Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 504724 (CVE-2013-6367) - <sys-kernel/openvz-sources-2.6.32.85.17: multiple vulnerabilities (CVE-2013-{2141,4470,6367,6368})
Summary: <sys-kernel/openvz-sources-2.6.32.85.17: multiple vulnerabilities (CVE-2013-{...
Status: RESOLVED FIXED
Alias: CVE-2013-6367
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: https://secunia.com/advisories/57426/
Whiteboard: B1 [noglsa]
Keywords:
: 501594 (view as bug list)
Depends on:
Blocks:
 
Reported: 2014-03-15 15:36 UTC by Agostino Sarubbo
Modified: 2014-04-07 08:52 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-03-15 15:36:41 UTC
From ${URL} :

Description

OpenVZ has issued an update for kernel. This fixes multiple vulnerabilities, which can be exploited 
by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service) and by 
malicious, local users to gain escalated privileges.

For more information:
SA55348
SA56020 (#2)


Solution:
Update kernel branch RHEL6 to 042stab085.17.

Original Advisory:
OpenVZ:
http://wiki.openvz.org/Download/kernel/rhel6/042stab085.17


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Andreis Vinogradovs ( slepnoga ) 2014-03-17 21:12:59 UTC
*openvz-sources-2.6.32.85.17 (15 Mar 2014)

  15 Mar 2014; Maxim Koltsov <maksbotan@gentoo.org>
  +openvz-sources-2.6.32.85.17.ebuild:
  Bump to 2.6.32.85.17, thanks to slepnoga.
Comment 2 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2014-03-17 21:14:35 UTC
(In reply to Andreis Vinogradovs ( slepnoga ) from comment #1)
> *openvz-sources-2.6.32.85.17 (15 Mar 2014)
> 
>   15 Mar 2014; Maxim Koltsov <maksbotan@gentoo.org>
>   +openvz-sources-2.6.32.85.17.ebuild:
>   Bump to 2.6.32.85.17, thanks to slepnoga.

ready to go stable?
Comment 3 Andreis Vinogradovs ( slepnoga ) 2014-03-17 21:20:24 UTC
(In reply to Mikle Kolyada from comment #2)
> (In reply to Andreis Vinogradovs ( slepnoga ) from comment #1)
> > *openvz-sources-2.6.32.85.17 (15 Mar 2014)
> > 
> >   15 Mar 2014; Maxim Koltsov <maksbotan@gentoo.org>
> >   +openvz-sources-2.6.32.85.17.ebuild:
> >   Bump to 2.6.32.85.17, thanks to slepnoga.
> 
> ready to go stable?

Yes, please stabilize sys-kernel/openvz-sources-2.6.32.85.17 on amd64 and x86 ASAP. 
After stabilization, please remove old ebuild.

P.S Please add pva@ in CC.
Comment 4 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2014-03-18 11:21:05 UTC
Arches, please test and mark stable:

=sys-kernel/openvz-sources-2.6.32.85.17 

target KEYWORDS="amd64 x86"
Comment 5 Sergey Popov gentoo-dev 2014-03-19 06:07:36 UTC
*** Bug 501594 has been marked as a duplicate of this bug. ***
Comment 6 Joakim 2014-03-21 11:56:24 UTC
# make && make modules_install
...
  CC      crypto/signature/ksign-publickey.o
crypto/signature/ksign-publickey.c:2:17: fatal error: key.h: No such file or directory
 #include "key.h"
                 ^
compilation terminated.
scripts/Makefile.build:229: recipe for target 'crypto/signature/ksign-publickey.o' failed
make[2]: *** [crypto/signature/ksign-publickey.o] Error 1
scripts/Makefile.build:365: recipe for target 'crypto/signature' failed
make[1]: *** [crypto/signature] Error 2
Makefile:917: recipe for target 'crypto' failed
make: *** [crypto] Error 2

This is after a "make oldconfig" from 2.6.32.84.26,  using the settings suggested in upstreams conf file. Almost appears as if a file was missing?
Comment 7 Agostino Sarubbo gentoo-dev 2014-03-21 13:44:38 UTC
(In reply to Joakim from comment #6)
> # make && make modules_install
> ...
>   CC      crypto/signature/ksign-publickey.o
> crypto/signature/ksign-publickey.c:2:17: fatal error: key.h: No such file or
> directory
>  #include "key.h"
>                  ^
> compilation terminated.
> scripts/Makefile.build:229: recipe for target
> 'crypto/signature/ksign-publickey.o' failed
> make[2]: *** [crypto/signature/ksign-publickey.o] Error 1
> scripts/Makefile.build:365: recipe for target 'crypto/signature' failed
> make[1]: *** [crypto/signature] Error 2
> Makefile:917: recipe for target 'crypto' failed
> make: *** [crypto] Error 2
> 
> This is after a "make oldconfig" from 2.6.32.84.26,  using the settings
> suggested in upstreams conf file. Almost appears as if a file was missing?

Please open a new bug.
Comment 8 Andreis Vinogradovs ( slepnoga ) 2014-03-27 07:40:20 UTC
(In reply to Joakim from comment #6)
> # make && make modules_install
> ...
>   CC      crypto/signature/ksign-publickey.o
> crypto/signature/ksign-publickey.c:2:17: fatal error: key.h: No such file or
> directory
>  #include "key.h"
>                  ^
> compilation terminated.
> scripts/Makefile.build:229: recipe for target
> 'crypto/signature/ksign-publickey.o' failed
> make[2]: *** [crypto/signature/ksign-publickey.o] Error 1
> scripts/Makefile.build:365: recipe for target 'crypto/signature' failed
> make[1]: *** [crypto/signature] Error 2
> Makefile:917: recipe for target 'crypto' failed
> make: *** [crypto] Error 2
> 
> This is after a "make oldconfig" from 2.6.32.84.26,  using the settings
> suggested in upstreams conf file. Almost appears as if a file was missing?

Yes, it's (openvz upstream) config bug. Please disable "module signing" feature.


http://foxpa.ws/2012/08/27/ksign-publickey-c217-error-key-h-no-such-file-or-directory/
Comment 9 Agostino Sarubbo gentoo-dev 2014-03-27 14:11:05 UTC
(In reply to Andreis Vinogradovs ( slepnoga ) from comment #3)
> Yes, please stabilize sys-kernel/openvz-sources-2.6.32.85.17 on amd64 and
> x86 ASAP. 
> After stabilization, please remove old ebuild.
> 
> P.S Please add pva@ in CC.

We do not have the proper environment to really test it. So if pva is not around to do it, we can just trust and commit.
Comment 10 Agostino Sarubbo gentoo-dev 2014-03-28 18:33:00 UTC
amd64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2014-03-28 18:33:12 UTC
x86 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 12 Alexander Vershilov (RETIRED) gentoo-dev 2014-04-02 09:54:11 UTC
unstable versions are cleared up, stable versions <sys-kernel/openvz-sources-2.6.32.85.17 are masked.
Comment 13 Sergey Popov gentoo-dev 2014-04-07 08:52:32 UTC
Cleanup was done, no GLSA for kernel packages. Thanks guys, closing