Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 8: MGASA-2021-0589 Moderate: Kernel-Linus DoS Threat

mageia
Calendar Grey December 29, 2021
Dist Mageia Esm H88
Mageia 2021-0590 addresses security flaws in kernel-linus, crucial for mitigating potential guest service disruptions and safeguarding against threats.
This kernel-linus update is based on upstream 5.15.11 and fixes atleast the following security issues: Potentially malicious XEN PV backends can cause guest DoS due to unhardened ...

Summary

This kernel-linus update is based on upstream 5.15.11 and fixes atleast the following security issues:
Potentially malicious XEN PV backends can cause guest DoS due to unhardened frontends in the guests, even though this ought to have been prevented by containing them within a driver domain. This update fixes the issue tracked as XSA-391: blkfront (CVE-2021-28711), netfront (CVE-2021-28712), hvc_xen (CVE-2021-28713).
The Linux kernel's xen-netback backend driver can be forced by guests to queue arbitrary amounts of network data, finally causing an out of memory situation in the domain the backend is running in (usually dom0). This update fixes the issues tracked as XSA-392 (CVE-2021-28714, CVE-2021-28715).
For other upstream fixes, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=29814

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.11

- https://xenbits.xen.org/xsa/advisory-391.html

- https://xenbits.xen.org/xsa/advisory-392.html

- https://www.cve.org/CVERecord?id=CVE-2021-28711

- https://www.cve.org/CVERecord?id=CVE-2021-28712

- https://www.cve.org/CVERecord?id=CVE-2021-28713

- https://www.cve.org/CVERecord?id=CVE-2021-28714

- https://www.cve.org/CVERecord?id=CVE-2021-28715

Topics%20covered

Topics Covered

security advisory kernel update backend CVE issues XEN Mageia guest DoS

Resolution

SRPMS

- 8/core/kernel-linus-5.15.11-1.mga8

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 29 Dec 2021
URL: https://advisories.mageia.org/MGASA-2021-0589.html
Type: security
CVE: CVE-2021-28711, CVE-2021-28712, CVE-2021-28713, CVE-2021-28714, CVE-2021-28715

Topics%20covered

Topics Covered

security advisory kernel update backend CVE issues XEN Mageia guest DoS

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here