[ALAS-2014-392] Amazon Linux AMI 2012.09 - ALAS-2014-392: medium priority package update for kernel

Package updates are available for Amazon Linux AMI that fix the following vulnerabilities:
CVE-2014-3153:
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system.
1103626:
CVE-2014-3153 kernel: futex: pi futexes requeue issue

CVE-2014-1739:
The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
1109774:
CVE-2014-1739 Kernel: drivers: media: an information leakage

CVE-2014-0196:
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
1094232:
CVE-2014-0196 kernel: pty layer race condition leading to memory corruption