Alerts This Week
Warning Icon 1 560
Alerts This Week
Warning Icon 1 560

Mageia 7: MGASA-2020-0355 Critical: Kernel Btrfs and Memory Flaws

mageia
Calendar Grey August 30, 2020
Dist Mageia Esm H88
Fedora's software upgrade addresses several vulnerabilities, improving performance and security.
This update is based on the upstream 5.7.19 kernel and fixes at least the following security issue: In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem imag...

Summary

This update is based on the upstream 5.7.19 kernel and fixes at least the following security issue:
In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure (CVE-2019-19448).
A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 filesystem, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability (CVE-2020-14314).
For other upstream fixes and changes in this update, see the referenced changelogs.
Also, the wireguard-tools package has been updated to version 1.0.20200827.

References

- https://bugs.mageia.org/show_bug.cgi?id=27215

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.15

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.16

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.17

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.18

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.19

- https://access.redhat.com/security/cve/CVE-2020-14314

- - - https://www.cve.org/CVERecord?id=CVE-2019-19448

- https://www.cve.org/CVERecord?id=CVE-2020-14314

Topics%20covered

Topics Covered

security advisory update kernel fix memory flaw Mageia system availability btrfs issue

Resolution

SRPMS

- 7/core/kernel-5.7.19-1.mga7

- 7/core/kernel-linus-5.7.19-1.mga7

- 7/core/kmod-virtualbox-6.0.24-5.mga7

- 7/core/kmod-xtables-addons-3.10-3.mga7

- 7/core/wireguard-tools-1.0.20200827-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 30 Aug 2020
URL: https://advisories.mageia.org/MGASA-2020-0355.html
Type: security
CVE: CVE-2019-19448, CVE-2020-14314

Topics%20covered

Topics Covered

security advisory update kernel fix memory flaw Mageia system availability btrfs issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here