Bug 20313 - Update request: kernel-4.4.50-2.mga5
Summary: Update request: kernel-4.4.50-2.mga5
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: High critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: MGA5_
Whiteboard: advisory MGA5-64-OK MGA5-32-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2017-02-19 13:10 CET by Thomas Backlund
Modified: 2017-02-25 09:30 CET (History)
13 users (show)

See Also:
Source RPM: kernel
CVE:
Status comment:


Attachments

Description Thomas Backlund 2017-02-19 13:10:08 CET
Now this one should be good for tests... it's passed my initial tests and the whole mageia build infra runs the x86_64 server kernel

Advisory to follow...

SRPMS:
kernel-4.4.50-1.mga5.src.rpm
kernel-userspace-headers-4.4.50-1.mga5.src.rpm
kmod-vboxadditions-5.1.10-10.1.mga5.src.rpm
kmod-virtualbox-5.1.10-10.1.mga5.src.rpm
kmod-xtables-addons-2.10-30.mga5.src.rpm

i586:
cpupower-4.4.50-1.mga5.i586.rpm
cpupower-devel-4.4.50-1.mga5.i586.rpm
kernel-desktop-4.4.50-1.mga5-1-1.mga5.i586.rpm
kernel-desktop586-4.4.50-1.mga5-1-1.mga5.i586.rpm
kernel-desktop586-devel-4.4.50-1.mga5-1-1.mga5.i586.rpm
kernel-desktop586-devel-latest-4.4.50-1.mga5.i586.rpm
kernel-desktop586-latest-4.4.50-1.mga5.i586.rpm
kernel-desktop-devel-4.4.50-1.mga5-1-1.mga5.i586.rpm
kernel-desktop-devel-latest-4.4.50-1.mga5.i586.rpm
kernel-desktop-latest-4.4.50-1.mga5.i586.rpm
kernel-doc-4.4.50-1.mga5.noarch.rpm
kernel-server-4.4.50-1.mga5-1-1.mga5.i586.rpm
kernel-server-devel-4.4.50-1.mga5-1-1.mga5.i586.rpm
kernel-server-devel-latest-4.4.50-1.mga5.i586.rpm
kernel-server-latest-4.4.50-1.mga5.i586.rpm
kernel-source-4.4.50-1.mga5-1-1.mga5.noarch.rpm
kernel-source-latest-4.4.50-1.mga5.noarch.rpm
kernel-userspace-headers-4.4.50-1.mga5.i586.rpm
perf-4.4.50-1.mga5.i586.rpm

vboxadditions-kernel-4.4.50-desktop-1.mga5-5.1.10-10.1.mga5.i586.rpm
vboxadditions-kernel-4.4.50-desktop586-1.mga5-5.1.10-10.1.mga5.i586.rpm
vboxadditions-kernel-4.4.50-server-1.mga5-5.1.10-10.1.mga5.i586.rpm
vboxadditions-kernel-desktop586-latest-5.1.10-10.1.mga5.i586.rpm
vboxadditions-kernel-desktop-latest-5.1.10-10.1.mga5.i586.rpm
vboxadditions-kernel-server-latest-5.1.10-10.1.mga5.i586.rpm

virtualbox-kernel-4.4.50-desktop-1.mga5-5.1.10-10.1.mga5.i586.rpm
virtualbox-kernel-4.4.50-desktop586-1.mga5-5.1.10-10.1.mga5.i586.rpm
virtualbox-kernel-4.4.50-server-1.mga5-5.1.10-10.1.mga5.i586.rpm
virtualbox-kernel-desktop586-latest-5.1.10-10.1.mga5.i586.rpm
virtualbox-kernel-desktop-latest-5.1.10-10.1.mga5.i586.rpm
virtualbox-kernel-server-latest-5.1.10-10.1.mga5.i586.rpm

xtables-addons-kernel-4.4.50-desktop-1.mga5-2.10-30.mga5.i586.rpm
xtables-addons-kernel-4.4.50-desktop586-1.mga5-2.10-30.mga5.i586.rpm
xtables-addons-kernel-4.4.50-server-1.mga5-2.10-30.mga5.i586.rpm
xtables-addons-kernel-desktop586-latest-2.10-30.mga5.i586.rpm
xtables-addons-kernel-desktop-latest-2.10-30.mga5.i586.rpm
xtables-addons-kernel-server-latest-2.10-30.mga5.i586.rpm


x86_64:
cpupower-4.4.50-1.mga5.x86_64.rpm
cpupower-devel-4.4.50-1.mga5.x86_64.rpm
kernel-desktop-4.4.50-1.mga5-1-1.mga5.x86_64.rpm
kernel-desktop-devel-4.4.50-1.mga5-1-1.mga5.x86_64.rpm
kernel-desktop-devel-latest-4.4.50-1.mga5.x86_64.rpm
kernel-desktop-latest-4.4.50-1.mga5.x86_64.rpm
kernel-doc-4.4.50-1.mga5.noarch.rpm
kernel-server-4.4.50-1.mga5-1-1.mga5.x86_64.rpm
kernel-server-devel-4.4.50-1.mga5-1-1.mga5.x86_64.rpm
kernel-server-devel-latest-4.4.50-1.mga5.x86_64.rpm
kernel-server-latest-4.4.50-1.mga5.x86_64.rpm
kernel-source-4.4.50-1.mga5-1-1.mga5.noarch.rpm
kernel-source-latest-4.4.50-1.mga5.noarch.rpm
kernel-userspace-headers-4.4.50-1.mga5.x86_64.rpm
perf-4.4.50-1.mga5.x86_64.rpm

