Mageia 2019-0172: kernel-linus security update

    Date16 May 2019
    CategoryMageia
    360
    Posted ByLinuxSecurity Advisories
    This kernel update provides the upstream 4.14.119 that adds the kernel side mitigations for the Microarchitectural Data Sampling (MDS, also called ZombieLoad attack) vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. To complete the mitigations new microcode is also needed, either by installing the
    MGASA-2019-0172 - Updated kernel-linus packages fixes security vulnerabilities
    
    Publication date: 16 May 2019
    URL: https://advisories.mageia.org/MGASA-2019-0172.html
    Type: security
    Affected Mageia releases: 6
    CVE: CVE-2018-12126,
         CVE-2018-12127,
         CVE-2018-12130,
         CVE-2018-1000026,
         CVE-2019-3882,
         CVE-2019-7308,
         CVE-2019-9213,
         CVE-2019-11091,
         CVE-2019-11486,
         CVE-2019-11599
    
    This kernel update provides the upstream 4.14.119 that adds the kernel side
    mitigations for the Microarchitectural Data Sampling (MDS, also called
    ZombieLoad attack) vulnerabilities in Intel processors that can allow
    attackers to retrieve data being processed inside a CPU. To complete the
    mitigations new microcode is also needed, either by installing the
    microcode-0.20190514-1.mga6 package, or get an updated bios / uefi
    firmware from the motherboard vendor.
    
    The fixed / mitigated issues are:
    
    Modern Intel microprocessors implement hardware-level micro-optimizations
    to improve the performance of writing data back to CPU caches. The write
    operation is split into STA (STore Address) and STD (STore Data)
    sub-operations. These sub-operations allow the processor to hand-off
    address generation logic into these sub-operations for optimized writes.
    Both of these sub-operations write to a shared distributed processor
    structure called the 'processor store buffer'. As a result, an
    unprivileged attacker could use this flaw to read private data resident
    within the CPU's processor store buffer. (CVE-2018-12126)
    
    Microprocessors use a ‘load port’ subcomponent to perform load operations
    from memory or IO. During a load operation, the load port receives data
    from the memory or IO subsystem and then provides the data to the CPU
    registers and operations in the CPU’s pipelines. Stale load operations
    results are stored in the 'load port' table until overwritten by newer
    operations. Certain load-port operations triggered by an attacker can be
    used to reveal data about previous stale requests leaking data back to the
    attacker via a timing side-channel. (CVE-2018-12127)
    
    A flaw was found in the implementation of the "fill buffer", a mechanism
    used by modern CPUs when a cache-miss is made on L1 CPU cache. If an
    attacker can generate a load operation that would create a page fault,
    the execution will continue speculatively with incorrect data from the
    fill buffer while the data is fetched from higher level caches. This
    response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)
    
    Uncacheable memory on some microprocessors utilizing speculative execution
    may allow an authenticated user to potentially enable information disclosure
    via a side channel with local access. (CVE-2019-11091)
    
    
    It also fixes atleast the following security issues:
    
    Linux Linux kernel version at least v4.8 onwards, probably well before
    contains a Insufficient input validation vulnerability in bnx2x network
    card driver that can result in DoS: Network card firmware assertion takes
    card off-line. This attack appear to be exploitable via An attacker on a
    must pass a very large, specially crafted packet to the bnx2x card.
    This can be done from an untrusted guest VM (CVE-2018-1000026)
    
    A flaw was found in the Linux kernel's vfio interface implementation that
    permits violation of the user's locked memory limit. If a device is bound
    to a vfio driver, such as vfio-pci, and the local attacker is
    administratively granted ownership of the device, it may cause a system
    memory exhaustion and thus a denial of service (DoS) (CVE-2019-3882).
    
    kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable
    out-of-bounds speculation on pointer arithmetic in various cases, including
    cases of different branches with different state or limits to sanitize,
    leading to side-channel attacks (CVE-2019-7308).
    
    In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks
    a check for the mmap minimum address, which makes it easier for attackers
    to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is
    related to a capability check for the wrong task (CVE-2019-9213).
    
    The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the
    Linux kernel before 5.0.8 has multiple race conditions (CVE-2019-11486).
    
    The coredump implementation in the Linux kernel before 5.0.10 does not use
    locking or other mechanisms to prevent vma layout or vma flags changes while
    it runs, which allows local users to obtain sensitive information, cause a
    denial of service, or possibly have unspecified other impact by triggering
    a race condition with mmget_not_zero or get_task_mm calls (CVE-2019-11599).
    
    It also fixes signal handling issues causing powertop to crash and some
    tracing tools to fail on execve tests.
    
    For other uptstream fixes in this update, see the referenced changelogs.
    
    References:
    - https://bugs.mageia.org/show_bug.cgi?id=24775
    - https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.101
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.102
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.103
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.104
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.105
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.106
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.107
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.108
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.109
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.110
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.111
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.112
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.113
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.114
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.115
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.116
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.117
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.118
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.119
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12126
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12127
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12130
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000026
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3882
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7308
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9213
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11091
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11486
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11599
    
    SRPMS:
    - 6/core/kernel-linus-4.14.119-1.mga6
    

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"8","type":"x","order":"1","pct":61.54,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":23.08,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"2","type":"x","order":"3","pct":15.38,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.