The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.
Difference between revisions of "EGI CSIRT:Alerts/LinuxKernel-2014-07-04"
Jump to navigation
Jump to search
| Line 8: | Line 8: | ||
EGI CSIRT ADVISORY [EGI-ADV-20140625] | EGI CSIRT ADVISORY [EGI-ADV-20140625] | ||
Title: EGI SVG Advisory 'High' RISK - CVE-2014-3153 Linux kernel privilege | Title: EGI SVG Advisory 'High' RISK - CVE-2014-3153 Linux kernel privilege | ||
escalation vulnerability [EGI-ADV-20140704] | |||
Date: 2014-07-04 | Date: 2014-07-04 | ||
| Line 18: | Line 19: | ||
============ | ============ | ||
This vulnerability allows privilege escalation, including escalation to 'root' and the ability to crash the kernel. | This vulnerability allows privilege escalation, including escalation to 'root' and | ||
the ability to crash the kernel. | |||
Previously EGI CSIRT sent a 'heads up' about this as a potential 'Critical' risk. | Previously EGI CSIRT sent a 'heads up' about this as a potential 'Critical' risk. | ||
| Line 58: | Line 60: | ||
=============== | =============== | ||
Sites deploying RHEL6 and it's derivatives are recommended to update as soon as possible, if they have not done so already. | Sites deploying RHEL6 and it's derivatives are recommended to update as soon as possible, | ||
if they have not done so already. | |||
Note that if you updated after 19th June you should already have a fixed version of the kernel. | Note that if you updated after 19th June you should already have a fixed version of the kernel. | ||
| Line 65: | Line 68: | ||
====== | ====== | ||
This vulnerability was found by EGI by Leif Nixon. It had originally been reported to Google by a Pinkie Pie. | This vulnerability was found by EGI by Leif Nixon. | ||
It had originally been reported to Google by a Pinkie Pie. | |||
Revision as of 15:48, 4 July 2014
| EGI-CSIRT web site | EGI-CSIRT Public wiki | EGI-CSIRT Contacts | EGI-CSIRT Activities | EGI-CSIRT Private wiki |
** WHITE information - Unlimited distribution allowed **
** see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions **
EGI CSIRT ADVISORY [EGI-ADV-20140625]
Title: EGI SVG Advisory 'High' RISK - CVE-2014-3153 Linux kernel privilege
escalation vulnerability [EGI-ADV-20140704]
Date: 2014-07-04
Updated: <date yyyy-mm-dd>
URL: https://wiki.egi.eu/wiki/EGI_CSIRT:Alerts/LinuxKernel-2014-07-04
Introduction
============
This vulnerability allows privilege escalation, including escalation to 'root' and
the ability to crash the kernel.
Previously EGI CSIRT sent a 'heads up' about this as a potential 'Critical' risk.
However, no public exploit was made available so it has been assessed as 'High' risk
This has now been fixed in RHEL6 and SL6
RHEL5 and it's derivatives are not affected.
Risk category
=============
This issue has been assessed as 'High' risk by the EGI CSIRT team.
Affected software
=================
RHEL6 and its deriviatives.
Mitigation
==========
N/A.
Component installation information
==================================
Sites should see the appropriate SL6 or RHEL6 documentation for further information.
Recommendations
===============
Sites deploying RHEL6 and it's derivatives are recommended to update as soon as possible,
if they have not done so already.
Note that if you updated after 19th June you should already have a fixed version of the kernel.
Credit
======
This vulnerability was found by EGI by Leif Nixon.
It had originally been reported to Google by a Pinkie Pie.
References
==========
[R 1] http://seclists.org/oss-sec/2014/q2/467
[R 2] http://seclists.org/oss-sec/2014/q2/469
Timeline
========
Yyyy-mm-dd
2014-06-06 SVG and EGI CSIRT become aware of the vulnerability
2014-06-10 Discussed at the EGI IRTF meeting and decided it was likely to become
'critical' if a public exploit became available and a 'Heads up'
should be sent to sites.
2014-06-11 'Heads up' sent to sites
2014-06-19 Updated packages available in RHEL6
2014-06-19 Updated packages available in SL6
2014-06-25 Risk considered to 'High'
2014-07-04 Advisory to update sent to sites