Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Mageia Linux 7 and 8: MGASA-2021-0225 Moderate Security Advisory

mageia
Calendar Grey May 31, 2021
Dist Mageia Esm H88
Mageia's latest kernel-linus patch addresses critical vulnerabilities associated with pointer arithmetic. Explore the implications and corrective actions taken.
This kernel-linus update is based on upstream 5.10.41 and fixes atleast the following security issue: kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect l...

Summary

This kernel-linus update is based on upstream 5.10.41 and fixes atleast the following security issue:
kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit (CVE-2021-33200).
For other upstream fixes, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=28981

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.38

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.39

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.40

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.41

- https://www.cve.org/CVERecord?id=CVE-2021-33200

Topics%20covered

Topics Covered

security advisory local privilege escalation kernel patch Mageia pointer arithmetic

Resolution

SRPMS

- 8/core/kernel-linus-5.10.41-1.mga8

- 7/core/kernel-linus-5.10.41-1.mga7

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 31 May 2021
URL: https://advisories.mageia.org/MGASA-2021-0225.html
Type: security
CVE: CVE-2021-33200

Topics%20covered

Topics Covered

security advisory local privilege escalation kernel patch Mageia pointer arithmetic

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here