There is now a kernel-2.6.38.8-10.mga1 to validate Advisory: This update addresses the following CVEs: * CVE-2011-4622 KVM: User space may create the PIT and forgets about setting up the irqchips. In that case, firing PIT IRQs will crash the host. * CVE-2012-0038 Commit ef14f0c1578dce4b688726eb2603e50b62d6665a ('xfs: use generic Posix ACL code') in 2.2.6.32-rc1 introduced a n integer overflow in the ACL handling code, which could further lead to heap-based buffer overflow via a crafted filesystem. * CVE-2012-0044 There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if userspace passes in a large num_clips. The call to kmalloc would allocate a small buffer, and the call to fb->funcs->dirty may result in a memory corruption. * CVE-2012-0207 Linux IGMP Remote Denial Of Service. Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP behavior on v3 query during v2-compatibility mode') added in 2.6.36-rc8 added yet another case for query parsing, which can result in max_delay = 0. NOTE! The 2.6.38 series kernels in Mageia 1 are not affected by CVE-2012-0056 ('kernel: proc: /proc/<pid>/mem mem_write insufficient permission checking') as the commit introducing the security issue was added in 2.6.39-rc1 Other fixes in this release: * ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range() * dvb_frontend: fix race condition in stopping/starting frontend (reported by coling)
Blocks: (none) => 4161
No POC's that I can find
Work fine on both i586 and x86_64 installation of Mageia1.
CC: (none) => pham182b
There is a POC at http://www.dis9.com/cve-2012-0056-mempodipper-a-linux-local-root-exploit.html however it doesn't work on mageia du to su having ... readelf -h /bin/su|grep Type Type: DYN (Shared object file)
CC: (none) => davidwhodgins
Testing complete on i586 for the srpm kernel-2.6.38.8-10.mga1.src.rpm All 5 of the i586 kernels booted, including compiling dkms modules, starting kde with sound etc.
mempodipper is for the CVE which started with 2.6.39-rc1 so we just missed it fortunately! It's good that that's been verified now though. Testing x86_64 No errors so far.
Given that exploits for this bug are now in the wild according to http://linux.slashdot.org/story/12/01/25/2137243/exploits-emerge-for-linux-privilege-escalation-flaw?utm_source=rss1.0moreanon&utm_medium=feed and that no problems have been found, I'll go ahead and validate this update. Could someone from the sysadmin team push the srpm kernel-2.6.38.8-10.mga1.src.rpm from Core Updates Testing to Core Updates. Advisory: This kernel security update addresses the following CVEs: * CVE-2011-4622 KVM: User space may create the PIT and forgets about setting up the irqchips. In that case, firing PIT IRQs will crash the host. * CVE-2012-0038 Commit ef14f0c1578dce4b688726eb2603e50b62d6665a ('xfs: use generic Posix ACL code') in 2.2.6.32-rc1 introduced a n integer overflow in the ACL handling code, which could further lead to heap-based buffer overflow via a crafted filesystem. * CVE-2012-0044 There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if userspace passes in a large num_clips. The call to kmalloc would allocate a small buffer, and the call to fb->funcs->dirty may result in a memory corruption. * CVE-2012-0207 Linux IGMP Remote Denial Of Service. Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP behavior on v3 query during v2-compatibility mode') added in 2.6.36-rc8 added yet another case for query parsing, which can result in max_delay = 0. NOTE! The 2.6.38 series kernels in Mageia 1 are not affected by CVE-2012-0056 ('kernel: proc: /proc/<pid>/mem mem_write insufficient permission checking') as the commit introducing the security issue was added in 2.6.39-rc1 Other fixes in this release: * ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range() * dvb_frontend: fix race condition in stopping/starting frontend (reported by coling) https://bugs.mageia.org/show_bug.cgi?id=4281
Keywords: (none) => Security, validated_updateCC: (none) => sysadmin-bugs
update pushed.
Status: NEW => RESOLVEDResolution: (none) => FIXED