Advisories ยป MGASA-2021-0257

Updated kernel packages fix security vulnerabilities

Publication date: 13 Jun 2021
Modification date: 17 Feb 2022
Type: security
Affected Mageia releases : 7 , 8
CVE: CVE-2020-24586 , CVE-2020-24587 , CVE-2020-24588 , CVE-2020-26139 , CVE-2020-26141 , CVE-2020-26145 , CVE-2020-26147 , CVE-2021-3573 , CVE-2021-28691 , CVE-2021-38208

Description

This kernel update is based on upstream 5.10.43 and fixes at least the
following security issues:

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and
WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received
fragments be cleared from memory after (re)connecting to a network. Under
the right circumstances, when another device sends fragmented frames
encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary
network packets and/or exfiltrate user data (CVE-2020-24586).

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and
WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments
of a frame are encrypted under the same key. An adversary can abuse this to
decrypt selected fragments when another device sends fragmented frames and
the WEP, CCMP, or GCMP encryption key is periodically renewed
(CVE-2020-24587).

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and
WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU
flag in the plaintext QoS header field is authenticated. Against devices
that support receiving non-SSP A-MSDU frames (which is mandatory as part
of 802.11n), an adversary can abuse this to inject arbitrary network
packets (CVE-2020-24588).

An issue was discovered in the kernel. An Access Point (AP) forwards EAPOL
frames to other clients even though the sender has not yet successfully
authenticated to the AP. This might be abused in projected Wi-Fi networks
to launch denial-of-service attacks against connected clients and makes
it easier to exploit other vulnerabilities in connected clients
(CVE-2020-26139).

An issue was discovered in the kernel ath10k driver. The Wi-Fi
implementation does not verify the Message Integrity Check (authenticity)
of fragmented TKIP frames. An adversary can abuse this to inject and
possibly decrypt packets in WPA or WPA2 networks that support the TKIP
data-confidentiality protocol (CVE-2020-26141). 

An issue was discovered in the kernel ath10k driver. The WEP, WPA, WPA2,
and WPA3 implementations accept second (or subsequent) broadcast fragments
even when sent in plaintext and process them as full unfragmented frames.
An adversary can abuse this to inject arbitrary network packets independent
of the network configuration (CVE-2020-26145).

An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and
WPA3 implementations reassemble fragments even though some of them were
sent in plaintext. This vulnerability can be abused to inject packets and/
or exfiltrate selected fragments when another device sends fragmented
frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used
(CVE-2020-26147).

A use after free vulnerability has been found in the hci_sock_bound_ioctl()
function of the Linux kernel. It can allow attackers to corrupt kernel
heaps (kmalloc-8k to be specific) and adopt further exploitations
(CVE-2021-3573).

There is a guest triggered use-after-free in Linux xen-netback. A malicious
or buggy network PV frontend can force Linux netback to disable the
interface and terminate the receive kernel thread associated with queue 0
in response to the frontend sending a malformed packet. Such kernel thread
termination will lead to a use-after-free in Linux netback when the backend
is destroyed, as the kernel thread associated with queue 0 will have already
exited and thus the call to kthread_stop will be performed against a stale
pointer. A malicious or buggy frontend driver can trigger a dom0 crash.
Privilege escalation and information leaks cannot be ruled out.
(CVE-2021-28691 / XSA-374).

There is a null pointer dereference in llcp_sock_getname in net/nfc/
llcp_sock.c of the Linux kernel. An unprivileged user can trigger this bug
and cause denial of service (CVE-2021-38208).

Other fixes in this update:
- bpf: Forbid trampoline attach for functions with variable arguments
- bpf: Add deny list of btf ids check for tracing programs
- net/nfc/rawsock.c: fix a permission check bug
- proc: Track /proc/$pid/attr/ opener mm_struct
- RDS tcp loopback connection can hang

For other upstream fixes, see the referenced changelogs.

References

SRPMS

7/core

8/core