Upcoming 4.18s - SECURITY ISSUES

Hi all,

I'm about to release 4.18s, please double check if I missed something. Please 
read below ...

P.S.: I miss some CAN numbers, the stuff is in but w/o CAN association, so if
      you know the CAN number, please tell me.


Changelog from v4.17s -> v4.18s
-------------------------------
o   added:    for whatever fscking reason: netdev-random was missing
o   added:    manual oom killer invocation via sysrq (this rulez :)
o   added:    CRC32 library backport (usbnet needs this for example)
o   added:    Netfilter addons:
              - Eggdrop, CONNMARK, Quake3, MMS, CuSeeMe, RPC, IPP2P,
              - IP Range, dstlimit, condition, account, OSF, U32,
              - address type, comment, CONNLIMIT, IPMARK, CLASSIFY, XOR
              - PPTP/GRE as an addon due to breakage of standard iptables.
o   added:    Linux ABI (Ian, here you are :-))
o   added:    introduce "make help"
o   added:    Kernel routing table monitoring (default off). Enable it
                via: 'echo 1 >/proc/sys/net/ipv4/route/route_monitor'
                and whenever a program adds/removes/changes a route
                it will be syslogged.
o   added:    3rdparty directory containing: AVM Fritz! PCI / DSL drivers
                with changes made to compile cleanly against 2.4-WOLK.
o   added:    Adaptec AACRAID (aacraid_new, alternate driver) v1.1.5
o   fixed:    CAN-2004-1016: Paul Starzetz discovered a buffer overflow
                vulnerability in the "__scm_send" function which handles
                the sending of UDP network packets. A wrong validity check
                of the cmsghdr structure allowed a local attacker to modify
                kernel memory, thus causing an endless loop (Denial of
                Service) or possibly even root privilege escalation.
o   fixed:    CAN-2004-1056: Thomas Hellstroem discovered a Denial of Service
                vulnerability in the Direct Rendering Manager (DRM) drivers.
                Due to an insufficient DMA lock checking, any authorized
                client could send arbitrary values to the video card, which
                could cause an X server crash or modification of the video
                output.
o   fixed:    CAN-2004-1235: Paul Starzetz: sys_uselib() race vulnerability
o   fixed:    CAN-2004-1068: A missing serialization flaw in
                unix_dgram_recvmsg was discovered. A local user could
                potentially make use of a race condition in order to
                gain privileges.
o   fixed:    CAN-2004-0883, CAN-2004-0949: smbfs: client overflow. There
                are two bugs in the handling of SMB responses that result
                in remote kernel overflows. Due to the nature of the bugs
                both seem to be very hard to exploit (in the sense of
                remote code execution or local privilege escalation) but
                are trivial remote kernel crashes.
o   fixed:    CAN-2004-1074: Handcrafted a.out binaries could be used to
                trigger a local denial of service condition in Linux kernels,
                allowing a local attacker to render the system unusable.
o   fixed:    CAN-2004-0814: tty/ldisc locking (backport from 2.6)
o   fixed:    random poolsize sysctl
o   fixed:    moxa serial bound checking issue
o   fixed:    warn if mmap_sem is not locked in do_brk
o   fixed:    RLIMIT_MEMLOCK issue
o   fixed:    binfmt_elf: exec with huge bss
o   fixed:    binfmt_elf: return error codes and early corrupt
                binary detection
o   fixed:    procfs enhanced error reporting
o   fixed:    sysctl: block bogus argument earlier
o   fixed:    stronger (paranoic) mremap argument checking
o   fixed:    oops in locking code
o   fixed:    check for zero program header on load_elf_interp()
o   fixed:    leaking IP options
o   fixed:    make sure VC resizing fits in s16
o   fixed:    UDP: Select handling of bad checksums.
o   fixed:    isdn: SMP deadlocks in AVM C2/C4 driver
o   fixed:    RMAP: some more tweakings for braindead rmap VM. It's almost
                perfect now. We still need to fix some things, but we are
                almost there :) - Thanks to Rik an Larry for their support.
o   fixed:    compiler warning in include/asm-generic/rmap.h
o   fixed:    assembler compiler warnings like:
                {standard input}: Assembler messages:
                {standard input}:1014: Warning: indirect lcall without `*'
                Holy shit, I can't see that any longer ;)
o   fixed:    make NF_HIPAC work with latest Netfilter
o   fixed:    unresolved symbol llc_oui in net/sched/sch_atm.o
o   fixed:    kdb: another kdb vs. rmap unresolved symbol error
o   fixed:    IDE modular build
o   fixed:    task name handling in proc fs
o   fixed:    RAID1 error handling locking
o   fixed:    some compiler warnings in fs/proc/kconfig.c
o   fixed:    jfs: race in jfs_commit_inode
o   fixed:    tmpfs: shmem_file_write return value
o   fixed:    tmpfs: stop negative dentries
o   fixed:    ext3fs: an oops which occured when using rmmdir(1)
o   fixed:    compile error in fs/binfmt_elf.c when PAGEEXEC is used.
o   fixed:    sym53c8xx_2 error handler
o   fixed:    sym53c8xx_2 sniff inquiry
o   fixed:    sym53c8xx_2 Ultra 160 requires LVD
o   fixed:    make SCSI error handler preserve data transfer residual
o   fixed:    scsi_unjam_host: Miscount of number of failed commands
o   fixed:    race condition in sg.c
o   updated:  i2c v2.9.0 Final
o   updated:  lmsensors v2.9.0 Final
o   updated:  Intel Software RAID Driver (iswraid): ICH6R RAID mode support
o   updated:  libata (S-ATA support via SCSI layer, up to 2.4.29-rc1)
o   updated:  nForce Ethernet v0.30
o   updated:  Loop-AES v2.2d
o   updated:  PPP Microsoft encryption/compression (MPPE/MPPC) v1.1
o   updated:  DRBD v0.7.5
o   updated:  HostAP driver v0.2.5
o   updated:  Intel PRO/Wireless 2100 (IPW2100) v1.0.1
o   updated:  Netfilter code (up to 2.4.28)
o   updated:  QoS code (up to 2.4.28)
o   updated:  Netfilter addons
o   updated:  Broadcom Tigon3 (tg3) v3.14
o   updated:  SysKonnect SK-98xx v7.09
o   updated:  SCSI: Qlogic QLA 1280 v3.23.37.1
o   updated:  grsecurity v2.1.0 as an replacement patch you have to apply
                manually to use v2.1.0 instead of v1.9.15. Please use
                gradm2 from ./gradm2 directory and make sure, /dev/grsec
                has minor number 12 instead of 10.
o   updated:  Intel/ICP RAID Controller support v3.04
o   updated:  CryptoAPI (up to 2.4.28)
o   updated:  Intel Software RAID Driver (iswraid) v0.1.4.3
o   updated:  Intel e1000 v5.6.10.1-k1
o   updated:  Openswan v1.0.8
o   changed:  get_user_pages: BUG_ON to WARN_ON
o   changed:  Wireless LAN menu structure (menuconfig|xconfig)

-- 
Kind regards
        Marc-Christian Petersen

http://sourceforge.net/projects/wolk

PGP/GnuPG Key: 1024D/569DE2E3DB441A16
Fingerprint:  3469 0CF8 CA7E 0042 7824 080A 569D E2E3 DB44 1A16
Key available at http://pgp.mit.edu. Encrypted e-mail preferred


-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
WOLK - Working Overloaded Linux Kernel
[email protected]
https://lists.sourceforge.net/lists/listinfo/wolk-devel