Synopsis: Important: kernel security update
Advisory ID: SLSA-2014:0923-1
Issue Date: 2014-07-23
CVE Numbers: CVE-2014-4699
CVE-2014-4943
—
* It was found that the Linux kernel’s ptrace subsystem allowed a traced
process’ instruction pointer to be set to a non-canonical memory address
without forcing the non-sysret code path when returning to user space. A
local, unprivileged user could use this flaw to crash the system or,
potentially, escalate their privileges on the system. (CVE-2014-4699,
Important)
Note: The CVE-2014-4699 issue only affected systems using an Intel CPU.
* A flaw was found in the way the pppol2tp_setsockopt() and
pppol2tp_getsockopt() functions in the Linux kernel’s PPP over L2TP
implementation handled requests with a non-SOL_PPPOL2TP socket option
level. A local, unprivileged user could use this flaw to escalate their
privileges on the system. (CVE-2014-4943, Important)
The system must be rebooted for this update to take effect.
—
– Scientific Linux Development Team
