Mageia 2021-0419: kernel-linus security update | LinuxSecurity.com

Advisories

MGASA-2021-0419 - Updated kernel-linus packages fix security vulnerabilities

Publication date: 08 Sep 2021
URL: https://advisories.mageia.org/MGASA-2021-0419.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2020-3702,
     CVE-2021-3739,
     CVE-2021-3743,
     CVE-2021-3753

This kernel-linus update is based on upstream 5.10.62 and fixes atleast the
following security issues:

Specifically timed and handcrafted traffic can cause internal errors
in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a
consequent possibility of information disclosure over the air for a
discrete set of traffic in ath9k (CVE-2020-3702).

A process with CAP_SYS_ADMIN can cause a kernel NULL pointer dereference
in btrfs code (CVE-2021-3739).

there is an out-of-bound read bug in qrtr_endpoint_post in net/qrtr/qrtr.c
(CVE-2021-3743).

An out-of-bounds read due to a race condition has been found in the Linux
kernel due to write access to vc_mode is not protected by a lock in vt_ioctl
(KDSETMDE) (CVE-2021-3753).

For other upstream fixes, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=29436
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3702
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3739
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3743
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3753

SRPMS:
- 8/core/kernel-linus-5.10.62-1.mga8

Mageia 2021-0419: kernel-linus security update

Summary

This kernel-linus update is based on upstream 5.10.62 and fixes atleast the following security issues:
Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic in ath9k (CVE-2020-3702).
A process with CAP_SYS_ADMIN can cause a kernel NULL pointer dereference in btrfs code (CVE-2021-3739).
there is an out-of-bound read bug in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743).
An out-of-bounds read due to a race condition has been found in the Linux kernel due to write access to vc_mode is not protected by a lock in vt_ioctl (KDSETMDE) (CVE-2021-3753).
For other upstream fixes, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=29436

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3702

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3739

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3743

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3753

Resolution

MGASA-2021-0419 - Updated kernel-linus packages fix security vulnerabilities

SRPMS

- 8/core/kernel-linus-5.10.62-1.mga8

Severity
Publication date: 08 Sep 2021
URL: https://advisories.mageia.org/MGASA-2021-0419.html
Type: security
CVE: CVE-2020-3702, CVE-2021-3739, CVE-2021-3743, CVE-2021-3753

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.