Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
203
security advisorymemory corruptioninformation exposureMageia: 2020-0158 High: Kernel-Linus Use-After-Free Issues
This update is based on upstream 5.5.15 and fixes atleast the following security vulnerabilities: In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to . MGASA-2020-0158 - Updated kernel-linus packages fix security vulnerabilities Publication date: 03 Apr 2020 URL: https://advisories.mageia.org/MGASA-2020-0158.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-19768, CVE-2019-19769, CVE-2020-2732, CVE-2020-8647, CVE-2020-8648, CVE-2020-8649, CVE-2020-8835, CVE-2020-9383, CVE-2020-9391 This update is based on upstream 5.5.15 and fixes atleast the following security vulnerabilities: In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer) (CVE-2019-19768). In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h) (CVE-2019-19769). A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested(=1) virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to potentially access information of the L1 hypervisor (CVE-2020-2732). There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647). There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648). Manfred Paul discovered that the bpf verifier in the Linux kernel did not properly calculate register bounds for certain operations. A local attacker could use this to expose sensitive information (kernel memory) or gain administrative privileges(CVE-2020-8835). There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. (CVE-2020-8649). An issue was discovered in the Linux kernel through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2 (CVE-2020-9383). An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID- dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation (CVE-2020-9391). Security fixes and hardenings to the mac00211 layer to prevent leaking keys and frames. For other upstream fixes in this update, see the referenced changelogs. References: - https://bugs.mageia.org/show_bug.cgi?id=26426 - https://kernelnewbies.org/Linux_5.5 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.1 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.2 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.3 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.5 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.6 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.7 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.8 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.9 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.10 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.11 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.12 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.13 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.14 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.15 -https://www.cve.org/CVERecord?id=CVE-2019-19768 - https://www.cve.org/CVERecord?id=CVE-2019-19769 - https://www.cve.org/CVERecord?id=CVE-2020-2732 - https://www.cve.org/CVERecord?id=CVE-2020-8647 - https://www.cve.org/CVERecord?id=CVE-2020-8648 - https://www.cve.org/CVERecord?id=CVE-2020-8649 - https://www.cve.org/CVERecord?id=CVE-2020-8835 - https://www.cve.org/CVERecord?id=CVE-2020-9383 - https://www.cve.org/CVERecord?id=CVE-2020-9391 SRPMS: - 7/core/kernel-5.5.15-1.mga7 . The Mageia security advisory MGASA-2020-0158 identifies severe weaknesses within the kernel-linus packages, aiming to bolster system integrity and reliability.. Kernel-Linus Security, Mageia Advisory, Memory Safety, Vulnerability Fixes. . LinuxSecurity.com Team
Apr 03, 2020
Mageia
203
security advisorycriticalkernelMageia 7: 2020-0110 Critical: Kernel KVM Instruction Emulation Issue
This update is based on upstream 5.5.6 and fixes atleast the following security vulnerability: A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested(=1) virtualization is enabled. In the . MGASA-2020-0110 - Updated kernel packages fix security vulnerability Publication date: 29 Feb 2020 URL: https://advisories.mageia.org/MGASA-2020-0110.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-2732 This update is based on upstream 5.5.6 and fixes atleast the following security vulnerability: A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested(=1) virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to potentially access information of the L1 hypervisor (CVE-2020-2732). Other additional fixes in this update: - a fix for broken radeon on 32bit (mga#26237) - broken iwlwifi for some (mga#26248) - a bugfix for pipe optimization backported in the 5.5.4 update For other upstream fixes in this update, see the referenced changelogs. References: - https://bugs.mageia.org/show_bug.cgi?id=26258 - https://bugs.mageia.org/show_bug.cgi?id=26237 - https://bugs.mageia.org/show_bug.cgi?id=26248 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.5 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.6 - https://www.cve.org/CVERecord?id=CVE-2020-2732 SRPMS: - 7/core/kernel-5.5.6-2.mga7 - 7/core/kmod-virtualbox-6.0.18-4.mga7 - 7/core/kmod-xtables-addons-3.8-4.mga7 . Ubuntu 2021-0220 introduces vital patches aimed at resolving significant vulnerabilities in QEMU's device modeling, enhancing safety in containerized environments.. Mageia kernel update,KVM security fix,instruction emulation flaw,virtualization security,critical advisory. . Severity: Critical. LinuxSecurity.com Team
Feb 29, 2020
•Critical
Mageia
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!