Package: python-pycuda Severity: grave Tags: upstream security Justification: user security hole
Dear Maintainer, See https://github.com/inducer/pycuda/issues/54 for the upstream report of this bug, which allows a local attacker to run arbitrary GPU code in the address space of the victim's application. The link also contains a patch. I happen to be running Ubuntu Trusty on the machine where I first discovered this, but it presumably affects any UNIX system with a shared system temporary directory. -- System Information: Debian Release: jessie/sid APT prefers trusty-updates APT policy: (500, 'trusty-updates'), (500, 'trusty-security'), (500, 'trusty'), (100, 'trusty-backports') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.13.0-39-generic (SMP w/8 CPU cores) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
