MGASA-2019-0097
- Source
- https://advisories.mageia.org/MGASA-2019-0097.html
- Import Source
- https://advisories.mageia.org/MGASA-2019-0097.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2019-0097
- Related
- Published
- 2019-02-20T23:50:36Z
- Modified
- 2022-02-17T18:21:47Z
- Summary
- Updated kernel packages fix security vulnerabilities
- Details
-
This kernel update is based on the upstream 4.14.100 and fixes at least the following security issues:
A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nestedgetvmcs12pages(), in case of an error while processing posted interrupt address, it unmaps the 'pidescpage' without resetting 'pidesc' descriptor address, which is later used in pitestandclearon(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system (CVE-2018-16882).
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bcsvcprocess() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (CVE-2018-16884).
A flaw was found in the Linux kernel in the function hsoprobe() which reads ifnum value from the USB device (as an u8) and uses it without a length check to index an array, resulting in an OOB memory read in hsoprobe() or hsogetconfigdata(). An attacker with a forged USB device and physical access to a system (needed to connect such a device) can cause a system crash and a denial of service (CVE-2018-19985).
An issue was discovered in cancangwrcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the candlc field. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames. This is related to cgwcsumxor_rel. An unprivileged user can trigger a system crash (general protection fault) (CVE-2019-3701).
A flaw was found in the Linux kernel in the function hiddebugevents_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service (CVE-2019-3819).
In the Linux kernel before 4.20.8, kvmioctlcreatedevice in virt/kvm/kvmmain.c mishandles reference counting because of a race condition, leading to a use-after-free (CVE-2019-6974).
A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor emulates a preemption timer for L2 guests when nested (=1) virtualization is enabled. This high resolution timer(hrtimer) runs when a L2 guest is active. After VM exit, the syncvmcs12() timer object is stopped. The use-after-free occurs if the timer object is freed before calling syncvmcs12() routine. A guest user/process could use this flaw to crash the host kernel resulting in a denial of service or, potentially, gain privileged access to a system (CVE-2019-7221).
An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exceptions while emulating instructions like VMXON, VMCLEAR, VMPTRLD, and VMWRITE with memory address as an operand. It occurs if the operand is a mmio address, as the returned exception object holds uninitialized stack memory contents. A guest user/process could use this flaw to leak host's stack memory contents to a guest (CVE-2019-7222).
Other fixes in this update: * Ndiswrapper has been updated to 1.62 * WireGuard has been updated to 0.0.20190123
For other uptstream fixes in this update, see the referenced changelogs.
- References
-
- https://advisories.mageia.org/MGASA-2019-0097.html
- https://bugs.mageia.org/show_bug.cgi?id=24331
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.90
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.91
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.92
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.93
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.94
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.95
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.96
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.97
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.98
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.99
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.100
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:6 / kernel
Package
- Name
- kernel
- Purl
- pkg:rpm/mageia/kernel?distro=mageia-6
Mageia:6 / kernel-userspace-headers
Package
- Name
- kernel-userspace-headers
- Purl
- pkg:rpm/mageia/kernel-userspace-headers?distro=mageia-6
Mageia:6 / kmod-vboxadditions
Package
- Name
- kmod-vboxadditions
- Purl
- pkg:rpm/mageia/kmod-vboxadditions?distro=mageia-6
Mageia:6 / kmod-virtualbox
Package
- Name
- kmod-virtualbox
- Purl
- pkg:rpm/mageia/kmod-virtualbox?distro=mageia-6
Mageia:6 / kmod-xtables-addons
Package
- Name
- kmod-xtables-addons
- Purl
- pkg:rpm/mageia/kmod-xtables-addons?distro=mageia-6
Mageia:6 / ndiswrapper
Package
- Name
- ndiswrapper
- Purl
- pkg:rpm/mageia/ndiswrapper?distro=mageia-6
Mageia:6 / wireguard-tools
Package
- Name
- wireguard-tools
- Purl
- pkg:rpm/mageia/wireguard-tools?distro=mageia-6