Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 518108 (CVE-2014-5045) - <sys-kernel/openvz-sources-2.6.32.92.3: out-of-memory or use-after-free
Summary: <sys-kernel/openvz-sources-2.6.32.92.3: out-of-memory or use-after-free
Status: RESOLVED FIXED
Alias: CVE-2014-5045
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: http://secunia.com/advisories/60348/
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-25 15:53 UTC by Agostino Sarubbo
Modified: 2016-11-23 13:21 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-07-25 15:53:03 UTC 
From ${URL} :

Description

OpenVZ has issued an update for kernel. This fixes a vulnerability, which can be exploited by 
malicious, local users to cause a DoS (Denial of Service) or potentially gain escalated privileges.

The vulnerability is caused due to an error within the "mountpoint_last()" function (fs/namei.c) 
and can be exploited to cause an out-of-memory or use-after-free condition.


Solution:
Update kernel branch RHEL6 to 042stab092.3.

Provided and/or discovered by:
Vasily Averin, Parallels.

Original Advisory:
OpenVZ:
http://wiki.openvz.org/Download/kernel/rhel6/042stab092.3


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Maxim Koltsov (RETIRED) gentoo-dev 2014-07-27 16:10:45 UTC 
+*openvz-sources-2.6.32.92.3 (27 Jul 2014)
+
+  27 Jul 2014; Maxim Koltsov <maksbotan@gentoo.org>
+  +openvz-sources-2.6.32.92.3.ebuild:
+  Bump to new release, fized security bug #518108. Thanks to ago and slepnoga
+
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-23 01:06:36 UTC 
Newer version is already stable.

@ Security: Please vote!
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2016-11-23 13:21:20 UTC 
GLSA Vote: No