From: Alexei Sheplyakov Date: Fri, 28 Nov 2014 10:14:41 +0000 (+0200) Subject: Security update, RHSA-2014-1843 X-Git-Url: https://review.fuel-infra.org/gitweb?a=commitdiff_plain;h=b5eea5381bf6a2e0e5aa738395614bbac4db5114;p=packages%2Fcentos6%2Fkernel.git Security update, RHSA-2014-1843 Update to 2.6.32-504.1.3 (the latest upstream version at the time of writing). Fixes the following problems: * CVE-2014-3611: KVM: host kernel DoS due to a race condition in PIT emulation. A guest user who has access to PIT IO ports could use this flaw to crash the host. (impact: important, host DoS from a guest) * CVE-2014-3645, CVE-2014-3646: KVM: guest DoS by an unprivileged user due to the missing handling of the VM exits for invept and invvpid. (impact: moderate, guest DoS with certain Intel processors) * CVE-2014-3185: local DoS/privilege escalation due to a memory corruption in the USB ConnectTech WhiteHEAT serial driver (impact: moderate). * BZ#1148693: virtio-net: kernel was unable to boot with the mgr_rxbuf=off option specified * BZ#1149083: possible kernel panic when using one of the newer IPSec authentication header (AH) algorithms with Openswan. * BZ#1142570: possible DoS due to the race between PCI error recovery and ifup/ifdown commands in the tg3 driver. * BZ#1149578: kernel panic when an IPMI interface was removed using the hotmod scrpit. * BZ#1149580: possible kernel panic when adding an IPMI interface that was previously removed using the hotmod script. * BZ#1145193: GFS2 failed to unmount a sub-mounted GFS2 file system if its parent was also a GFS2 file system. Change-Id: Ia6c60a039ed4c9b35b76600a89935a907c1a1b21 Related-bug: #1395586 Related-bug: #1395607 --- diff --git a/genkey b/genkey index 8800542..8ded97d 100644 --- a/genkey +++ b/genkey @@ -3,6 +3,6 @@ Key-Type: DSA Key-Length: 2048 Preferences: SHA256 -Name-Real: Red Hat, Inc. +Name-Real: CentOS Name-Comment: Kernel Module GPG key %commit diff --git a/kernel.spec b/kernel.spec index 44eab60..635c5f7 100644 --- a/kernel.spec +++ b/kernel.spec @@ -6,6 +6,7 @@ Summary: The Linux kernel # and/or a kernel built from an rc or git snapshot, released_kernel should # be 0. %define released_kernel 1 +%define dist .el6 # Versions of various parts @@ -16,7 +17,7 @@ Summary: The Linux kernel # # % define buildid .local -%define distro_build 504 +%define distro_build 504.1.3 %define signmodules 1 # if patch fuzzy patch applying will be forbidden @@ -153,7 +154,7 @@ Summary: The Linux kernel %endif # The kernel tarball/base version -%define kversion 2.6.32-504.el6 +%define kversion 2.6.32-504.1.3.el6 %define make_target bzImage @@ -543,7 +544,7 @@ BuildConflicts: rhbuildsys(DiskFree) < 7Gb %define strip_cmd strip %endif -Source0: linux-2.6.32-504.el6.tar.bz2 +Source0: linux-2.6.32-504.1.3.el6.tar.bz2 Source1: Makefile.common @@ -1001,7 +1002,7 @@ EOF if [ -s %{SOURCE19} ]; then gpg --homedir . --no-default-keyring --keyring kernel.pub --import %{SOURCE19} fi -gpg --homedir . --export --keyring ./kernel.pub Red > extract.pub +gpg --homedir . --export --keyring ./kernel.pub CentOS > extract.pub gcc -o scripts/bin2c scripts/bin2c.c scripts/bin2c ksign_def_public_key __initdata crypto/signature/key.h %endif @@ -1738,6 +1739,26 @@ fi %endif %changelog +* Tue Nov 11 2014 Johnny Hughes [2.6.32-504.1.3.el6] +- Roll in CentOS Branding + +* Fri Oct 31 2014 Radomir Vrbovsky [2.6.32-504.1.3.el6] +- Revert: [net] revert "bridge: Set vlan_features to allow offloads on vlans" (Vlad Yasevich) [1144442 1121991] + +* Wed Oct 15 2014 Radomir Vrbovsky [2.6.32-504.1.2.el6] +- [x86] kvm: fix PIT timer race condition (mguzik) [1149592 1149593] {CVE-2014-3611} +- [x86] kvm: vmx: handle invept and invvpid vm exits gracefull (mguzik) [1144826 1144837 1144827 1144838] {CVE-2014-3646 CVE-2014-3645} + +* Fri Oct 10 2014 Radomir Vrbovsky [2.6.32-504.1.1.el6] +- [fs] call d_op->d_hash on last component of umount path (Abhijith Das) [1145193 1129712] +- [usb] serial: memory corruption flaw (Jacob Tanenbaum) [1141401 1141402] {CVE-2014-3185} +- [char] ipmi: Clear drvdata when interface is removed (Tony Camuso) [1149578 1135910] +- [char] ipmi: init shadow_ipmi_smi_handlers early in ipmi_si_intf (Tony Camuso) [1149580 1139464] +- [net] ipsec: update MAX_AH_AUTH_LEN to support sha512 (Herbert Xu) [1149083 1140103] +- [net] revert "bridge: Set vlan_features to allow offloads on vlans" (Vlad Yasevich) [1144442 1121991] +- [netdrv] virtio-net: fix big buffer receiving (Jason Wang) [1148693 1144073] +- [netdrv] tg3: prevent ifup/ifdown during PCI error recovery (Ivan Vecera) [1142570 1117009] + * Tue Sep 16 2014 Rafael Aquini [2.6.32-504.el6] - [netdrv] revert "cxgb4: set skb->rxhash" (Prarit Bhargava) [1140743] - [netdrv] revert "cxgb4: Use netif_set_real_num_rx/tx_queues()" (Prarit Bhargava) [1140743] diff --git a/linux-2.6.32-504.el6.tar.bz2 b/linux-2.6.32-504.1.3.el6.tar.bz2 similarity index 85% rename from linux-2.6.32-504.el6.tar.bz2 rename to linux-2.6.32-504.1.3.el6.tar.bz2 index c6508a2..60a1246 100644 Binary files a/linux-2.6.32-504.el6.tar.bz2 and b/linux-2.6.32-504.1.3.el6.tar.bz2 differ