Advisories » MGASA-2019-0333

Updated kernel-linus packages fix security vulnerabilities

Publication date: 19 Nov 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-0155 , CVE-2019-1125 , CVE-2019-10207 , CVE-2019-11135 , CVE-2018-12207 , CVE-2019-14814 , CVE-2019-14815 , CVE-2019-14816 , CVE-2019-14821 , CVE-2019-14835 , CVE-2019-16714 , CVE-2019-17666


This kernel-linus update is based on the upstream 5.3.11 and fixes at least
the following security issues:

Insufficient access control in a subsystem for Intel (R) processor graphics
may allow an authenticated user to potentially enable escalation of
privilege via local access (CVE-2019-0155).

A Spectre SWAPGS gadget was found in the Linux kernel's implementation of
system interrupts. An attacker with local access could use this information
to reveal private data through a Spectre like side channel (CVE-2019-1125).

A flaw was found in the Linux kernel’s Bluetooth implementation of UART.
An attacker with local access and write permissions to the Bluetooth
hardware could use this flaw to issue a specially crafted ioctl function
call and cause the system to crash (CVE-2019-10207).

TSX Asynchronous Abort condition on some CPUs utilizing speculative
execution may allow an authenticated user to potentially enable
information disclosure via a side channel with local access

Improper invalidation for page table updates by a virtual guest operating
system for multiple Intel(R) Processors may allow an authenticated user to
potentially enable denial of service of the host system via local access

For proper mitigations and fixes for theese issues, a microcode update is
also needed, either with a bios/uefi update from your hardware vendor or
by installing the microcode-0.20191112-1.mga7.nonfree update (mga#25688).

There is heap-based buffer overflow in the marvell wifi chip driver that
allows local users to cause a denial of service(system crash) or possibly
execute arbitrary code (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816).

An out-of-bounds access issue was found in the way Linux kernel's KVM
hypervisor implements the Coalesced MMIO write operation. It operates on
an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write
indices 'ring->first' and 'ring->last' value could be supplied by a host
user-space process. An unprivileged host user or process with access to
'/dev/kvm' device could use this flaw to crash the host kernel, resulting
in a denial of service or potentially escalating privileges on the system

A buffer overflow flaw was found in the way Linux kernel's vhost
functionality that translates virtqueue buffers to IOVs, logged the buffer
descriptors during migration. A privileged guest user able to pass
descriptors with invalid length to the host when migration is underway,
could use this flaw to increase their privileges on the host

In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c
allows attackers to obtain sensitive information from kernel stack memory
because tos and flags fields are not initialized (CVE-2019-16714)

rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux
kernel through 5.3.6 lacks a certain upper-bound check, leading to a
buffer overflow (CVE-2019-17666)

For other upstream fixes in this update, see the referenced changelogs.