Mageia 2021-0589: kernel-linus security update | LinuxSecurity.com

Advisories

MGASA-2021-0589 - Updated kernel-linus packages fix security vulnerabilities

Publication date: 29 Dec 2021
URL: https://advisories.mageia.org/MGASA-2021-0589.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-28711,
     CVE-2021-28712,
     CVE-2021-28713,
     CVE-2021-28714,
     CVE-2021-28715

This kernel-linus update is based on upstream 5.15.11 and fixes atleast the
following security issues:

Potentially malicious XEN PV backends can cause guest DoS due to unhardened
frontends in the guests, even though this ought to have been prevented by
containing them within a driver domain. This update fixes the issue tracked
as XSA-391: blkfront (CVE-2021-28711), netfront (CVE-2021-28712),
hvc_xen (CVE-2021-28713).

The Linux kernel's xen-netback backend driver can be forced by guests to
queue arbitrary amounts of network data, finally causing an out of memory
situation in the domain the backend is running in (usually dom0). This
update fixes the issues tracked as XSA-392 (CVE-2021-28714, CVE-2021-28715).

For other upstream fixes, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=29814
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.11
- https://xenbits.xen.org/xsa/advisory-391.html
- https://xenbits.xen.org/xsa/advisory-392.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28711
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28712
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28713
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28714
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28715

SRPMS:
- 8/core/kernel-linus-5.15.11-1.mga8

Mageia 2021-0589: kernel-linus security update

Summary

This kernel-linus update is based on upstream 5.15.11 and fixes atleast the following security issues:
Potentially malicious XEN PV backends can cause guest DoS due to unhardened frontends in the guests, even though this ought to have been prevented by containing them within a driver domain. This update fixes the issue tracked as XSA-391: blkfront (CVE-2021-28711), netfront (CVE-2021-28712), hvc_xen (CVE-2021-28713).
The Linux kernel's xen-netback backend driver can be forced by guests to queue arbitrary amounts of network data, finally causing an out of memory situation in the domain the backend is running in (usually dom0). This update fixes the issues tracked as XSA-392 (CVE-2021-28714, CVE-2021-28715).
For other upstream fixes, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=29814

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.11

- https://xenbits.xen.org/xsa/advisory-391.html

- https://xenbits.xen.org/xsa/advisory-392.html

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28711

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28712

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28713

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28714

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28715

Resolution

MGASA-2021-0589 - Updated kernel-linus packages fix security vulnerabilities

SRPMS

- 8/core/kernel-linus-5.15.11-1.mga8

Severity
Publication date: 29 Dec 2021
URL: https://advisories.mageia.org/MGASA-2021-0589.html
Type: security
CVE: CVE-2021-28711, CVE-2021-28712, CVE-2021-28713, CVE-2021-28714, CVE-2021-28715

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.