[LU-9143] kernel update [RHEL7.3 3.10.0-514.6.2.el7]

• Status: Resolved
• Project: Lustre
• Type: Bug
• Priority: Minor
• Reporter: Bob Glossman (Inactive)
• Assignee: Bob Glossman (Inactive)
• Resolution: Fixed
• Severity: 3

Description

Security Fix(es):

• A use-after-free flaw was found in the way the Linux kernel's Datagram
  Congestion Control Protocol (DCCP) implementation freed SKB (socket buffer)
  resources for a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option is set
  on the socket. A local, unprivileged user could use this flaw to alter the
  kernel memory, allowing them to escalate their privileges on the system.
  (CVE-2017-6074, Important)

Bugs fixed (https://bugzilla.redhat.com/):

1423071 - CVE-2017-6074 kernel: use after free in dccp protocol

Issue Links

• is related to: LU-9174 kernel update [RHEL7.3 3.10.0-514.10....

Comments

[Gerrit Updater]

Bob Glossman ([e-mail]) uploaded a new patch: https://review.whamcloud.com/25598
Subject: LU-9143 kernel: kernel update RHEL7.3 [3.10.0-514.6.2.el7]
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: a1a3dabb8147b79bb60c72100963e703393c12bb

[Oleg Drokin]

this one is a serious bug on the clients that people would want fixed.
Luckily it's just hte clients, but unfortunately we don't have EE3.0 supportign weak updates yet even with patchless clients, or do we?

[Bob Glossman (Inactive)]

This ticket is obsolete. There's already a later kernel update; LU-9174. It can be landed instead.