Mageia 2022-0121: kernel security update | LinuxSecurity.com
MGASA-2022-0121 - Updated kernel packages fix security vulnerabilities

Publication date: 29 Mar 2022
URL: https://advisories.mageia.org/MGASA-2022-0121.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2022-0995,
     CVE-2022-1011,
     CVE-2022-1015,
     CVE-2022-1016,
     CVE-2022-1048,
     CVE-2022-26490,
     CVE-2022-27666

This kernel update is based on upstream 5.15.32 and fixes at least the
following security issues:

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s
watch_queue event notification subsystem. This flaw can overwrite parts
of the kernel state, potentially allowing a local user to gain privileged
access or cause a denial of service on the system (CVE-2022-0995).

A flaw use after free in the Linux kernel FUSE filesystem was found in
the way user triggers write(). A local user could use this flaw to get
some unauthorized access to some data from the FUSE filesystem and as
result potentially privilege escalation too (CVE-2022-1011).

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c
of the netfilter subsystem. This flaw allows a local user to cause an
out-of-bounds write issue (CVE-2022-1015).

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:
nft_do_chain, which can cause a use-after-free. This issue needs to handle
'return' with proper preconditions, as it can lead to a kernel information
leak problem caused by a local, unprivileged attacker (CVE-2022-1016).

A use-after-free flaw was found in the Linux kernel’s sound subsystem in
the way a user triggers concurrent calls of PCM hw_params. The hw_free
ioctls or similar race condition happens inside ALSA PCM for other ioctls.
This flaw allows a local user to crash or potentially escalate their
privileges on the system (CVE-2022-1048).

st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c has
EVT_TRANSACTION buffer overflows because of untrusted length parameters
(CVE-2022-26490).

There is a buffer overflow in ESP transformation in net/ipv4/esp4.c and
net/ipv6/esp6.c via a large message. In some configurations, local users
can gain privileges by overwriting kernel heap objects (CVE-2022-27666).

Other fixes in this update:
- locking/lockdep: Avoid potential access of invalid memory in lock_class
- mm: kfence: fix missing objcg housekeeping for SLAB
- net: ipv6: fix skb_over_panic in __ip6_append_data
- rtw88: Add support for Realtek 8821CE RFE Type 6
- revert: "swiotlb: rework 'fix info leak with DMA_FROM_DEVICE'" as it
  breaks atleast ath9k

For other upstream fixes, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=30199
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.29
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.30
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.31
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.32
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0995
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1011
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1015
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1016
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1048
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26490
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27666

SRPMS:
- 8/core/kernel-5.15.32-1.mga8
- 8/core/kmod-virtualbox-6.1.32-1.14.mga8
- 8/core/kmod-xtables-addons-3.18-1.64.mga8

Mageia 2022-0121: kernel security update

This kernel update is based on upstream 5.15.32 and fixes at least the following security issues: An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_...

Summary

This kernel update is based on upstream 5.15.32 and fixes at least the following security issues:
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system (CVE-2022-0995).
A flaw use after free in the Linux kernel FUSE filesystem was found in the way user triggers write(). A local user could use this flaw to get some unauthorized access to some data from the FUSE filesystem and as result potentially privilege escalation too (CVE-2022-1011).
A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue (CVE-2022-1015).
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c: nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker (CVE-2022-1016).
A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1048).
st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c has EVT_TRANSACTION buffer overflows because of untrusted length parameters (CVE-2022-26490).
There is a buffer overflow in ESP transformation in net/ipv4/esp4.c and net/ipv6/esp6.c via a large message. In some configurations, local users can gain privileges by overwriting kernel heap objects (CVE-2022-27666).
Other fixes in this update: - locking/lockdep: Avoid potential access of invalid memory in lock_class - mm: kfence: fix missing objcg housekeeping for SLAB - net: ipv6: fix skb_over_panic in __ip6_append_data - rtw88: Add support for Realtek 8821CE RFE Type 6 - revert: "swiotlb: rework 'fix info leak with DMA_FROM_DEVICE'" as it breaks atleast ath9k
For other upstream fixes, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=30199

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.29

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.30

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.31

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.32

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0995

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1011

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1015

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1016

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1048

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26490

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27666

Resolution

MGASA-2022-0121 - Updated kernel packages fix security vulnerabilities

SRPMS

- 8/core/kernel-5.15.32-1.mga8

- 8/core/kmod-virtualbox-6.1.32-1.14.mga8

- 8/core/kmod-xtables-addons-3.18-1.64.mga8

Severity
Publication date: 29 Mar 2022
URL: https://advisories.mageia.org/MGASA-2022-0121.html
Type: security
CVE: CVE-2022-0995, CVE-2022-1011, CVE-2022-1015, CVE-2022-1016, CVE-2022-1048, CVE-2022-26490, CVE-2022-27666

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.