Alerts This Week
Warning Icon 1 485
Alerts This Week
Warning Icon 1 485

Mageia 8: 2022-0095 Critical: Kernel-Linus Memory Corruption Threat

mageia
Calendar Grey March 9, 2022
Dist Mageia Esm H88
Mageia 8 Kernel-linus security patch addresses multiple vulnerabilities including memory overflow and privilege elevation issues.
This kernel-linus update is based on upstream 5.15.26 and fixes at least the following security issues: A vulnerability in the Linux kernel since version 5.8 due to uninitialized ...

Summary

This kernel-linus update is based on upstream 5.15.26 and fixes at least the following security issues:
A vulnerability in the Linux kernel since version 5.8 due to uninitialized variables. It enables anybody to write arbitrary data to arbitrary files, even if the file is O_RDONLY, immutable or on a MS_RDONLY filesystem. It can be used to inject code into arbitrary processes (CVE-2022-0847).
An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur (CVE-2022-25258).
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (CVE-2022-25375).
net/netfilter/nf_dup_netd...

Read the Full Advisory

References

- https://bugs.mageia.org/show_bug.cgi?id=30139

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.24

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.25

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.26

- https://www.cve.org/CVERecord?id=CVE-2022-0847

- https://www.cve.org/CVERecord?id=CVE-2022-25258

- https://www.cve.org/CVERecord?id=CVE-2022-25375

- https://www.cve.org/CVERecord?id=CVE-2022-25636

Topics%20covered

Topics Covered

security advisory kernel update critical privilege escalation memory corruption Mageia USB gadget

Resolution

SRPMS

- 8/core/kernel-linus-5.15.26-1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 09 Mar 2022
URL: https://advisories.mageia.org/MGASA-2022-0095.html
Type: security
CVE: CVE-2022-0847, CVE-2022-25258, CVE-2022-25375, CVE-2022-25636

Topics%20covered

Topics Covered

security advisory kernel update critical privilege escalation memory corruption Mageia USB gadget

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here