MGASA-2019-0287
- Source
- https://advisories.mageia.org/MGASA-2019-0287.html
- Import Source
- https://advisories.mageia.org/MGASA-2019-0287.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2019-0287
- Related
- Published
- 2019-09-21T16:04:55Z
- Modified
- 2022-02-17T18:21:47Z
- Summary
- Updated kernel packages fix security vulnerabilities
- Details
-
This kernel update is based on the upstream 4.14.145 and fixes at least the following security issues:
There is heap-based buffer overflow in the marvell wifi chip driver that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816).
An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvmcoalescedmmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (CVE-2019-14821).
A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host (CVE-2019-14835).
WireGuard has been updated to 0.0.20190913.
For other uptstream fixes in this update, see the referenced changelogs.
- References
-
- https://advisories.mageia.org/MGASA-2019-0287.html
- https://bugs.mageia.org/show_bug.cgi?id=25453
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.138
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.139
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.140
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.141
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.142
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.143
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.144
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.145
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:6 / kernel
Package
- Name
- kernel
- Purl
- pkg:rpm/mageia/kernel?distro=mageia-6
Mageia:6 / kernel-userspace-headers
Package
- Name
- kernel-userspace-headers
- Purl
- pkg:rpm/mageia/kernel-userspace-headers?distro=mageia-6
Mageia:6 / kmod-vboxadditions
Package
- Name
- kmod-vboxadditions
- Purl
- pkg:rpm/mageia/kmod-vboxadditions?distro=mageia-6
Mageia:6 / kmod-virtualbox
Package
- Name
- kmod-virtualbox
- Purl
- pkg:rpm/mageia/kmod-virtualbox?distro=mageia-6
Mageia:6 / kmod-xtables-addons
Package
- Name
- kmod-xtables-addons
- Purl
- pkg:rpm/mageia/kmod-xtables-addons?distro=mageia-6
Mageia:6 / wireguard-tools
Package
- Name
- wireguard-tools
- Purl
- pkg:rpm/mageia/wireguard-tools?distro=mageia-6