Advisories ยป MGASA-2018-0296

Updated kernel packages fix security vulnerabilities

Publication date: 24 Jun 2018
Modification date: 17 Feb 2022
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-6412 , CVE-2018-10853 , CVE-2018-12904

Description

This kernel update is based on the upstream 4.14.50 and fixes at least
the following security issues:

In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c
in the Linux kernel through 4.15, an integer signedness error allows
arbitrary information leakage for the FBIOPUTCMAP_SPARC and
FBIOGETCMAP_SPARC commands (CVE-2018-6412).

The kvm functions that were used in the emulation of fxrstor, fxsave,
sgdt and sidt were originally meant for task switching, and as such they
did not check privilege levels. This allowed guest userspace to guest
kernel write (CVE-2018-10853).

In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested
virtualization is used, local attackers could cause L1 KVM guests to
VMEXIT, potentially allowing privilege escalations and denial of service
attacks due to lack of checking of CPL (CVE-2018-12904).

WireGuard has been updated to 0.0.20180613.

For other fixes in this update, see the referenced changelogs.

References

SRPMS

6/core