Mageia 2022-0308: kernel-linus security update | LinuxSecurity.com

Advisories

MGASA-2022-0308 - Updated kernel-linus packages fix security vulnerabilities

Publication date: 25 Aug 2022
URL: https://advisories.mageia.org/MGASA-2022-0308.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2022-1679,
     CVE-2022-2585,
     CVE-2022-2586,
     CVE-2022-2588,
     CVE-2022-26373,
     CVE-2022-36946

This kernel update is based on upstream 5.15.62 and fixes at least the
following security issues:

A use-after-free flaw was found in the Linux kernel Atheros wireless adapter
driver in the way a user forces the ath9k_htc_wait_for_target function to
fail with some input messages. This flaw allows a local user to crash or
potentially escalate their privileges on the system (CVE-2022-1679).

A use-after-free flaw was found in the Linux kernel’s POSIX CPU timers
functionality in the way a user creates and then deletes the timer in the
non-leader thread of the program. This flaw allows a local user to crash
or potentially escalate their privileges on the system (CVE-2022-2585).

A use-after-free flaw was found in nf_tables cross-table in the
net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows
a local, privileged attacker to cause a use-after-free problem at the time
of table deletion, possibly leading to local privilege escalation
(CVE-2022-2586).

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c
filter implementation in the Linux kernel. This flaw allows a local,
privileged attacker to crash the system, possibly leading to a local
privilege escalation issue (CVE-2022-2588).

A flaw was found in hw. In certain processors with Intel's Enhanced Indirect
Branch Restricted Speculation (eIBRS) capabilities, soon after VM exit or
IBPB command event, the linear address following the most recent near CALL
instruction prior to a VM exit may be used as the Return Stack Buffer (RSB)
prediction (CVE-2022-26373).

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through
5.18.14 allows remote attackers to cause a denial of service  (panic) because,
in the case of an nf_queue verdict with a one-byte nfta_payload attribute,
an skb_pull can encounter a negative skb->len (CVE-2022-36946).

x86/bugs: Enable STIBP for IBPB mitigated RETBleed.

Other fixes in this update:
- add support for more tcp congestion control algos (mga #30725)

For other upstream fixes in this update, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=30762
- https://bugs.mageia.org/show_bug.cgi?id=30725
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.59
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.60
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.61
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.62
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1679
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2585
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2588
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26373
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36946

SRPMS:
- 8/core/kernel-linus-5.15.62-1.mga8

Mageia 2022-0308: kernel-linus security update

Summary

This kernel update is based on upstream 5.15.62 and fixes at least the following security issues:
A use-after-free flaw was found in the Linux kernel Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1679).
A use-after-free flaw was found in the Linux kernel’s POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-2585).
A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation (CVE-2022-2586).
A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issue (CVE-2022-2588).
A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction (CVE-2022-26373).
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len (CVE-2022-36946).
x86/bugs: Enable STIBP for IBPB mitigated RETBleed.
Other fixes in this update: - add support for more tcp congestion control algos (mga #30725)
For other upstream fixes in this update, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=30762

- https://bugs.mageia.org/show_bug.cgi?id=30725

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.59

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.60

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.61

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.62

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1679

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2585

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2588

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26373

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36946

Resolution

MGASA-2022-0308 - Updated kernel-linus packages fix security vulnerabilities

SRPMS

- 8/core/kernel-linus-5.15.62-1.mga8

Severity
Publication date: 25 Aug 2022
URL: https://advisories.mageia.org/MGASA-2022-0308.html
Type: security
CVE: CVE-2022-1679, CVE-2022-2585, CVE-2022-2586, CVE-2022-2588, CVE-2022-26373, CVE-2022-36946

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.