A flaw was found in NFS in the Linux Kernel. An attacker who is able to mount an exported NFS filesystem is able to trigger a null pointer dereference by an invalid NFS sequence.
This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
Upstream fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01310bb7c9c98752cc763b36532fab028e0f8f81
A flaw was found in the way the xfsda3fixhashpath() function of the Linux kernel's XFS file system implementation ordered directory hashes under certain conditions. A local attacker could use this flaw to corrupt the file system by creating directories, potentially resulting in kernel panic.
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c88547a8119e3b581318ab65e9b72f27f23e641d
Reproducer:
http://oss.sgi.com/cgi-bin/gitweb.cgi?p=xfs/cmds/xfstests.git;a=blob;f=src/dirhashcollide.c;h=55cec872d5061ac2ca0f56d1f11e6bf349d5bb97;hb=947ee8bd4b59770534297572b14c695e9c6e001e
References:
http://seclists.org/oss-sec/2014/q4/28 http://marc.info/?l=linux-xfs&m=139590613002926&w=2
Condor is a specialized workload management system for compute-intensivejobs. It provides a job queuing mechanism, scheduling policy, priorityscheme, and resource monitoring and management.A flaw was found in the way Condor managed jobs. This could allow a userthat is authorized to submit jobs into Condor to queue a job as if it weresubmitted by a different local user, potentially leading to unauthorizedaccess to that user's account. (CVE-2009-4133)Note: Condor will not run jobs as root; therefore, this flaw cannot lead toa compromise of the root user account.All Red Hat Enterprise MRG 1.2 users are advised to upgrade to theseupdated packages, which contain a backported patch to correct this issue.Condor must be restarted for the update to take effect.
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc//fd/ pathname.
Quoting from the upstream commit: Almost all r128's private ioctls require that the CCE state has already been initialised. However, most do not test that this has been done, and will proceed to dereference a null pointer. This may result in a security vulnerability, since some ioctls are unprivileged.
This adds a macro for the common initialisation test and changes all ioctl implementations that require prior initialisation to use that macro.
Also, r128doinitcce() does not test that the CCE state has not been initialised already. Repeated initialisation may lead to a crash or resource leak. This adds that test.
http://git.kernel.org/linus/7dc482dfeeeefcfd000d4271c4626937406756d7
Other references: http://secunia.com/advisories/36707/