Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP behavior on v3 query during v2-compatibility mode') added yet another case for query parsing, which can result in maxdelay = 0. Substitute a value of 1, as in the usual v3 case.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654876

code added in 2.6.36-rc8.

Upstream commit: http://git.kernel.org/linus/a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27

Acknowledgements:

Red Hat would like to thank Simon McVittie for reporting this issue.

A flaw was found in the way Linux kernel's floppy driver treated userspace provided data in certain error code path while processing FDRAWCMD ioctl command. An local user with write access to /dev/fdX could use this flaw to kfree() arbitrary data. (CVE-2014-1737)

It was found that Linux kernel's floppy driver leaked internal kernel memory addresses to userspace during processing of FDRAWCMD ioctl command. An local user with write access to /dev/fdX could use this flaw to get information about kernel heap arrangment. (CVE-2014-1738)

An local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.

Acknowledgements:

Red Hat would like to thank Matthew Daley for reporting these issues.