Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 8: 2023-0238 Critical: Kernel DECnet Remote Access Flaw

mageia
Calendar Grey July 19, 2023
Dist Mageia Esm H88
Explore the Mageia 2023-0239 kernel security patch that tackles various weaknesses, enhancing overall system protection.
This kernel-linus update is based on upstream 5.15.120 and fixes atleast the following security issues: A flaw null pointer dereference in the Linux kernel DECnet networking proto...

Summary

This kernel-linus update is based on upstream 5.15.120 and fixes atleast the following security issues:
A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system. This is fixed by removing DECnet support (CVE-2023-3338).
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue (CVE-2023-3390).
NOTE!! This kernel also contains a fix for dkms builds hanging / stalling during upgrade to Mageia 9 (mga#31982) due to the new make 4.4 series utility ending up in a loop processing Makefile in kernel-devel packages. So if you use dkms packaged drivers and kernel-linus, you need to be running this kernel (or a...

Read the Full Advisory

References

- https://bugs.mageia.org/show_bug.cgi?id=32094

- https://bugs.mageia.org/show_bug.cgi?id=31982

- https://www.cve.org/CVERecord?id=CVE-2023-3338

- https://www.cve.org/CVERecord?id=CVE-2023-3390

Resolution

SRPMS

- 8/core/kernel-linus-5.15.120-2.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 19 Jul 2023
URL: https://advisories.mageia.org/MGASA-2023-0238.html
Type: security
CVE: CVE-2023-3338, CVE-2023-3390

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here