-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2007:078 http://www.mandriva.com/security/ _______________________________________________________________________ Package : kernel Date : April 4, 2007 Affected: 2007.0 _______________________________________________________________________ Problem Description: Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: When SELinux hooks are enabled, the kernel could allow a local user to cause a DoS (crash) via a malformed file stream that triggers a NULL pointer derefernece (CVE-2006-6056). Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges. (CVE-2007-0005) The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered a free of an incorrect pointer (CVE-2007-0772). A local user could read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump; a variant of CVE-2004-1073 (CVE-2007-0958). The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference. (CVE-2007-1000) Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet. (CVE-2007-1217) The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux kernel 2.6.17, and possibly other versions, allows local users to cause a denial of service (oops) by calling setsockopt with the IPV6_RTHDR option name and possibly a zero option length or invalid option value, which triggers a NULL pointer dereference. (CVE-2007-1388) net/ipv6/tcp_ipv6.c in Linux kernel 2.4 and 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double-free by opening a listeing IPv6 socket, attaching a flow label, and connecting to that socket. (CVE-2007-1592) The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and reboot to effect the fixes. In addition to these security fixes, other fixes have been included such as: - Suspend to disk speed improvements - Add nmi watchdog support for core2 - Add atl1 driver - Update KVM - Add acer_acpi - Update asus_acpi - Fix suspend on r8169, i8259A - Fix suspend when using ondemand governor - Add ide acpi support - Add suspend/resume support for sata_nv chipsets. - USB: Let USB-Serial option driver handle anydata devices (#29066) - USB: Add PlayStation 2 Trance Vibrator driver - Fix bogus delay loop in video/aty/mach64_ct.c - Add MCP61 support (#29398) - USB: fix floppy drive SAMSUNG SFD-321U/EP detected 8 times bug - Improve keyboard handling on Apple MacBooks - Add -latest patch - Workaround a possible binutils bug in smp alternatives - Add forcedeth support - Fix potential deadlock in driver core (USB hangs at boot time #24683) To update your kernel, please follow the directions located at: http://www.mandriva.com/en/security/kernelupdate _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6056 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0005 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0772 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0958 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1000 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1217 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1388 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1592 http://qa.mandriva.com/show_bug.cgi?id=29066 http://qa.mandriva.com/show_bug.cgi?id=29398 http://qa.mandriva.com/show_bug.cgi?id=24683 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.0: 84459fea8b1b4548fea8864694feb5e9 2007.0/i586/kernel-2.6.17.13mdv-1-1mdv2007.0.i586.rpm 4f2ae01ccf337c0c538c1e8d4b41bb84 2007.0/i586/kernel-doc-2.6.17.13mdv-1-1mdv2007.0.i586.rpm a432c277b621f02670692a83fd9cf4cd 2007.0/i586/kernel-enterprise-2.6.17.13mdv-1-1mdv2007.0.i586.rpm f1a62fd01f7b14aef9d55bfe57fb352c 2007.0/i586/kernel-legacy-2.6.17.13mdv-1-1mdv2007.0.i586.rpm 2a46a4009273f725e6f3ba66073d6186 2007.0/i586/kernel-source-2.6.17.13mdv-1-1mdv2007.0.i586.rpm b954cacf1af9775900c0180c66f731b2 2007.0/i586/kernel-source-stripped-2.6.17.13mdv-1-1mdv2007.0.i586.rpm 750b4e67fe1be3c87802297a7745ab1f 2007.0/i586/kernel-xen0-2.6.17.13mdv-1-1mdv2007.0.i586.rpm 2d28253eafc9c7dadb116e571dce00d5 2007.0/i586/kernel-xenU-2.6.17.13mdv-1-1mdv2007.0.i586.rpm 25f757eb5d57317dc91ddd37f37e8abb 2007.0/SRPMS/kernel-2.6.17.13mdv-1-1mdv2007.0.src.rpm Mandriva Linux 2007.0/X86_64: e1ca731fc7376199172238e5d92063a4 2007.0/x86_64/kernel-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm 8c02b29e58f8fbc6f90693ccc3e0855a 2007.0/x86_64/kernel-doc-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm f0d98a19885831fc0323c8d2dac615db 2007.0/x86_64/kernel-source-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm cc53d2abaf5aaa284cda0327516bc9c5 2007.0/x86_64/kernel-source-stripped-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm 77e4a2f83a8ce5b652b2847cac8467ce 2007.0/x86_64/kernel-xen0-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm bbe4780078b5ffd6cf9e47ae6920518f 2007.0/x86_64/kernel-xenU-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm 25f757eb5d57317dc91ddd37f37e8abb 2007.0/SRPMS/kernel-2.6.17.13mdv-1-1mdv2007.0.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGE/qkmqjQ0CJFipgRAhFJAKDxW476ewc4Ixk8MAhK0AQFW+RKCQCg4LsO PC34rll1d2d3D2uKqPw1h+o= =Fjgh -----END PGP SIGNATURE-----