MGASA-2021-0419 - Updated kernel-linus packages fix security vulnerabilities

Publication date: 08 Sep 2021
URL: https://advisories.mageia.org/MGASA-2021-0419.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2020-3702,
     CVE-2021-3739,
     CVE-2021-3743,
     CVE-2021-3753

This kernel-linus update is based on upstream 5.10.62 and fixes atleast the
following security issues:

Specifically timed and handcrafted traffic can cause internal errorsin a WLAN device that lead to improper layer 2 Wi-Fi encryption with a
consequent possibility of information disclosure over the air for a
discrete set of traffic in ath9k (CVE-2020-3702).

A process with CAP_SYS_ADMIN can cause a kernel NULL pointer dereference
in btrfs code (CVE-2021-3739).

there is an out-of-bound read bug in qrtr_endpoint_post in net/qrtr/qrtr.c
(CVE-2021-3743).

An out-of-bounds read due to a race condition has been found in the Linux
kernel due to write access to vc_mode is not protected by a lock in vt_ioctl
(KDSETMDE) (CVE-2021-3753).

For other upstream fixes, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=29436
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3702
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3739
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3743
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3753

SRPMS:
- 8/core/kernel-linus-5.10.62-1.mga8