Mageia 2019-0287: kernel security update

    Date21 Sep 2019
    CategoryMageia
    369
    Posted ByLinuxSecurity Advisories
    This kernel update is based on the upstream 4.14.145 and fixes atleast the following security issues: There is heap-based buffer overflow in the marvell wifi chip driver that allows local users to cause a denial of service(system crash) or possibly
    MGASA-2019-0287 - Updated kernel packages fix security vulnerabilities
    
    Publication date: 21 Sep 2019
    URL: https://advisories.mageia.org/MGASA-2019-0287.html
    Type: security
    Affected Mageia releases: 6
    CVE: CVE-2019-14814,
         CVE-2019-14815,
         CVE-2019-14816,
         CVE-2019-14821,
         CVE-2019-14835
    
    This kernel update is based on the upstream 4.14.145 and fixes atleast
    the following security issues:
    
    There is heap-based buffer overflow in the marvell wifi chip driver that
    allows local users to cause a denial of service(system crash) or possibly
    execute arbitrary code (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816).
    
    An out-of-bounds access issue was found in the way Linux kernel's KVM
    hypervisor implements the Coalesced MMIO write operation. It operates on
    an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write
    indices 'ring->first' and 'ring->last' value could be supplied by a host
    user-space process. An unprivileged host user or process with access to
    '/dev/kvm' device could use this flaw to crash the host kernel, resulting
    in a denial of service or potentially escalating privileges on the system
    (CVE-2019-14821).
    
    A buffer overflow flaw was found in the way Linux kernel's vhost
    functionality that translates virtqueue buffers to IOVs, logged the buffer
    descriptors during migration. A privileged guest user able to pass
    descriptors with invalid length to the host when migration is underway,
    could use this flaw to increase their privileges on the host
    (CVE-2019-14835).
    
    WireGuard has been updated to 0.0.20190913.
    
    For other uptstream fixes in this update, see the referenced changelogs.
    
    References:
    - https://bugs.mageia.org/show_bug.cgi?id=25453
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.138
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.139
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.140
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.141
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.142
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.143
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.144
    - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.145
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14814
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14815
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14816
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14821
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14835
    
    SRPMS:
    - 6/core/kernel-4.14.145-2.mga6
    - 6/core/kernel-userspace-headers-4.14.145-2.mga6
    - 6/core/kmod-vboxadditions-6.0.10-4.mga6
    - 6/core/kmod-virtualbox-6.0.10-4.mga6
    - 6/core/kmod-xtables-addons-2.13-92.mga6
    - 6/core/wireguard-tools-0.0.20190913-1.mga6
    

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"22","type":"x","order":"1","pct":55,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":12.5,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"13","type":"x","order":"3","pct":32.5,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.