——————————————————————————–
Fedora Update Notification
FEDORA-2014-3442
2014-03-05 03:55:11
——————————————————————————–
Name : kernel
Product : Fedora 20
Version : 3.13.5
Release : 202.fc20
URL : http://www.kernel.org/
Summary : The Linux kernel
Description :
The kernel package contains the Linux kernel (vmlinuz), the core of any
Linux operating system. The kernel handles the basic functions
of the operating system: memory allocation, process allocation, device
input and output, etc.
——————————————————————————–
Update Information:
This kernel update contains a number of CVE fixes, all users are encouraged to update.
——————————————————————————–
ChangeLog:
* Mon Mar 3 2014 Josh Boyer <jwboyer@fedoraproject.org> – 3.13.5-202
– CVE-2014-0100 net: inet frag race condition use-after-free (rhbz 1072026 1070618)
– CVE-2014-0101 sctp: null ptr deref when processing auth cookie_echo chunk (rhbz 1070209 1070705)
– Fix overly verbose audit logs (rhbz 1066064)
* Mon Mar 3 2014 Josh Boyer <jwboyer@fedoraproject.org> – 3.13.5-201
– CVE-2014-0049 kvm: mmio_fragments out-of-bounds access (rhbz 1062368 1071837)
– Fix atomic sched BUG in tty low_latency (rhbz 1065087)
* Fri Feb 28 2014 Josh Boyer <jwboyer@fedoraproject.org>
– CVE-2014-0102 keyctl_link can be used to cause an oops (rhbz 1071396)
* Fri Feb 28 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Drop alx phy reset patch that is already in 3.13
* Tue Feb 25 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Fix mounting issues on cifs (rhbz 1068862)
* Mon Feb 24 2014 Josh Boyer <jwboyer@fedoraproject.org> – 3.13.5-200
– CVE-2014-2039 s390: crash due to linkage stack instructions (rhbz 1067558 1068758)
– Fix lockdep issue in EHCI when using threaded IRQs (rhbz 1056170)
* Mon Feb 24 2014 Justin M. Forbes <jforbes@fedoraproject.org>
– Linux v3.13.5
* Fri Feb 21 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Fix WARN from e100 from Michele Baldessari (rhbz 994438)
* Thu Feb 20 2014 Peter Robinson <pbrobinson@fedoraproject.org> – 3.13.4-200
– Rebase i.MX6 Utilite to upstream version
* Thu Feb 20 2014 Justin M. Forbes <jforbes@fedoraproject.org>
– Linux v3.13.4
* Tue Feb 18 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Fix r8169 ethernet after suspend (rhbz 1054408)
– Enable INTEL_MIC drivers (rhbz 1064086)
* Fri Feb 14 2014 Josh Boyer <jwboyer@fedoraproject.org> – 3.13.3-201
– CVE-2014-0069 cifs: incorrect handling of bogus user pointers (rhbz 1064253 1062584)
* Thu Feb 13 2014 Justin M. Forbes <jforbes@fedoraproject.org> – 3.13.3-200
– Linux v3.13.3
* Wed Feb 12 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Add patch to fix list corruption from pinctrl (rhbz 1051918)
– Add IFA_FLAGS for IPv6 temporary addresses back (rhbz 1064430)
– Fix cgroup destroy oops (rhbz 1045755)
– Fix backtrace in amd_e400_idle (rhbz 1031296)
– CVE-2014-1874 SELinux: local denial of service (rhbz 1062356 1062507)
* Wed Feb 12 2014 Justin M. Forbes <jforbes@fedoraproject.org> – 3.13.2-200
– Packaging fixes for tmon and trace
* Tue Feb 11 2014 Peter Robinson <pbrobinson@fedoraproject.org>
– Update am33xx (BeagleBone) patch for 3.13
– Minor ARM updates
* Mon Feb 10 2014 Justin M. Forbes <jforbes@fedoraproject.org>
– Linux v3.13.2
– Fixes (rhbz 1062144)
* Thu Feb 6 2014 Justin M. Forbes <jforbes@fedoraproject.org> – 3.12.10-300
– Linux v3.12.10
* Wed Feb 5 2014 Justin M. Forbes <jforbes@fedoraproject.org>
– fix resume issues on Renesas chips in Samsung laptops (rhbz 950630)
* Wed Jan 29 2014 Justin M. Forbes <jforbes@fedoraproject.org> – 3.12.9-301
– ipv6 addrconf: revert /proc/net/if_inet6 ifa_flag format (rhbz 1056711)
* Tue Jan 28 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Add patch from Stanislaw Gruszka to fix ath9k BUG (rhbz 990955)
* Mon Jan 27 2014 Justin M. Forbes <jforbes@fedoraproject.org> – 3.12.9-300
– Backport new IPv6 address flag IFA_F_NOPREFIXROUTE and IFA_F_MANAGETEMPADDR (rhbz 1056711)