vboxadditions-kernel-4.4.50-desktop-1.mga5-5.1.10-10.1.mga5.x86_64.rpm
vboxadditions-kernel-4.4.50-server-1.mga5-5.1.10-10.1.mga5.x86_64.rpm
vboxadditions-kernel-desktop-latest-5.1.10-10.1.mga5.x86_64.rpm
vboxadditions-kernel-server-latest-5.1.10-10.1.mga5.x86_64.rpm

virtualbox-kernel-4.4.50-desktop-1.mga5-5.1.10-10.1.mga5.x86_64.rpm
virtualbox-kernel-4.4.50-server-1.mga5-5.1.10-10.1.mga5.x86_64.rpm
virtualbox-kernel-desktop-latest-5.1.10-10.1.mga5.x86_64.rpm
virtualbox-kernel-server-latest-5.1.10-10.1.mga5.x86_64.rpm

xtables-addons-kernel-4.4.50-desktop-1.mga5-2.10-30.mga5.x86_64.rpm
xtables-addons-kernel-4.4.50-server-1.mga5-2.10-30.mga5.x86_64.rpm
xtables-addons-kernel-desktop-latest-2.10-30.mga5.x86_64.rpm
xtables-addons-kernel-server-latest-2.10-30.mga5.x86_64.rpm
Comment 1 nathan giovannini 2017-02-20 08:15:33 CET
After several tests the kernel seems stable on mga5-64

CC: (none) => nathan95
Whiteboard: (none) => MGA5-64-OK

Comment 2 Len Lawrence 2017-02-20 12:18:21 CET
x86_64

Gigabyte Sniper Z.97
Intel Core i7-4790K 4.00GHz
nvidia GeForce GTX 770
16 GB RAM

Installed cleanly, rebuilding nvidia, virtualbox, libafs ... modules on the fly.
Rebooted to Mate.  All looks OK.  Leaving this running as the default kernel.

CC: (none) => tarazed25

Comment 3 James Kerr 2017-02-20 16:11:54 CET
- cpupower-4.4.50-1.mga5.x86_64
- kernel-desktop-4.4.50-1.mga5-1-1.mga5.x86_64
- kernel-desktop-latest-4.4.50-1.mga5.x86_64

Packages installed cleanly
System rebooted normally
No regressions noted
OK for mga5-64 on this system

CPU:  Quad core Intel Core i7-6700
Graphics: Intel HD Graphics 530

CC: (none) => jim

Comment 4 James Kerr 2017-02-20 16:15:52 CET
I've removed the OK from the whiteboard, since we need to have all kernel flavours tested on as wide a range of hardware as possible, before they are given the OK.

Whiteboard: MGA5-64-OK => (none)

Comment 5 Len Lawrence 2017-02-20 18:24:21 CET
X86_64 UEFI Broadwell
Aorus laptop
Intel(R) Core(TM) i7-5700HQ CPU @ 2.70GHz
twin nvidia GeForce GTX 965M
running in single mode
16 GB RAM

Installed cpupower and kernel-desktop-latest on multi-boot system.  Had to search for the new kernel in the list at reboot because it was not specifically listed.  Used 'Mageia with linux' entry.
$ uname -r
4.4.50-desktop-1.mga5

This is running fine so far.
Comment 6 Len Lawrence 2017-02-20 18:54:48 CET
x86_64 UEFI
MSI motherboard
Intel Core i7-4790 3.60GHz
nvidia GeForce GTX 970
32 GB RAM

Installed:
- cpupower-4.4.50-1.mga5.x86_64
- kernel-desktop-4.4.50-1.mga5-1-1.mga5.x86_64
- kernel-desktop-devel-4.4.50-1.mga5-1-1.mga5.x86_64
- kernel-desktop-devel-latest-4.4.50-1.mga5.x86_64
- kernel-desktop-latest-4.4.50-1.mga5.x86_64
- kernel-userspace-headers-4.4.50-1.mga5.x86_64
- virtualbox-kernel-4.4.50-desktop-1.mga5-5.1.10-10.1.mga5.x86_64
- virtualbox-kernel-desktop-latest-5.1.10-10.1.mga5.x86_64

Installed cleanly, various modules built.
Rebooted OK as default on multiboot system.  virtualbox started up and booted to its own default kernel, 4.4.45.
nathan giovannini 2017-02-20 18:58:42 CET

URL: (none) => MGA5_

nathan giovannini 2017-02-20 18:59:08 CET

Whiteboard: (none) => MGA5-64-OK

Comment 7 James Kerr 2017-02-20 19:35:41 CET
On mga5-32

- cpupower-4.4.50-1.mga5.i586
- kernel-desktop-4.4.50-1.mga5-1-1.mga5.i586
- kernel-desktop-latest-4.4.50-1.mga5.i586

Packages installed cleanly
System re-booted normally
No regressions noted

OK for mga5-32 on this system

CPU:  Quad core Intel Core i7-6700
Graphics: Intel HD Graphics 530
nathan giovannini 2017-02-21 07:16:21 CET

Whiteboard: MGA5-64-OK => MGA5-64-OK MGA-32-OK

nathan giovannini 2017-02-21 07:42:18 CET

Whiteboard: MGA5-64-OK MGA-32-OK => MGA5-64-OK MGA5-32-OK

nathan giovannini 2017-02-21 09:44:02 CET

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Lewis Smith 2017-02-22 12:25:31 CET

CC: (none) => lewyssmith

Comment 8 Dave Hodgins 2017-02-22 17:02:58 CET
Removing the validated update keyword until more testing has been completed.

