RHSA-2015:0864: Important: kernel security and bug fix update

First published: Tue Apr 21 2015(Updated: )

The kernel packages contain the Linux kernel, the core of any Linux<br>operating system.<br><li> A flaw was found in the way seunshare, a utility for running executables</li> under a different security context, used the capng_lock functionality of<br>the libcap-ng library. The subsequent invocation of suid root binaries that<br>relied on the fact that the setuid() system call, among others, also sets<br>the saved set-user-ID when dropping the binaries' process privileges, could<br>allow a local, unprivileged user to potentially escalate their privileges<br>on the system. Note: the fix for this issue is the kernel part of the<br>overall fix, and introduces the PR_SET_NO_NEW_PRIVS functionality and the<br>related SELinux exec transitions support. (CVE-2014-3215, Important)<br><li> A use-after-free flaw was found in the way the Linux kernel's SCTP</li> implementation handled authentication key reference counting during INIT<br>collisions. A remote attacker could use this flaw to crash the system or,<br>potentially, escalate their privileges on the system. (CVE-2015-1421,<br>Important)<br><li> It was found that the Linux kernel's KVM implementation did not ensure</li> that the host CR4 control register value remained unchanged across VM<br>entries on the same virtual CPU. A local, unprivileged user could use this<br>flaw to cause a denial of service on the system. (CVE-2014-3690, Moderate)<br><li> An out-of-bounds memory access flaw was found in the syscall tracing</li> functionality of the Linux kernel's perf subsystem. A local, unprivileged<br>user could use this flaw to crash the system. (CVE-2014-7825, Moderate)<br><li> An out-of-bounds memory access flaw was found in the syscall tracing</li> functionality of the Linux kernel's ftrace subsystem. On a system with<br>ftrace syscall tracing enabled, a local, unprivileged user could use this<br>flaw to crash the system, or escalate their privileges. (CVE-2014-7826,<br>Moderate)<br><li> It was found that the Linux kernel memory resource controller's (memcg)</li> handling of OOM (out of memory) conditions could lead to deadlocks.<br>An attacker able to continuously spawn new processes within a single<br>memory-constrained cgroup during an OOM event could use this flaw to lock<br>up the system. (CVE-2014-8171, Moderate)<br><li> A race condition flaw was found in the way the Linux kernel keys</li> management subsystem performed key garbage collection. A local attacker<br>could attempt accessing a key while it was being garbage collected, which<br>would cause the system to crash. (CVE-2014-9529, Moderate)<br><li> A stack-based buffer overflow flaw was found in the TechnoTrend/Hauppauge</li> DEC USB device driver. A local user with write access to the corresponding<br>device could use this flaw to crash the kernel or, potentially, elevate<br>their privileges on the system. (CVE-2014-8884, Low)<br><li> An information leak flaw was found in the way the Linux kernel's ISO9660</li> file system implementation accessed data on an ISO9660 image with RockRidge<br>Extension Reference (ER) records. An attacker with physical access to the<br>system could use this flaw to disclose up to 255 bytes of kernel memory.<br>(CVE-2014-9584, Low)<br>Red Hat would like to thank Andy Lutomirski for reporting CVE-2014-3215<br>and CVE-2014-3690, Robert Święcki for reporting CVE-2014-7825 and<br>CVE-2014-7826, and Carl Henrik Lunde for reporting CVE-2014-9584. The<br>CVE-2015-1421 issue was discovered by Sun Baoliang of Red Hat.<br>This update also fixes several bugs. Documentation for these changes is<br>available from the Technical Notes document linked to in the References<br>section.<br>All kernel users are advised to upgrade to these updated packages, which<br>contain backported patches to correct these issues. The system must be<br>rebooted for this update to take effect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2015:0864
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• package-manager/redhat