Package name
kernel
Date
2007-04-04
Advisory ID
MDKSA-2007:078
Affected versions
2007.0 x86_64 , 2007.0 i586

Problem description

Some vulnerabilities were discovered and corrected in the Linux
2.6 kernel:

When SELinux hooks are enabled, the kernel could allow a local user
to cause a DoS (crash) via a malformed file stream that triggers a
NULL pointer derefernece (CVE-2006-6056).

Multiple buffer overflows in the (1) read and (2) write handlers in
the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3
allow local users to gain privileges. (CVE-2007-0005)

The Linux kernel version 2.6.13 to 2.6.20.1 allowed a remote attacker to
cause a DoS (oops) via a crafted NFSACL2 ACCESS request that triggered
a free of an incorrect pointer (CVE-2007-0772).

A local user could read unreadable binaries by using the interpreter
(PT_INTERP) functionality and triggering a core dump; a variant of
CVE-2004-1073 (CVE-2007-0958).

The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the
Linux kernel before 2.6.20.2 allows local users to read arbitrary
kernel memory via certain getsockopt calls that trigger a NULL
dereference. (CVE-2007-1000)

Buffer overflow in the bufprint function in capiutil.c in libcapi,
as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local
users to cause a denial of service (crash) and possibly gain privileges
via a crafted CAPI packet. (CVE-2007-1217)

The do_ipv6_setsockopt function in net/ipv6/ipv6_sockglue.c in Linux
kernel 2.6.17, and possibly other versions, allows local users to cause
a denial of service (oops) by calling setsockopt with the IPV6_RTHDR
option name and possibly a zero option length or invalid option value,
which triggers a NULL pointer dereference. (CVE-2007-1388)

net/ipv6/tcp_ipv6.c in Linux kernel 2.4 and 2.6.x up to 2.6.21-rc3
inadvertently copies the ipv6_fl_socklist from a listening TCP socket
to child sockets, which allows local users to cause a denial of service
(OOPS) or double-free by opening a listeing IPv6 socket, attaching a
flow label, and connecting to that socket. (CVE-2007-1592)

The provided packages are patched to fix these vulnerabilities.
All users are encouraged to upgrade to these updated kernels immediately
and reboot to effect the fixes.

In addition to these security fixes, other fixes have been included
such as:

- Suspend to disk speed improvements
- Add nmi watchdog support for core2
- Add atl1 driver
- Update KVM
- Add acer_acpi
- Update asus_acpi
- Fix suspend on r8169, i8259A
- Fix suspend when using ondemand governor
- Add ide acpi support
- Add suspend/resume support for sata_nv chipsets.
- USB: Let USB-Serial option driver handle anydata devices (#29066)
- USB: Add PlayStation 2 Trance Vibrator driver
- Fix bogus delay loop in video/aty/mach64_ct.c
- Add MCP61 support (#29398)
- USB: fix floppy drive SAMSUNG SFD-321U/EP detected 8 times bug
- Improve keyboard handling on Apple MacBooks
- Add -latest patch
- Workaround a possible binutils bug in smp alternatives
- Add forcedeth support
- Fix potential deadlock in driver core (USB hangs at boot time
#24683)

To update your kernel, please follow the directions located at:

http://www.mandriva.com/en/security/kernelupdate

Updated packages

2007.0 x86_64

 e1ca731fc7376199172238e5d92063a4  2007.0/x86_64/kernel-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 8c02b29e58f8fbc6f90693ccc3e0855a  2007.0/x86_64/kernel-doc-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 f0d98a19885831fc0323c8d2dac615db  2007.0/x86_64/kernel-source-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 cc53d2abaf5aaa284cda0327516bc9c5  2007.0/x86_64/kernel-source-stripped-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 77e4a2f83a8ce5b652b2847cac8467ce  2007.0/x86_64/kernel-xen0-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm
 bbe4780078b5ffd6cf9e47ae6920518f  2007.0/x86_64/kernel-xenU-2.6.17.13mdv-1-1mdv2007.0.x86_64.rpm 
 25f757eb5d57317dc91ddd37f37e8abb  2007.0/SRPMS/kernel-2.6.17.13mdv-1-1mdv2007.0.src.rpm

2007.0 i586

 84459fea8b1b4548fea8864694feb5e9  2007.0/i586/kernel-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 4f2ae01ccf337c0c538c1e8d4b41bb84  2007.0/i586/kernel-doc-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 a432c277b621f02670692a83fd9cf4cd  2007.0/i586/kernel-enterprise-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 f1a62fd01f7b14aef9d55bfe57fb352c  2007.0/i586/kernel-legacy-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 2a46a4009273f725e6f3ba66073d6186  2007.0/i586/kernel-source-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 b954cacf1af9775900c0180c66f731b2  2007.0/i586/kernel-source-stripped-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 750b4e67fe1be3c87802297a7745ab1f  2007.0/i586/kernel-xen0-2.6.17.13mdv-1-1mdv2007.0.i586.rpm
 2d28253eafc9c7dadb116e571dce00d5  2007.0/i586/kernel-xenU-2.6.17.13mdv-1-1mdv2007.0.i586.rpm 
 25f757eb5d57317dc91ddd37f37e8abb  2007.0/SRPMS/kernel-2.6.17.13mdv-1-1mdv2007.0.src.rpm

References