All kernels normally need testing on multiple systems, with both arches.

With the exception of critical security updates with minimal changes, kernel
updates need plenty of testing.

Keywords: validated_update => (none)
CC: (none) => davidwhodgins

Comment 9 Herman Viaene 2017-02-22 17:15:07 CET
MGA5-32 on Asus A6000VM Xfce (Intel Pentium M 740 32 bit with nvidia graphics)
No installation issues.
All seems OK

CC: (none) => herman.viaene

Comment 10 Herman Viaene 2017-02-22 17:28:15 CET
No sound on this Xfce laptop. I do very little multimedia on it, but I cann't imagine it never worked before.
Comment 11 Herman Viaene 2017-02-22 17:49:01 CET
Checked: good sound with kernel 4.4.39
With this 4.4.50 two apparent problems at first sight:
no speaker symbol in the Xfce panel
lauching pavucontrol gives "Fatal error: could not connect to Pulseaudio :OK"
Comment 12 claire robinson 2017-02-22 20:30:56 CET
Any mention of firmware issues in the journal Herman?
Comment 13 Herman Viaene 2017-02-23 09:45:08 CET
Shit happens. Yesterday I did a number of reboots, but all warm reboots (choose restart from the Xfce panel). This morning was a cold reboot, and there was sound again. One subsequent warm reboot did not show the problem again anymore. So I have no complaints anymore.
Comment 14 James Kerr 2017-02-23 12:15:28 CET
(In reply to James Kerr from comment #3)

$ uname -r
4.4.50-desktop-1.mga5

Additional packages

- virtualbox-kernel-4.4.50-desktop-1.mga5-5.1.10-10.1.mga5.x86_64
- virtualbox-kernel-desktop-latest-5.1.10-10.1.mga5.x86_64

vbox launches normally
extensions OK
win7 and winxp VMs OK
Comment 15 Thomas Andrews 2017-02-23 16:37:10 CET
Tested 32-bit desktop kernel on a Dell Dimension E310 (P4, 2GB, Intel810 or later graphics, BCM4318 wifi)

All looks good. Wifi, Firefox, vlc all work.

CC: (none) => andrewsfarm

Comment 16 Thomas Andrews 2017-02-23 16:44:12 CET
Tested 64-bit server kernel on a homebrew desktop. (Athlon X2 7750, 8GB, nvidia340 graphics, wired Internet, MBR, grub2 bootloader)

All looks good. Common apps work.

Neglected to mention in Comment 15 that that system also uses the grub2 bootloader. Both systems dual- or triple-boot with Mageia 6 installs, and use grub2 for compatibility.
Comment 17 Brian Rockwell 2017-02-24 03:15:07 CET
AMD Sempron(tm) Processor 3000+
Description: âNV18 [GeForce4 MX 4000]


The following 2 packages are going to be installed:

- kernel-desktop-4.4.50-2.mga5-1-1.mga5.i586
- kernel-desktop-latest-4.4.50-2.mga5.i586

52MB of additional disk space will be used.

47MB of packages will be retrieved.

Is it ok to continue?



After reboot:

$ uname -a
Linux localhost 4.4.50-desktop-2.mga5 #1 SMP Thu Feb 23 21:57:21 UTC 2017 i686 i686 i686 GNU/Linux

Sound and Audacious work.  Libreoffice Writer works.  Able to play movies with VLC.

Works here.

CC: (none) => brtians1

Comment 18 Brian Rockwell 2017-02-24 03:42:50 CET
Core Processor Integrated Graphics Controller
Intel(R) Core(TM) i3 CPU       M 350  @ 2.27GHz

$ uname -a
Linux localhost.localdomain 4.4.50-desktop-2.mga5 #1 SMP Thu Feb 23 21:57:21 UTC 2017 i686 i686 i686 GNU/Linux

sound works, libreoffice writer works

works fine.
Comment 19 Brian Rockwell 2017-02-24 03:43:16 CET
(In reply to Brian Rockwell from comment #18)
> Core Processor Integrated Graphics Controller
> Intel(R) Core(TM) i3 CPU       M 350  @ 2.27GHz
> 
> $ uname -a
> Linux localhost.localdomain 4.4.50-desktop-2.mga5 #1 SMP Thu Feb 23 21:57:21
> UTC 2017 i686 i686 i686 GNU/Linux
> 
> sound works, libreoffice writer works
> 
> works fine.

wifi works as well.
Comment 20 Thomas Andrews 2017-02-24 04:13:41 CET
Additional testing with the hardware of Comment 15, except this time with 32-bit kernel-desktop-4.4.50-2.

All still looks good.
Comment 21 Thomas Andrews 2017-02-24 04:16:10 CET
Additional testing with the hardware of Comment 16, except this time with 64-bit kernel-server-4.4.50-2.

