1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE> [Mageia-dev] NVIDIA CVE, mga1: update driver, or patch and break CUDA debugger?
</TITLE>
<LINK REL="Index" HREF="index.html" >
<LINK REL="made" HREF="mailto:mageia-dev%40mageia.org?Subject=Re%3A%20%5BMageia-dev%5D%20NVIDIA%20CVE%2C%20mga1%3A%20update%20driver%2C%0A%09or%20patch%20and%20break%20CUDA%20debugger%3F&In-Reply-To=%3C4F8594DD.1070205%40mageia.org%3E">
<META NAME="robots" CONTENT="index,nofollow">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<LINK REL="Previous" HREF="014173.html">
<LINK REL="Next" HREF="014147.html">
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>[Mageia-dev] NVIDIA CVE, mga1: update driver, or patch and break CUDA debugger?</H1>
<B>Anssi Hannula</B>
<A HREF="mailto:mageia-dev%40mageia.org?Subject=Re%3A%20%5BMageia-dev%5D%20NVIDIA%20CVE%2C%20mga1%3A%20update%20driver%2C%0A%09or%20patch%20and%20break%20CUDA%20debugger%3F&In-Reply-To=%3C4F8594DD.1070205%40mageia.org%3E"
TITLE="[Mageia-dev] NVIDIA CVE, mga1: update driver, or patch and break CUDA debugger?">anssi at mageia.org
</A><BR>
<I>Wed Apr 11 16:27:41 CEST 2012</I>
<P><UL>
<LI>Previous message: <A HREF="014173.html">[Mageia-dev] Help: Please find me initscripts without LSB headers!
</A></li>
<LI>Next message: <A HREF="014147.html">[Mageia-dev] NVIDIA CVE, mga1: update driver, or patch and break CUDA debugger?
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#14145">[ date ]</a>
<a href="thread.html#14145">[ thread ]</a>
<a href="subject.html#14145">[ subject ]</a>
<a href="author.html#14145">[ author ]</a>
</LI>
</UL>
<HR>
<!--beginarticle-->
<PRE>Hi all!
We'll have to apply a patch for CVE-2012-0946 (access to arbitrary
system memory by any user) for cauldron and mga1.
However, the security fix (patch to the nvidia kernel interface layer)
will break CUDA debugger using libcuda older than 295.40.
While I can upgrade cauldron driver (which contains libcuda) to 295.40,
mga1 will be left with two options:
a) Apply patch, informing users that CUDA debugger will cease to
function unless they upgrade their NVIDIA driver. However, as we have
no backports, the remaining (non-system-breaking) option to upgrade
their driver is to use <A HREF="http://onse.fi/nvidia-mgabuild/">http://onse.fi/nvidia-mgabuild/</A> , but I don't
think it is very nice to link to non-official page from an advisory,
right?
b) Upgrade our MGA1 driver from 275.09.07 to 295.40 ("long-lived branch
release") as well. We have
previously shipped an update from 270.41.19 to 275.09.07 for MGA1
(that was due to an important stability bugfix). I'm not aware of
any blockers for this.
I'd probably prefer (a), but since we don't have any official way for
users to update their driver, that makes me lean to (b) instead.
WDYT?
A relatively quick decision needs to be made...
--
Anssi Hannula
</PRE>
<!--endarticle-->
<HR>
<P><UL>
<!--threads-->
<LI>Previous message: <A HREF="014173.html">[Mageia-dev] Help: Please find me initscripts without LSB headers!
</A></li>
<LI>Next message: <A HREF="014147.html">[Mageia-dev] NVIDIA CVE, mga1: update driver, or patch and break CUDA debugger?
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#14145">[ date ]</a>
<a href="thread.html#14145">[ thread ]</a>
<a href="subject.html#14145">[ subject ]</a>
<a href="author.html#14145">[ author ]</a>
</LI>
</UL>
<hr>
<a href="https://www.mageia.org/mailman/listinfo/mageia-dev">More information about the Mageia-dev
mailing list</a><br>
</body></html>
|
