Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 513084 - <sys-kernel/openvz-sources-2.6.32.90.3: multiple vulnerabilities (CVE-2014-3153)
Summary: <sys-kernel/openvz-sources-2.6.32.90.3: multiple vulnerabilities (CVE-2014-3153)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://secunia.com/advisories/59123/
Whiteboard: B1 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-06-13 09:28 UTC by Agostino Sarubbo
Modified: 2014-08-10 21:53 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-06-13 09:28:05 UTC 
From ${URL} :

Description

OpenVZ has issued an update for kernel. This fixes a vulnerability, which can be exploited by malicious, local users to gain escalated privileges.

For more information:
SA59029


Solution:
Update kernel branch RHEL6 to 042stab090.3.

Original Advisory:
http://wiki.openvz.org/Download/kernel/rhel6/042stab090.3
Comment 1 Peter Volkov (RETIRED) gentoo-dev 2014-06-17 06:06:42 UTC 
+  17 Jun 2014; Peter Volkov <pva@gentoo.org>
+  -openvz-sources-2.6.32.85.20.ebuild, -openvz-sources-2.6.32.88.4.ebuild,
+  -openvz-sources-2.6.32.90.2.ebuild, openvz-sources-2.6.32.90.3.ebuild:
+  x86/amd64 stable, security bug #508010 and bug #513084 wrt Andreis
+  Vinogradovs ( slepnoga ) and Agostino Sarubbo. Drop old.
Comment 2 Sergey Popov gentoo-dev 2014-06-19 06:51:12 UTC 
Thanks, guys

Kernel package, thus - noglsa
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2014-08-10 21:53:49 UTC 
CVE-2014-3153 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3153):
  The futex_requeue function in kernel/futex.c in the Linux kernel through
  3.14.5 does not ensure that calls have two different futex addresses, which
  allows local users to gain privileges via a crafted FUTEX_REQUEUE command
  that facilitates unsafe waiter modification.