(RHSA-2014:1025) Important: kernel security and bug fix update

2014-08-06T04:00:00
ID RHSA-2014:1025
Type redhat
Reporter RedHat
Modified 2015-04-24T14:17:06

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

  • A flaw was found in the way the pppol2tp_setsockopt() and pppol2tp_getsockopt() functions in the Linux kernel's PPP over L2TP implementation handled requests with a non-SOL_PPPOL2TP socket option level. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-4943, Important)

Red Hat would like to thank Sasha Levin for reporting this issue.

This update also fixes the following bug:

  • When a device was registered to a bus, a race condition could occur between the device being added to the list of devices of the bus and binding the device to a driver. As a result, the device could already be bound to a driver which led to a warning and incorrect reference counting, and consequently to a kernel panic on device removal. To avoid the race condition, this update adds a check to identify an already bound device. (BZ#1114409)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.