All still looks good.
Comment 22 Thomas Backlund 2017-02-24 07:07:04 CET
Ok, 
a 4.4.50-2 with theese 4 minimal fixes added to get the update out fast
- dccp: fix freeing skb too early for IPV6_RECVPKTINFO (CVE-2017-6074)
- rtlwifi: rtl_usb: Fix missing entry in USB driver's private data
- Fix missing sanity check in /dev/sg
- scsi: don't BUG_ON() empty DMA transfers

I will write the advisory later todany


SRPMS:
kernel-4.4.50-2.mga5.src.rpm
kernel-userspace-headers-4.4.50-2.mga5.src.rpm

kmod-vboxadditions-5.1.10-12.mga5.src.rpm
kmod-virtualbox-5.1.10-12.mga5.src.rpm
kmod-xtables-addons-2.10-32.mga5.src.rpm



i586:
cpupower-4.4.50-2.mga5.i586.rpm
cpupower-devel-4.4.50-2.mga5.i586.rpm
kernel-desktop-4.4.50-2.mga5-1-1.mga5.i586.rpm
kernel-desktop586-4.4.50-2.mga5-1-1.mga5.i586.rpm
kernel-desktop586-devel-4.4.50-2.mga5-1-1.mga5.i586.rpm
kernel-desktop586-devel-latest-4.4.50-2.mga5.i586.rpm
kernel-desktop586-latest-4.4.50-2.mga5.i586.rpm
kernel-desktop-devel-4.4.50-2.mga5-1-1.mga5.i586.rpm
kernel-desktop-devel-latest-4.4.50-2.mga5.i586.rpm
kernel-desktop-latest-4.4.50-2.mga5.i586.rpm
kernel-doc-4.4.50-2.mga5.noarch.rpm
kernel-server-4.4.50-2.mga5-1-1.mga5.i586.rpm
kernel-server-devel-4.4.50-2.mga5-1-1.mga5.i586.rpm
kernel-server-devel-latest-4.4.50-2.mga5.i586.rpm
kernel-server-latest-4.4.50-2.mga5.i586.rpm
kernel-source-4.4.50-2.mga5-1-1.mga5.noarch.rpm
kernel-source-latest-4.4.50-2.mga5.noarch.rpm
kernel-userspace-headers-4.4.50-2.mga5.i586.rpm
perf-4.4.50-2.mga5.i586.rpm

vboxadditions-kernel-4.4.50-desktop-2.mga5-5.1.10-12.mga5.i586.rpm
vboxadditions-kernel-4.4.50-desktop586-2.mga5-5.1.10-12.mga5.i586.rpm
vboxadditions-kernel-4.4.50-server-2.mga5-5.1.10-12.mga5.i586.rpm
vboxadditions-kernel-desktop586-latest-5.1.10-12.mga5.i586.rpm
vboxadditions-kernel-desktop-latest-5.1.10-12.mga5.i586.rpm
vboxadditions-kernel-server-latest-5.1.10-12.mga5.i586.rpm

virtualbox-kernel-4.4.50-desktop-2.mga5-5.1.10-12.mga5.i586.rpm
virtualbox-kernel-4.4.50-desktop586-2.mga5-5.1.10-12.mga5.i586.rpm
virtualbox-kernel-4.4.50-server-2.mga5-5.1.10-12.mga5.i586.rpm
virtualbox-kernel-desktop586-latest-5.1.10-12.mga5.i586.rpm
virtualbox-kernel-desktop-latest-5.1.10-12.mga5.i586.rpm
virtualbox-kernel-server-latest-5.1.10-12.mga5.i586.rpm

xtables-addons-kernel-4.4.50-desktop-2.mga5-2.10-32.mga5.i586.rpm
xtables-addons-kernel-4.4.50-desktop586-2.mga5-2.10-32.mga5.i586.rpm
xtables-addons-kernel-4.4.50-server-2.mga5-2.10-32.mga5.i586.rpm
xtables-addons-kernel-desktop586-latest-2.10-32.mga5.i586.rpm
xtables-addons-kernel-desktop-latest-2.10-32.mga5.i586.rpm
xtables-addons-kernel-server-latest-2.10-32.mga5.i586.rpm




x86_64:
cpupower-4.4.50-2.mga5.x86_64.rpm
cpupower-devel-4.4.50-2.mga5.x86_64.rpm
kernel-desktop-4.4.50-2.mga5-1-1.mga5.x86_64.rpm
kernel-desktop-devel-4.4.50-2.mga5-1-1.mga5.x86_64.rpm
kernel-desktop-devel-latest-4.4.50-2.mga5.x86_64.rpm
kernel-desktop-latest-4.4.50-2.mga5.x86_64.rpm
kernel-doc-4.4.50-2.mga5.noarch.rpm
kernel-server-4.4.50-2.mga5-1-1.mga5.x86_64.rpm
kernel-server-devel-4.4.50-2.mga5-1-1.mga5.x86_64.rpm
kernel-server-devel-latest-4.4.50-2.mga5.x86_64.rpm
kernel-server-latest-4.4.50-2.mga5.x86_64.rpm
kernel-source-4.4.50-2.mga5-1-1.mga5.noarch.rpm
kernel-source-latest-4.4.50-2.mga5.noarch.rpm
kernel-userspace-headers-4.4.50-2.mga5.x86_64.rpm
perf-4.4.50-2.mga5.x86_64.rpm

