Mageia 2022-0230: kernel-linus security update | LinuxSecurity.com
MGASA-2022-0230 - Updated kernel-linus packages fix security vulnerabilities

Publication date: 13 Jun 2022
URL: https://advisories.mageia.org/MGASA-2022-0230.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2022-1789,
     CVE-2022-1852,
     CVE-2022-1966,
     CVE-2022-1972,
     CVE-2022-1973

This kernel-linus update is based on upstream 5.15.46 and fixes at least
the following security issues:

KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
(CVE-2022-1789).

KVM: x86: avoid calling x86 emulator without a decoded instruction
(CVE-2022-1852).

A use-after-free vulnerability was found in the Linux kernel's Netfilter
subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local
attacker with user access to cause a privilege escalation issue
(CVE-2022-1966).

An out-of-bound write vulnerability was identified within the netfilter
subsystem which can be exploited to achieve privilege escalation to
root. In order to trigger the issue it requires the ability to create
user/net namespaces (CVE-2022-1972).

fs/ntfs3: Fix invalid free in log_replay (CVE-2022-1973).

For other upstream fixes, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=30537
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.44
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.45
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.46
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1789
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1852
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1966
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1972
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1973

SRPMS:
- 8/core/kernel-linus-5.15.46-1.mga8

Mageia 2022-0230: kernel-linus security update

This kernel-linus update is based on upstream 5.15.46 and fixes at least the following security issues: KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID (CVE-2022-1789)

Summary

This kernel-linus update is based on upstream 5.15.46 and fixes at least the following security issues:
KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID (CVE-2022-1789).
KVM: x86: avoid calling x86 emulator without a decoded instruction (CVE-2022-1852).
A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue (CVE-2022-1966).
An out-of-bound write vulnerability was identified within the netfilter subsystem which can be exploited to achieve privilege escalation to root. In order to trigger the issue it requires the ability to create user/net namespaces (CVE-2022-1972).
fs/ntfs3: Fix invalid free in log_replay (CVE-2022-1973).
For other upstream fixes, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=30537

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.44

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.45

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.46

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1789

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1852

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1966

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1972

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1973

Resolution

MGASA-2022-0230 - Updated kernel-linus packages fix security vulnerabilities

SRPMS

- 8/core/kernel-linus-5.15.46-1.mga8

Severity
Publication date: 13 Jun 2022
URL: https://advisories.mageia.org/MGASA-2022-0230.html
Type: security
CVE: CVE-2022-1789, CVE-2022-1852, CVE-2022-1966, CVE-2022-1972, CVE-2022-1973

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.