Bug 526676 (CVE-2014-3610)

Summary:	Kernel: KVM: multiple vulnerabilities (CVE-2014-{3610,3611,3645,3646,3647,8369,8480,8481})
Product:	Gentoo Security	Reporter:	Richard Yao (RETIRED) <ryao>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	normal	CC:	kernel
Priority:	High	Keywords:	SECURITY
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Richard Yao (RETIRED) gentoo-dev

2014-10-24 19:17:02 UTC

The vulnerabilities are not on nist.gov yet, but they are on seclists.org:

http://seclists.org/oss-sec/2014/q4/438

CVE-2014-3610
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=854e8bb1aa06c578c2c9145fa6bfe3680ef63b23
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=8b3c3104c3f4f706e99365c3e0d2aa61b95f969f

CVE-2014-3611
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=2febc839133280d5a5e8e1179c94ea674489dae2

CVE-2014-3646
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=a642fc305053cc1c6e47e4f4df327895747ab485

CVE-2014-3645
  inadvertently fixed via
  http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bfd0a56b90005f8c8a004baf407ad90045c2b11e

CVE-2014-3647
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=234f3ce485d54017f15cf5e0699cff4100121601
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=d1442d85cc30ea75f7d399474ca738e0bc96f715

CVE-2014-8369
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=3d32e4dbe71374a6780eaf51d719d76f9a9bf22f

CVE-2014-8480
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=3f6f1480d86bf9fc16c160d803ab1d006e3058d5

CVE-2014-8481
  https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=a430c9166312e1aa3d80bce32374233bdbfeba32

Comment 1 Sean Amoss (RETIRED) gentoo-dev

2015-01-04 01:14:07 UTC


*** This bug has been marked as a duplicate of bug 525490 ***