MGASA-2023-0238 - Updated kernel-linus packages fix security vulnerabilities

Publication date: 19 Jul 2023
URL: https://advisories.mageia.org/MGASA-2023-0238.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2023-3338,
     CVE-2023-3390

This kernel-linus update is based on upstream 5.15.120 and fixes atleast
the following security issues:

A flaw null pointer dereference in the Linux kernel DECnet networking
protocol was found. A remote user could use this flaw to crash the
system. This is fixed by removing DECnet support (CVE-2023-3338).

A use-after-free vulnerability was found in the Linux kernel's netfilter
subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with
NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same
transaction causing a use-after-free vulnerability. This flaw allows a
local attacker with user access to cause a privilege escalation issue
(CVE-2023-3390).

NOTE!!
This kernel also contains a fix for dkms builds hanging / stalling during
upgrade to Mageia 9 (mga#31982) due to the new make 4.4 series utility
ending up in a loop processing Makefile in kernel-devel packages.
So if you use dkms packaged drivers and kernel-linus, you need to be
running this kernel (or any later released ones) before you do an online
upgrade to avoid the upgrade stalling / hanging.

References:
- https://bugs.mageia.org/show_bug.cgi?id=32094
- https://bugs.mageia.org/show_bug.cgi?id=31982
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3338
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3390

SRPMS:
- 8/core/kernel-linus-5.15.120-2.mga8