MGASA-2022-0092
- Source
- https://advisories.mageia.org/MGASA-2022-0092.html
- Import Source
- https://advisories.mageia.org/MGASA-2022-0092.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2022-0092
- Upstream
- Published
- 2022-03-07T23:10:22Z
- Modified
- 2026-04-16T00:09:48Z
- Summary
- Updated kernel packages fix security vulnerabilities
- Details
-
This kernel update is based on upstream 5.15.25 and fixes at least the following security issues:
A vulnerability in the Linux kernel since version 5.8 due to uninitialized variables. It enables anybody to write arbitrary data to arbitrary files, even if the file is O_RDONLY, immutable or on a MS_RDONLY filesystem. It can be used to inject code into arbitrary processes (CVE-2022-0847).
An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur (CVE-2022-25258).
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (CVE-2022-25375).
net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload (CVE-2022-25636).
For other upstream fixes, see the referenced changelogs.
- References
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:8 / kernel
Package
- Name
- kernel
- Purl
- pkg:rpm/mageia/kernel?arch=source&distro=mageia-8
Mageia:8 / kmod-virtualbox
Package
- Name
- kmod-virtualbox
- Purl
- pkg:rpm/mageia/kmod-virtualbox?arch=source&distro=mageia-8
Mageia:8 / kmod-xtables-addons
Package
- Name
- kmod-xtables-addons
- Purl
- pkg:rpm/mageia/kmod-xtables-addons?arch=source&distro=mageia-8