vboxadditions-kernel-4.4.50-desktop-2.mga5-5.1.10-12.mga5.x86_64.rpm
vboxadditions-kernel-4.4.50-server-2.mga5-5.1.10-12.mga5.x86_64.rpm
vboxadditions-kernel-desktop-latest-5.1.10-12.mga5.x86_64.rpm
vboxadditions-kernel-server-latest-5.1.10-12.mga5.x86_64.rpm

virtualbox-kernel-4.4.50-desktop-2.mga5-5.1.10-12.mga5.x86_64.rpm
virtualbox-kernel-4.4.50-server-2.mga5-5.1.10-12.mga5.x86_64.rpm
virtualbox-kernel-desktop-latest-5.1.10-12.mga5.x86_64.rpm
virtualbox-kernel-server-latest-5.1.10-12.mga5.x86_64.rpm

xtables-addons-kernel-4.4.50-desktop-2.mga5-2.10-32.mga5.x86_64.rpm
xtables-addons-kernel-4.4.50-server-2.mga5-2.10-32.mga5.x86_64.rpm
xtables-addons-kernel-desktop-latest-2.10-32.mga5.x86_64.rpm
xtables-addons-kernel-server-latest-2.10-32.mga5.x86_64.rpm

Priority: Normal => High
Summary: Update request: kernel-4.4.50-1.mga5 => Update request: kernel-4.4.50-2.mga5
Severity: normal => critical

Thomas Backlund 2017-02-24 07:27:21 CET

Whiteboard: MGA5-64-OK MGA5-32-OK => (none)

Comment 23 Shlomi Fish 2017-02-24 09:27:30 CET
I tried it with the mirror.isoc.org.il mirror on a vbox VM. The system rebooted fine, but the vboxadditions were not present (mirror problems probably) so my screen was small. Otherwise, everything seems to be working fine,

CC: (none) => shlomif

Comment 24 Thomas Backlund 2017-02-24 11:30:23 CET
Advisory text (also added to svn)


The cgroup offline implementation in the Linux kernel through 4.8.11
mishandles certain drain operations, which allows local users to cause
a denial of service (system hang) by leveraging access to a container
environment for executing a crafted application, as demonstrated by
trinity (CVE-2016-9191).

arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP
and #OF exceptions, which allows guest OS users to cause a denial of
service (guest OS crash) by declining to handle an exception thrown by
an L2 guest (CVE-2016-9588).

The sg implementation in the Linux kernel through 4.9 does not properly
restrict write operations in situations where the KERNEL_DS option is set,
which allows local users to read or write to arbitrary kernel memory
locations or cause a denial of service (use-after-free) by leveraging
access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c
(CVE-2016-10088).

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel
through 4.9.8 does not properly validate meta block groups, which
allows physically proximate attackers to cause a denial of service
(out-of-bounds read and system crash) via a crafted ext4 image
(CVE-2016-10208).

The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in
the Linux kernel before 4.9.5 improperly emulates a "MOV SS, NULL
selector" instruction, which allows guest OS users to cause a denial of
service (guest OS crash) or gain guest OS privileges via a crafted
application (CVE-2017-2583).

arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local
users to obtain sensitive information from kernel memory or cause a
denial of service (use-after-free) via a crafted application that
leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt
(CVE-2017-2584).

drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6
interacts incorrectly with the CONFIG_VMAP_STACK option, which allows
local users to cause a denial of service (system crash or memory
corruption) or possibly have unspecified other impact by leveraging
use of more than one virtual page for a DMA scatterlist (CVE-2017-5547).

drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6
interacts incorrectly with the CONFIG_VMAP_STACK option, which allows
local users to cause a denial of service (system crash or memory
corruption) or possibly have unspecified other impact by leveraging
use of more than one virtual page for a DMA scatterlist (CVE-2017-5548).

The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c
in the Linux kernel before 4.9.5 places uninitialized heap-memory
contents into a log entry upon a failure to read the line status, which
allows local users to obtain sensitive information by reading the log
(CVE-2017-5549).

The simple_set_acl function in fs/posix_acl.c in the Linux kernel before
4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs
filesystem, which allows local users to gain group privileges by
leveraging the existence of a setgid program with restrictions on
execute permissions (CVE-2017-5551).

An issue was found in the Linux kernel ipv6 implementation of GRE tunnels
which allows a remote attacker to trigger an out-of-bounds access
(CVE-2017-5897).

The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux
kernel through 4.9.9 allows attackers to cause a denial of service
(system crash) via (1) an application that makes crafted system calls or
possibly (2) IPv4 traffic with invalid IP options (CVE-2017-5970).

Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c
in the Linux kernel before 4.9.11 allows local users to cause a denial
of service (assertion failure and panic) via a multithreaded application
that peels off an association in a certain buffer-full state
(CVE-2017-5986).

The dccp_rcv_state_process function in net/dccp/input.c in the Linux
kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures
in the LISTEN state, which allows local users to obtain root privileges
or cause a denial of service (double free) via an application that makes
an IPV6_RECVPKTINFO setsockopt system call (CVE-2017-6074).

The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before
4.9.11 allows remote attackers to cause a denial of service (infinite loop
and soft lockup) via vectors involving a TCP packet with the URG flag
(CVE-2017-6214).

