Kernel 2.2.xx Mainline ---------------------- Person: Marc-Christian Petersen EMail: m.c.p@kernel.linux-systeme.com Mailinglist: linux-kernel@vger.kernel.org Website: http://www.kernel.org/pub/linux/kernel/people/mcp/ Status: Maintained Employed by: Linux-Systeme GmbH, http://www.linux-systeme.com/ Thanks to Alan Cox 8-) ---------------------------------------------------------------------------- If you need a more secured, more stable, even faster, better SMP support, LFS support, Highmem support, IDE LBA48 support, IPSec support, HTB support, IPVS support etc. enabled kernel with many more features and important fixes, please use my 2.2-secure tree. You may find more informations about it at http://www.wolk-project.de/ ---------------------------------------------------------------------------- 2.2.27-rc2 ---------- o CAN-2005-0001: fixed expand_stack() SMP race (Redhat) o CAN-2004-0883, CAN-2004-0949: smbfs: fixed client (Stefan Esser) overflow. There are two bugs in the handling of SMB responses that result in remote kernel overflows. Due to the nature of the bugs both seem to be very hard to exploit (in the sense of remote code execution or local privilege escalation) but are trivial remote kernel crashes. o rose_rt_ioctl: lack of bounds checking (Coverity) o sdla_xfer: lack of bounds checking (Coverity) o coda: bounds checking for tainted scalars (Coverity) o sendmsg compat wrapper fixes for 64bit compat mode (Olaf Kirch) 2.2.27-rc1 ---------- o CAN-2004-0497: fixed missing DAC check on sys_chown (Thomas Biege) o CAN-2004-1016: fixed a buffer overflow vulnerability (Paul Starzetz) in the "__scm_send" function which handles the sending of UDP network packets. A wrong validity check of the cmsghdr structure allowed a local attacker to modify kernel memory, thus causing an endless loop (DoS) or possibly even root privilege escalation. o CAN-2004-1333: fixed integer overflow in the vc_resize (Georgi Guninski) function allows local users to cause a denial of service (kernel crash) via a short new screen value, which leads to a buffer overflow. Make sure VC resizing fits in s16. o If the user makes ip_cmsg_send call ip_options_get (Georgi Guninski) multiple times, we leak kmalloced IP options data. o fixed moxa serial bound checking issue (Alan Cox) o menu cleanups (me) 2.2.27-pre2 ----------- o A more correct fix to last mremap (2) bug (Dan Yefimov/Solar Designer) o renamed imho *bogus* _vsnprintf to vsnprintf (me) o fixed 'noexec' behaviour (2.4 backport) (me) from Ulrich Drepper 2.2.27-pre1 ----------- o fixed TCP keepalive bug (Neal Cardwell) o fixed tcp seq nr wrapping bug (Ulrik De Bie) o added cciss root translation table (Eduard Bloch) o VIA KL133/KM133 northbridge: vga console going crazy (Roberto Biancardi) o speedup 'make dep' (Benoit Poulot-Cazajous) o disabled MCE only on Pentiums by default (2.4 backport) (Herbert Xu) (boot with 'mce' if your MCE works as expected) o skb_realloc_headroom() panics when new headroom is (James Morris) smaller than existing headroom o invalid nh.raw use after free (Julian Anastasov) o fix a local APIC initaliziation ordering bug that (Andrea Arcangeli) triggers on the P4 o TSC calibration must be dynamic and not a compile (Andrea Arcangeli) time thing because gettimeofday is dynamic and it depends on the TSCs to be in sync o fix deadlock on shutdown in 8139too (Herbert Xu) o support for ELF executables which use an a.out format (Solar Designer) interpreter (dynamic linker) moved into a separate configuration option and disabled by default o fixed sys_utimes perm check according to sys_utim (Al Viro) o show us the saved kernel command line (2.4 backport) (me) o some whitespace cleanups, some coding style cleanups (me) o fixed some gcc warnings (me) o add PCI ID for 82820 NIC to eepro100 network driver (me) o move 'Network device support' near 'Networking options' (me)