[security-announce] Kernel (linux-yocto 3.14): Security Update

Sona Sarmadi sona.sarmadi at enea.com
Fri Dec 4 10:50:28 CET 2015


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

	Enea Linux Security Advisory

=========================================================
Product/package: kernel (linux-yocto 3.14)
Severity: High
CVE Names: CVE-2014-8159
Layer: meta-enea
=========================================================

This security update fixes a unprotected physical memory access
in the Linux kernel's Infiniband subsystem .

Description
===========
It was found that the Linux kernel's Infiniband subsystem did not
properly sanitize input parameters while registering memory regions
from user space via the (u)verbs API. A local user with access to a
/dev/infiniband/uverbsX device could use this flaw to crash the
system or, potentially, escalate their privileges on the system.

References:
===========
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8159

Upstream/original fix:
======================
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/pat
ch/?id=f40fc98d0b046ba153442b3bfd7887437f2ebd30


Correction for Enea Linux
=========================
http://git.enea.com/cgit/linux/meta-enea.git/patch/?id=5fb22e9981f17dc3a
9111abebb315595cb7d240c

How to get the latest patches
=============================
 - If you have already cloned meta-enea, update it to get new security
patches.

cd Enea-Linux-5.0/poky/meta-enea
git pull

 - If you have not yet cloned needed repositories, do it as described
below. (Security patches are fetched implicitly when cloning the repos).

mkdir Enea-Linux-5.0
git -C Enea-Linux-5.0 clone -b dizzy git://git.enea.com/linux/poky.git
POKY=Enea-Linux-5.0/poky
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-enea.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/\
meta-hierofalcon.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-linaro.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/\
meta-openembedded.git
git -C $POKY clone -b dizzy
git://git.enea.com/linux/meta-virtualization.git
git -C $POKY/meta-enea clone -b dizzy
git://git.enea.com/linux/meta-enea/meta-vt.git


If you have any questions regarding the security patches and security
updates please contact security at enea.com.


Enea Security Team
Sona Sarmadi
Mobile: +46 70 971 4475
www.enea.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJWYWHkAAoJEHc+9u9ocWoU2LgP/RZbRLVOMcEHhq6oi0nNt4VB
I1JgeFWycW7+zmUVwiyDPxPRC+byRy7unzC0dyGfzcx8YxbS9XRUy7RsFef13jUi
PwmZcE6ly//A/j8+Td0+SSsOlSSTLj/DKMisknhvjVncBuAOqwbA34UpwxknwfKy
htpBOZydjfcWdq9eVldBS4LDxzdjipElX2DDRVYia3ka4hi+1LYOPYcQlQ9ixtwm
rJNEuRbTnrOQKKIMdqSuYBsEy6OlcaH1Y0ZDsAeIarMX6ZWyQc3BKVPmVWEWXhX+
ycoanE4EXe5hU1pLRRTBePMGGaX2UCVSf7Tc8a33hxgkSLQYMLbVeLzJqBNUFIFD
hbzOZt+TghywAuDJiij9fN/pO7j1V+onauDqnvKFeF96l3tgRuj1THvuHzBn1r+f
BR73zxZXjJM2Hb9YoNN9DjVroVFn1ujvXLb3IfOzHdTQ7NbPoLTveBtA457f1DrM
6FfyUCP8tmKbG0VwyquDb0AM4MSlMHjr+EB1HRBMCpA2u/gj1A0gpm19bWq0v8pB
ymaesKkA9QA8RJHAaqroHrWfO+trdp/7N8PWzluXKWwZL4olIvwng2SN5qAjnhEQ
MIjM8/FPiX9skLDKGB/PM6rbSMx8W63HKp7Km7ZuPOQrRwZv/espGb6Rrv2HqzCG
b8f4CJABlsRbZaBFLgu8
=VBZZ
-----END PGP SIGNATURE-----



More information about the security-announce mailing list