Whiteboard: (none) => advisory

Comment 25 James Kerr 2017-02-24 13:06:16 CET
on mga5-32 packages

kernel-desktop-latest-4.4.50-2.mga5.i586  
cpupower-4.4.50-2.mga5.i586     
kernel-desktop-4.4.50-2.mga5-1-1.mga5.i586  

$ uname -r
4.4.50-desktop-2.mga5

system booted normally
no regressions noted

OK for mga5-32 on this system:

CPU: Quad core Intel Core i7-6700 
Graphics: Intel HD Graphics 530
Comment 26 Thomas Andrews 2017-02-24 14:23:59 CET
Real hardware (Sempron 3100+, 2GB, nvidia304 graphics, BCM4318 wifi), 32-bit server kernel.

Updated to kernel-server-4.4.50-2.mga5-1-1.mga5.i586. No issues noted. Wifi OK, graphics OK, common apps work.
Comment 27 Herman Viaene 2017-02-24 15:26:15 CET
MGA5-32 on Asus A6000VM (Pentium M, nVidia GeForce 7300) Xfce
Installed desktop flavours, no issues
After reboot working desktop, text with mousepad and Libreoffice Writer, sound and video with parole player, access to NFS shares, wifi printer detected, firefox (writing from it) all OK.
Comment 28 PC LX 2017-02-24 18:04:09 CET
The new x86_64 desktop kernel is in use for several hours and didn't notice any regressions. All hardware seems to be working without issues (e.g. nVidia Geforce 210, HP OfficeJet 4652, Logitech USB keyboard and mouse). Both plasma and a bunch of programs I normally use seems to be working without regressions.

$ uname -a
Linux marte 4.4.50-desktop-2.mga5 #1 SMP Thu Feb 23 21:21:14 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
$ lspcidrake 
pata_jmicron    : JMicron Technology Corp.|JMB368 IDE controller [STORAGE_IDE]
r8169           : Realtek Semiconductor Co., Ltd.|RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller [NETWORK_ETHERNET] (rev: 02)
snd_hda_intel   : NVIDIA Corporation|High Definition Audio Controller [MULTIMEDIA_AUDIO_DEV] (rev: a1)
Card:NVIDIA GeForce 8100 to GeForce 415: NVIDIA Corporation|GT218 [GeForce 210] [DISPLAY_VGA] (rev: a2)
i2c_i801        : Intel Corporation|82801JI (ICH10 Family) SMBus Controller [SERIAL_SMBUS]
unknown         : Intel Corporation|82801JI (ICH10 Family) SATA AHCI Controller [STORAGE_SATA]
lpc_ich         : Intel Corporation|82801JIB (ICH10) LPC Interface Controller [BRIDGE_ISA]
unknown         : Intel Corporation|82801 PCI Bridge [BRIDGE_PCI] (rev: 90)
ehci_pci        : Intel Corporation|82801JI (ICH10 Family) USB2 EHCI Controller #1 [SERIAL_USB]
uhci_hcd        : Intel Corporation|82801JI (ICH10 Family) USB UHCI Controller #3 [SERIAL_USB]
uhci_hcd        : Intel Corporation|82801JI (ICH10 Family) USB UHCI Controller #2 [SERIAL_USB]
uhci_hcd        : Intel Corporation|82801JI (ICH10 Family) USB UHCI Controller #1 [SERIAL_USB]
shpchp          : Intel Corporation|82801JI (ICH10 Family) PCI Express Root Port 3 [BRIDGE_PCI]
shpchp          : Intel Corporation|82801JI (ICH10 Family) PCI Express Port 2 [BRIDGE_PCI]
shpchp          : Intel Corporation|82801JI (ICH10 Family) PCI Express Root Port 1 [BRIDGE_PCI]
snd_hda_intel   : Intel Corporation|82801JI (ICH10 Family) HD Audio Controller [MULTIMEDIA_AUDIO_DEV]
ehci_pci        : Intel Corporation|82801JI (ICH10 Family) USB2 EHCI Controller #2 [SERIAL_USB]
uhci_hcd        : Intel Corporation|82801JI (ICH10 Family) USB UHCI Controller #6 [SERIAL_USB]
uhci_hcd        : Intel Corporation|82801JI (ICH10 Family) USB UHCI Controller #5 [SERIAL_USB]
uhci_hcd        : Intel Corporation|82801JI (ICH10 Family) USB UHCI Controller #4 [SERIAL_USB]
shpchp          : Intel Corporation|4 Series Chipset PCI Express Root Port [BRIDGE_PCI] (rev: 03)
unknown         : Intel Corporation|4 Series Chipset DRAM Controller [BRIDGE_HOST] (rev: 03)
hub             : Linux 4.4.50-desktop-2.mga5 uhci_hcd|UHCI Host Controller [Hub|Unused|Full speed (or root) hub]
hub             : Linux 4.4.50-desktop-2.mga5 uhci_hcd|UHCI Host Controller [Hub|Unused|Full speed (or root) hub]
Mouse:evdev     : Logitech|USB Receiver [Human Interface Device|Boot Interface Subclass|Keyboard]
hub             : Linux 4.4.50-desktop-2.mga5 uhci_hcd|UHCI Host Controller [Hub|Unused|Full speed (or root) hub]
hub             : Linux 4.4.50-desktop-2.mga5 uhci_hcd|UHCI Host Controller [Hub|Unused|Full speed (or root) hub]
hub             : Linux 4.4.50-desktop-2.mga5 uhci_hcd|UHCI Host Controller [Hub|Unused|Full speed (or root) hub]
hub             : Linux 4.4.50-desktop-2.mga5 uhci_hcd|UHCI Host Controller [Hub|Unused|Full speed (or root) hub]
hub             : Linux 4.4.50-desktop-2.mga5 ehci_hcd|EHCI Host Controller [Hub|Unused|Full speed (or root) hub]
usb_storage     : Prolific Technology Inc.|Mass Storage Device [Mass Storage|SCSI|Bulk-Only]
usblp           : HP|OfficeJet 4650 series [Printer|Printer|Bidirectional]
hub             : Genesys Logic, Inc.|USB2.0 Hub [Hub|Unused|Full speed (or root) hub]
hub             : Linux 4.4.50-desktop-2.mga5 ehci_hcd|EHCI Host Controller [Hub|Unused|Full speed (or root) hub]
usb_storage     : Generic|Mass Storage Device [Mass Storage|SCSI|Bulk-Only]
hid_logitech    : Logitech USB Receiver
hid_logitech    : Logitech USB Receiver

