kernel-desktop-latest-4.4.36-2.mga5.i586

Packages installed cleanly

System re-booted normally
$ uname -r
4.4.36-desktop-2.mga5

No regressions noted

OK for mga5-32 on this system:

Machine:   Mobo: ECS model: GeForce7050M-M v: 1.0
CPU:       Quad core AMD Phenom 9500
Graphics:  Card: NVIDIA GF108 [GeForce GT 630]
	   drivers: v4l,nouveau

On real hardware, M5, KDE, 64-bit

initial install:
kernel-desktop-latest
virtualbox vboxadditions-kernel-desktop-latest dkms-virtualbox
virtualbox-guest-additions virtualbox-kernel-desktop-latest x11-driver-video-vboxvideo
kernel-desktop-devel-latest nvidia-current-kernel-desktop-latest

[root@localhost wilcal]# uname -a
Linux localhost.localdomain 4.4.32-desktop-1.mga5 #1 SMP Tue Nov 15 09:08:15 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-desktop-latest
Package kernel-desktop-latest-4.4.32-1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox
Package virtualbox-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi vboxadditions-kernel-desktop-latest
Package vboxadditions-kernel-desktop-latest-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi dkms-virtualbox
Package dkms-virtualbox-5.1.10-1.1.mga5.noarch is already installed
[root@localhost wilcal]# urpmi virtualbox-guest-additions
Package virtualbox-guest-additions-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox-kernel-desktop-latest
Package virtualbox-kernel-desktop-latest-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi x11-driver-video-vboxvideo
Package x11-driver-video-vboxvideo-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi kernel-desktop-devel-latest
Package kernel-desktop-devel-latest-4.4.32-1.mga5.x86_64 is already installed
Marking kernel-desktop-devel-latest as manually installed, it won't be auto-orphaned
writing /var/lib/rpm/installed-through-deps.list
[root@localhost wilcal]# urpmi nvidia-current-kernel-desktop-latest
Package nvidia-current-kernel-desktop-latest-352.79-10.mga5.nonfree.x86_64 is already installed
[wilcal@localhost ~]$ lspci -k
01:00.0 VGA compatible controller: NVIDIA Corporation GF108 [GeForce GT 440] (rev a1)
        Subsystem: Gigabyte Technology Co., Ltd Device 3518
        Kernel driver in use: nvidia
        Kernel modules: nvidiafb, nouveau, nvidia_current

M5 i586 Gnome Live-CD runs as a Vbox client.
Boots to a working desktop. Common apps work.
Screen sizes are correct.

- kernel-desktop-4.4.36-2.mga5-1-1.mga5.x86_64
- kernel-desktop-devel-4.4.36-2.mga5-1-1.mga5.x86_64
- kernel-desktop-devel-latest-4.4.36-2.mga5.x86_64
- kernel-desktop-latest-4.4.36-2.mga5.x86_64
- vboxadditions-kernel-4.4.36-desktop-2.mga5-5.1.10-2.1.mga5.x86_64
- vboxadditions-kernel-desktop-latest-5.1.10-2.1.mga5.x86_64
- virtualbox-kernel-4.4.36-desktop-2.mga5-5.1.10-2.1.mga5.x86_64
- virtualbox-kernel-desktop-latest-5.1.10-2.1.mga5.x86_64

install or check:
kernel-desktop-latest
virtualbox vboxadditions-kernel-desktop-latest dkms-virtualbox
virtualbox-guest-additions virtualbox-kernel-desktop-latest x11-driver-video-vboxvideo
kernel-desktop-devel-latest nvidia-current-kernel-desktop-latest
from updates_testing

[root@localhost wilcal]# uname -a
Linux localhost.localdomain 4.4.36-desktop-2.mga5 #1 SMP Tue Dec 6 16:56:06 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-desktop-latest
Package kernel-desktop-latest-4.4.36-2.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox
Package virtualbox-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi vboxadditions-kernel-desktop-latest
Package vboxadditions-kernel-desktop-latest-5.1.10-2.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi dkms-virtualbox
Package dkms-virtualbox-5.1.10-1.1.mga5.noarch is already installed
[root@localhost wilcal]# urpmi virtualbox-guest-additions
Package virtualbox-guest-additions-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox-kernel-desktop-latest
Package virtualbox-kernel-desktop-latest-5.1.10-2.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi x11-driver-video-vboxvideo
Package x11-driver-video-vboxvideo-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi kernel-desktop-devel-latest
Package kernel-desktop-devel-latest-4.4.36-2.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi nvidia-current-kernel-desktop-latest
Package nvidia-current-kernel-desktop-latest-352.79-10.mga5.nonfree.x86_64 is already installed
[wilcal@localhost ~]$ lspci -k
01:00.0 VGA compatible controller: NVIDIA Corporation GF108 [GeForce GT 440] (rev a1)
        Subsystem: Gigabyte Technology Co., Ltd Device 3518
        Kernel driver in use: nvidia
        Kernel modules: nvidiafb, nouveau, nvidia_current

System boots to a working desktop. Common apps work.
Previously created M5 i586 Gnome Live-CD runs as a Vbox client.
M5 Gnome x86_64 Live-DVD runs as a Vbox client.
M5 x86_64 KDE Live-DVD runs, installs and updates as a Vbox client.

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)

looks good

Created attachment 8736 [details]
dmesg from i686

CC: (none) => brtians1

Created attachment 8737 [details]
journal from i686 VM

Attached dmesg and journalctl from VM.  It hung up during reboot of VM after installing patch.  I think this may be unique to my configuration.

AMD Athlon X3 - Internal AMD Video.

Real Hardware: Athlon X2 7750, 8GB, nvidia 340 graphics.

32-bit install with server kernel.

Same hardware, 64-bit install, server kernel with vbox 5.1.10.

vbox Mageia 5 guests, both 32-bit and 64-bit, both using desktop kernel.

All updated to appropriate kernel, including vbox modules where appropriate. Host was updated before updating guests.

Everything working as it should.

CC: (none) => andrewsfarm

Real Hardware: HP Probook 6550b, Intel i3, 8GB, Integrated Intel graphics, Intel wifi.

64-bit desktop kernel, with vbox 5.1.10.

Real hardware updated. Everything seems to work, including wifi and vbox. 



Also more real hardware: Dell Dimension E310, P4, 2GB, onboard Intel graphics, BCM4318 wifi.

64-bit install, desktop kernel updated, all seems to work, including wifi.

Real Hardware - Intel

$ uname -a
Linux localhost 4.4.36-server-2.mga5 #1 SMP Tue Dec 6 18:04:15 UTC 2016 i686 i686 i686 GNU/Linux

Spun up VirtualBox - had to install a new VirtualBox latest to make it work.  

However, spun up a 32-bit client, browser is working.  Youtube is working.

Also OK on two i586 laptops and my x86_64 workstation at work.  We already have better testing coverage for this one than the last few we've pushed.  No need to hold it up any longer.

Keywords: (none) => validated_update
Whiteboard: advisory => MGA5-32-OK MGA5-64-OK advisory
CC: (none) => sysadmin-bugs

Wow! What a team effort on this one. Kudos to everyone.

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0415.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED