Mageia 2021-0575: kernel-linus security update | LinuxSecurity.com

Advisories

MGASA-2021-0575 - Updated kernel-linus packages fix security vulnerabilities

Publication date: 21 Dec 2021
URL: https://advisories.mageia.org/MGASA-2021-0575.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-4083,
     CVE-2021-39685,
     CVE-2021-43975

This kernel-linus update is based on upstream 5.15.10 and fixes atleast the
following security issues:

A read-after-free memory flaw was found in the Linux kernel's garbage
collection for Unix domain socket file handlers in the way users call
close() and fget() simultaneously and can potentially trigger a race
condition. This flaw allows a local user to crash the system or escalate
their privileges on the system (CVE-2021-4083).

An attacker can access kernel memory bypassing valid buffer boundaries by
exploiting implementation of control request handlers in the following usb
gadgets - rndis, hid, uac1, uac1_legacy and uac2. Processing of malicious
control transfer requests with unexpectedly large wLength lacks assurance
that this value does not exceed the buffer size. Due to this fact one is
capable of reading and/or writing (depending on particular case) up to 65k
of kernel memory. Devices implementing affected usb device gadget classes
may be affected by buffer overflow vulnerabilities resulting in information
disclosure, denial of service or execution of arbitrary code in kernel
context (CVE-2021-39685).

In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/
ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can
introduce a crafted device) to trigger an out-of-bounds write via a crafted
length value (CVE-2021-43975).

For other upstream fixes, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=29778
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.7
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.8
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.9
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.10
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975

SRPMS:
- 8/core/kernel-linus-5.15.10-1.mga8

Mageia 2021-0575: kernel-linus security update

Summary

This kernel-linus update is based on upstream 5.15.10 and fixes atleast the following security issues:
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system (CVE-2021-4083).
An attacker can access kernel memory bypassing valid buffer boundaries by exploiting implementation of control request handlers in the following usb gadgets - rndis, hid, uac1, uac1_legacy and uac2. Processing of malicious control transfer requests with unexpectedly large wLength lacks assurance that this value does not exceed the buffer size. Due to this fact one is capable of reading and/or writing (depending on particular case) up to 65k of kernel memory. Devices implementing affected usb device gadget classes may be affected by buffer overflow vulnerabilities resulting in information disclosure, denial of service or execution of arbitrary code in kernel context (CVE-2021-39685).
In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value (CVE-2021-43975).
For other upstream fixes, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=29778

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.7

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.8

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.9

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.10

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975

Resolution

MGASA-2021-0575 - Updated kernel-linus packages fix security vulnerabilities

SRPMS

- 8/core/kernel-linus-5.15.10-1.mga8

Severity
Publication date: 21 Dec 2021
URL: https://advisories.mageia.org/MGASA-2021-0575.html
Type: security
CVE: CVE-2021-4083, CVE-2021-39685, CVE-2021-43975

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.