– Linux v3.12.9
– i915: remove pm_qos request on error (rhbz 1057533)
* Sun Jan 26 2014 Peter Robinson <pbrobinson@fedoraproject.org>
– Minor ARM config updates
– Disable highbank cpuidle driver
– Update CPU thermal scaling options for ARM
* Wed Jan 15 2014 Justin M. Forbes <jforbes@fedoraproject.org – 3.12.8-300
– Linux v3.12.8
* Wed Jan 15 2014 Josh Boyer <jwboyer@fedoraproject.org>
– CVE-2014-1446 hamradio/yam: information leak in ioctl (rhbz 1053620 1053647)
– CVE-2014-1438 x86: exceptions are not cleared in AMD FXSAVE workaround (rhbz 1053599 1052914)
* Tue Jan 14 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Fix k-m-e Provides to be explicit to only the package flavor (rhbz 1046246)
* Tue Jan 14 2014 Neil Horman <nhorman@redhat.com>
– Backport ipv6 route cache expiration fix (rhbz 1040128)
* Sun Jan 12 2014 Peter Robinson <pbrobinson@fedoraproject.org>
– Enable generic cpufreq-cpu0 driver on ARM
– Enable thermal userspace support for ARM
* Fri Jan 10 2014 Justin M. Forbes <jforbes@fedoraproject.org – 3.12.7-300
– Linux v3.12.7
* Wed Jan 8 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Backport support for ALPS Dolphin devices (rhbz 953211)
– Enable BCMA_DRIVER_GPIO by turning on GPIOLIB everywhere (rhbz 1021098)
* Mon Jan 6 2014 Josh Boyer <jwboyer@fedoraproject.org>
– Add support for BCM57786 devices to tg3 (rhbz 1044471)
– Fix use after free crash in KVM (rhbz 1047892)
– Fix oops in KVM with invalid root_hpa (rhbz 924916)
– CVE-2013-4579: ath9k_htc improper MAC update (rhbz 1032753 1033072)
* Sat Dec 28 2013 Peter Robinson <pbrobinson@fedoraproject.org>
– Update am33xx (BeagleBone) cpsw patch to upstream version
* Mon Dec 23 2013 Justin M. Forbes <jforbes@fedoraproject.org – 3.12.6-300
– Linux v3.12.6
* Fri Dec 20 2013 Josh Boyer <jwboyer@fedoraproject.org>
– Add patches to fix dummy gssd entry (rhbz 1037793)
* Wed Dec 18 2013 Josh Boyer <jwboyer@fedoraproject.org>
– Fix nowatchdog-on-virt.patch to actually work in KVM guests
* Tue Dec 17 2013 Josh Boyer <jwboyer@fedoraproject.org> – 3.12.5-302
– Add patch to avoid using queued trim on M500 SSD (rhbz 1024002)
* Mon Dec 16 2013 Josh Boyer <jwboyer@fedoraproject.org>
– Fix host lockup in bridge code when starting from virt guest (rhbz 1025770)
* Fri Dec 13 2013 Josh Boyer <jwboyer@fedoraproject.org> 3.12.5-301
– More keys fixes from upstream to fix keyctl_get_persisent crash (rhbz 1043033)
* Fri Dec 13 2013 Justin M. Forbes <jforbes@fedoraproject.org – 3.12.5-300
– Linux v3.12.5 rebase
* Thu Dec 12 2013 Josh Boyer <jwboyer@fedoraproject.org>
– CVE-2013-4587 kvm: out-of-bounds access (rhbz 1030986 1042071)
– CVE-2013-6376 kvm: BUG_ON in apic_cluster_id (rhbz 1033106 1042099)
– CVE-2013-6368 kvm: cross page vapic_addr access (rhbz 1032210 1042090)
– CVE-2013-6367 kvm: division by 0 in apic_get_tmcct (rhbz 1032207 1042081)
* Wed Dec 11 2013 Josh Boyer <jwboyer@fedoraproject.org>
– Add patches to support ETPS/2 Elantech touchpads (rhbz 1030802)
* Tue Dec 10 2013 Josh Boyer <jwboyer@fedoraproject.org>
– CVE-2013-XXXX net: memory leak in recvmsg (rhbz 1039845 1039874)
* Fri Dec 6 2013 Peter Robinson <pbrobinson@fedoraproject.org>
– Fix up ARM usb gadget config to make it useful
——————————————————————————–
References:
[ 1 ] Bug #1062368 – CVE-2014-0049 kernel: kvm: mmio_fragments out-of-the-bounds access
https://bugzilla.redhat.com/show_bug.cgi?id=1062368
[ 2 ] Bug #1070705 – CVE-2014-0101 kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk
https://bugzilla.redhat.com/show_bug.cgi?id=1070705
[ 3 ] Bug #1070618 – CVE-2014-0100 kernel: net: inet frag code race condition leading to user-after-free
https://bugzilla.redhat.com/show_bug.cgi?id=1070618
——————————————————————————–
This update can be installed with the “yum” update program. Use
su -c ‘yum update kernel’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce
