Discover Government News

MGASA-2022-0379 - Updated kernel packages fix security vulnerabilities

Publication date: 23 Oct 2022
URL: https://advisories.mageia.org/MGASA-2022-0379.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2022-0171,
     CVE-2022-2308,
     CVE-2022-2663,
     CVE-2022-3061,
     CVE-2022-3303,
     CVE-2022-3586,
     CVE-2022-20421,
     CVE-2022-39842,
     CVE-2022-40307,
     CVE-2022-40768,
     CVE-2022-42719,
     CVE-2022-42720,
     CVE-2022-42721,
     CVE-2022-42722,
     CVE-2022-41674

This kernel update is based on upstream 5.15.74 and fixes at least the
following security issues:

A flaw was found in the Linux kernel. The existing KVM SEV API has a
vulnerability that allows a non-root (host) user-level application to
crash the host kernel by creating a confidential guest VM instance in
AMD CPU that supports Secure Encrypted Virtualization (SEV)
(CVE-2022-0171).

A flaw was found in vDPA with VDUSE backend. There are currently no checks
in VDUSE kernel driver to ensure the size of the device config space is in
line with the features advertised by the VDUSE userspace application. In
case of a mismatch, Virtio drivers config read helpers do not initialize
the memory indirectly passed to vduse_vdpa_get_config() returning
uninitialized memory from the stack. This could cause undefined behavior or
data leaks in Virtio drivers (CVE-2022-2308).

An issue was found in the Linux kernel in nf_conntrack_irc where the
message handling can be confused and incorrectly matches the message.
A firewall may be able to be bypassed when users are using unencrypted
IRC with nf_conntrack_irc configured (CVE-2022-2663).

A flaw in the i740 driver. The Userspace program could pass any values
to the driver through ioctl() interface. The driver doesn't check the
value of 'pixclock', so it may cause a divide by zero error
(CVE-2022-3061).

A race condition flaw was found in the Linux kernel sound subsystem due
to improper locking. It could lead to a NULL pointer dereference while
handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or
member of the audio group) could use this flaw to crash the system,
resulting in a denial of service condition (CVE-2022-3303).

A flaw was found in the Linux kernel networking code. A use-after-free
was found in the way the sch_sfb enqueue function used the socket buffer
(SKB) cb field after the same SKB had been enqueued (and freed) into a
child qdisc. This flaw allows a local, unprivileged user to crash the
system, causing a denial of service (CVE-2022-3586).

In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt
memory due to a use after free. This could lead to local escalation of
privilege with no additional execution privileges needed. User interaction
is not needed for exploitation (CVE-2022-20421).

An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write
in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict
of size_t versus int, causing an integer overflow and bypassing the size
check. After that, because it is used as the third argument to
copy_from_user(), a heap overflow may occur (CVE-2022-39842).

An issue was discovered in the Linux kernel through 5.19.8.
drivers/firmware/efi/capsule-loader.c has a race condition with a resultant
use-after-free (CVE-2022-40307).

drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local usersto obtain sensitive information from kernel memory because
stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case
(CVE-2022-40768).

A use-after-free in the mac80211 stack when parsing a multi-BSSID element
in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by
attackers (able to inject WLAN frames) to crash the kernel and potentially
execute code (CVE-2022-42719).

Various refcounting bugs in the multi-BSS handling in the mac80211 stack
in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by
local attackers (able to inject WLAN frames) to trigger use-after-free
conditions to potentially execute code (CVE-2022-42720).

A list management bug in BSS handling in the mac80211 stack in the Linux
kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers(able to inject WLAN frames) to corrupt a linked list and, in turn,
potentially execute code (CVE-2022-42721).

In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackersable to inject WLAN frames into the mac80211 stack could cause a NULL
pointer dereference denial-of-service attack against the beacon protection
of P2P devices (CVE-2022-42722).

An issue was discovered in the Linux kernel before 5.19.16. Attackers able
to inject WLAN frames could cause a buffer overflow in the
ieee80211_bss_info_update function in net/mac80211/scan.c (CVE-2022-41674).

For other upstream fixes in this update, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=30969
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.66
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.67
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.68
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.69
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.70
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.71
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.72
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.73
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.74
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0171
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2308
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2663
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3061
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3303
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3586
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20421
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39842
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40307
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40768
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42719
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42720
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42721
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42722
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41674

SRPMS:
- 8/core/kernel-5.15.74-1.mga8
- 8/core/kmod-virtualbox-6.1.38-1.6.mga8
- 8/core/kmod-xtables-addons-3.21-1.6.mga8

Mageia 2022-0379: kernel security update

This kernel update is based on upstream 5.15.74 and fixes at least the following security issues: A flaw was found in the Linux kernel

Summary

This kernel update is based on upstream 5.15.74 and fixes at least the following security issues:
A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV) (CVE-2022-0171).
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers (CVE-2022-2308).
An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured (CVE-2022-2663).
A flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error (CVE-2022-3061).
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition (CVE-2022-3303).
A flaw was found in the Linux kernel networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service (CVE-2022-3586).
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (CVE-2022-20421).
An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur (CVE-2022-39842).
An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free (CVE-2022-40307).
drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local usersto obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case (CVE-2022-40768).
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code (CVE-2022-42719).
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code (CVE-2022-42720).
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers(able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code (CVE-2022-42721).
In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackersable to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices (CVE-2022-42722).
An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c (CVE-2022-41674).
For other upstream fixes in this update, see the referenced changelogs.

References

- https://bugs.mageia.org/show_bug.cgi?id=30969

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.66

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.67

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.68

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.69

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.70

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.71

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.72

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.73

- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.74

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0171

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2308

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2663

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3061

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3303

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3586

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20421

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39842

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40307

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40768

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42719

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42720

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42721

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42722

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41674

Resolution

MGASA-2022-0379 - Updated kernel packages fix security vulnerabilities

SRPMS

- 8/core/kernel-5.15.74-1.mga8

- 8/core/kmod-virtualbox-6.1.38-1.6.mga8

- 8/core/kmod-xtables-addons-3.21-1.6.mga8

Severity
Publication date: 23 Oct 2022
URL: https://advisories.mageia.org/MGASA-2022-0379.html
Type: security
CVE: CVE-2022-0171, CVE-2022-2308, CVE-2022-2663, CVE-2022-3061, CVE-2022-3303, CVE-2022-3586, CVE-2022-20421, CVE-2022-39842, CVE-2022-40307, CVE-2022-40768, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721, CVE-2022-42722, CVE-2022-41674

Related News