CC: (none) => mageia

Comment 29 PC LX 2017-02-24 18:06:21 CET
The new x86_64 desktop kernel also works in VirtualBox without regressions. The DE is Plasma and run a bunch of programs without regressions.

$ uname -a
Linux vbox-mageia5 4.4.50-desktop-2.mga5 #1 SMP Thu Feb 23 21:21:14 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
$ lspcidrake 
unknown         : Intel Corporation|82801HM/HEM (ICH8M/ICH8M-E) SATA Controller [AHCI mode] [STORAGE_SATA] (rev: 02)
ehci_pci        : Intel Corporation|82801FB/FBM/FR/FW/FRW (ICH6 Family) USB2 EHCI Controller [SERIAL_USB]
i2c_piix4       : Intel Corporation|82371AB/EB/MB PIIX4 ACPI [BRIDGE_OTHER] (rev: 08)
ohci_pci        : Apple Inc.|KeyLargo/Intrepid USB [SERIAL_USB]
snd_hda_intel   : Intel Corporation|82801FB/FBM/FR/FW/FRW (ICH6 Family) High Definition Audio Controller [MULTIMEDIA_AUDIO_DEV] (rev: 01)
vboxguest       : InnoTek Systemberatung GmbH|VirtualBox Guest Service [SYSTEM_OTHER]
e1000           : Intel Corporation|82540EM Gigabit Ethernet Controller [NETWORK_ETHERNET] (rev: 02)
Card:VirtualBox virtual video card: InnoTek Systemberatung GmbH|VirtualBox Graphics Adapter [DISPLAY_VGA]
unknown         : Intel Corporation|82371SB PIIX3 ISA [Natoma/Triton II] [BRIDGE_ISA]
unknown         : Intel Corporation|440FX - 82441FX PMC [Natoma] [BRIDGE_HOST] (rev: 02)
hub             : Linux 4.4.50-desktop-2.mga5 ohci_hcd|OHCI PCI host controller [Hub|Unused|Full speed (or root) hub]
usbhid          : VirtualBox|USB Tablet [Human Interface Device|No Subclass|None]
hub             : Linux 4.4.50-desktop-2.mga5 ehci_hcd|EHCI Host Controller [Hub|Unused|Full speed (or root) hub]
hid_generic     : VirtualBox USB Tablet
Comment 30 James Kerr 2017-02-24 18:53:32 CET
On mga5-64 - packages

- cpupower-4.4.50-2.mga5.x86_64
- kernel-desktop-4.4.50-2.mga5-1-1.mga5.x86_64
- kernel-desktop-latest-4.4.50-2.mga5.x86_64
- virtualbox-kernel-4.4.50-desktop-2.mga5-5.1.10-12.mga5.x86_64
- virtualbox-kernel-desktop-latest-5.1.10-12.mga5.x86_64

System boots normally
$ uname -r
4.4.50-desktop-2.mga5

No regressions noted
vbox win7 and winxp VMs OK
 
OK for mga5-64 on this system:
CPU:  Quad core Intel Core i7-6700
Graphics: Intel HD Graphics 530
Comment 31 Dave Hodgins 2017-02-24 19:33:07 CET
My testing complete installing all kernel latest (no i586 on the x86-64 systems)
and testing that they boot to a working desktop. The devel latest packages were
also installed for the dkms modules. Tested in i586 and x86-64 vb guests and host
installs.

I'll wait another 8 hours or so, to see if others report regressions before
validating the update.
Comment 32 José Jorge 2017-02-24 20:14:00 CET
All is Ok :
32-bit desktop kernel on laptop Fujitsu Celeron 430M.
32-bit desktop kernel on laptop Dell Pentium M725.
64-bit desktop kernel on laptop Acer Celeron 530M.
64-bit server kernel on HP ProLiant ML350 G5 with Xeon 5410

CC: (none) => lists.jjorge

Comment 33 Len Lawrence 2017-02-24 20:25:09 CET
64bit MBR laptop with 4GB RAM
nvidia GeForce 8700M GT
Intel Core2 Duo T9300 2.5GHz
PRO/Wireless 3945 ABG

Installed all relevant packages and rebooted without incident.  
nvidia 340.101
wifi operations over the LAN
Common applications work well.
System suspends on lid closure and wakes up immediately on opening.
Comment 34 William Kenney 2017-02-24 21:55:03 CET
On real hardware, M5, KDE, 64-bit

initial install:
kernel-desktop-latest
virtualbox vboxadditions-kernel-desktop-latest dkms-virtualbox
virtualbox-guest-additions virtualbox-kernel-desktop-latest x11-driver-video-vboxvideo
kernel-desktop-devel-latest nvidia-current-kernel-desktop-latest

[root@localhost wilcal]# uname -a
Linux localhost 4.4.39-desktop-1.mga5 #1 SMP Fri Dec 16 18:43:46 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-desktop-latest
Package kernel-desktop-latest-4.4.39-1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox
Package virtualbox-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi vboxadditions-kernel-desktop-latest
Package vboxadditions-kernel-desktop-latest-5.1.10-3.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi dkms-virtualbox
Package dkms-virtualbox-5.1.10-1.1.mga5.noarch is already installed
[root@localhost wilcal]# urpmi virtualbox-guest-additions
Package virtualbox-guest-additions-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox-kernel-desktop-latest
Package virtualbox-kernel-desktop-latest-5.1.10-3.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi x11-driver-video-vboxvideo
Package x11-driver-video-vboxvideo-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi kernel-desktop-devel-latest
Package kernel-desktop-devel-latest-4.4.39-1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi nvidia-current-kernel-desktop-latest
Package nvidia-current-kernel-desktop-latest-352.79-10.mga5.nonfree.x86_64 is already installed
[wilcal@localhost ~]$ lspci -k
01:00.0 VGA compatible controller: NVIDIA Corporation GF108 [GeForce GT 440] (rev a1)
        Subsystem: Gigabyte Technology Co., Ltd Device 3518
        Kernel driver in use: nvidia
        Kernel modules: nvidiafb, nouveau, nvidia_drm, nvidia_current

M5.1 i586 Gnome Live-CD runs as a Vbox client.
Boots to a working desktop. Common apps work.
Screen sizes are correct.

install or check:
kernel-desktop-latest
virtualbox vboxadditions-kernel-desktop-latest dkms-virtualbox
virtualbox-guest-additions virtualbox-kernel-desktop-latest x11-driver-video-vboxvideo
kernel-desktop-devel-latest nvidia-current-kernel-desktop-latest
from updates_testing

Password: 
[root@localhost wilcal]# uname -a
Linux localhost 4.4.50-desktop-2.mga5 #1 SMP Thu Feb 23 21:21:14 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost wilcal]# urpmi kernel-desktop-latest
Package kernel-desktop-latest-4.4.50-2.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox
Package virtualbox-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi vboxadditions-kernel-desktop-latest
Package vboxadditions-kernel-desktop-latest-5.1.10-12.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi dkms-virtualbox
Package dkms-virtualbox-5.1.10-1.1.mga5.noarch is already installed
[root@localhost wilcal]# urpmi virtualbox-guest-additions
Package virtualbox-guest-additions-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi virtualbox-kernel-desktop-latest
Package virtualbox-kernel-desktop-latest-5.1.10-12.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi x11-driver-video-vboxvideo
Package x11-driver-video-vboxvideo-5.1.10-1.1.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi kernel-desktop-devel-latest
Package kernel-desktop-devel-latest-4.4.50-2.mga5.x86_64 is already installed
[root@localhost wilcal]# urpmi nvidia-current-kernel-desktop-latest
Package nvidia-current-kernel-desktop-latest-352.79-10.mga5.nonfree.x86_64 is already installed
[wilcal@localhost ~]$ lspci -k
01:00.0 VGA compatible controller: NVIDIA Corporation GF108 [GeForce GT 440] (rev a1)
        Subsystem: Gigabyte Technology Co., Ltd Device 3518
        Kernel driver in use: nvidia
        Kernel modules: nvidiafb, nouveau, nvidia_drm, nvidia_current

System boots to a working desktop. Common apps work.
Previously created M5.1 i586 Gnome Live-CD runs as a Vbox client.
M5.1 Gnome x86_64 Live-DVD runs as a Vbox client.
M5.1 x86_64 KDE Live-DVD runs, installs and updates as a Vbox client.

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)

CC: (none) => wilcal.int

Comment 35 Len Lawrence 2017-02-24 22:25:05 CET
x86_64 : UEFI : nvidia GTX 770 : Intel Core i7-4790K 4.00GHz

Removed several earlier kernels and upgraded from 4.4.50-desktop-1 to *-2.
Clean install.  Ran drakboot to update the bootloader.

Rebooted to Mate desktop - functioning as before.  Tested a few applications, sound and video working, bluetooth audio, live TV.  32bit virtualbox booted and working.  Remote login on vbox from host.  Celestia and Stellarium came up OK.  
Installed and configured Kstars.  Everything working perfectly.
Comment 36 Dave Hodgins 2017-02-25 02:48:19 CET
Validating the update

Keywords: (none) => validated_update
Whiteboard: advisory => advisory MGA5-64-OK MGA5-32-OK

Comment 37 Brian Rockwell 2017-02-25 05:41:40 CET
AMD Athlon X3

kernel-server-4.4.50-2.mga5-1-1.mga5.x86_64.rpm
virtualbox-kernel-4.4.50-server-2.mga5-5.1.10-12.mga5.x86_64.rpm

able to boot up, virtual box working with server edition.

All good
Comment 38 Mageia Robot 2017-02-25 09:30:06 CET
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0063.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.