Advisories ยป MGASA-2018-0337

Updated kernel packages fix security vulnerabilities

Publication date: 12 Aug 2018
Modification date: 17 Feb 2022
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-5390 , CVE-2018-14678

Description

This kernel update is based on the upstream 4.14.62 and fixes at least
the following security issues:

Security researchers from FICORA have identified a remote denial of
service attack against the Linux kernel caused by inefficient
implementation of TCP segment reassembly, named "SegmentSmack".
A remote attacker could consume a lot of CPU resources in the kernel
networking stack with just a low bandwidth or single host attack by
using lots of small TCP segments packets. Usually large botnets are
needed for similar effect. The rate needed for this denial of service
attack to be effective is several magnitudes lower than the usual
packet processing capability of the machine, as the attack exploits
worst case behaviour of existing algorithms (CVE-2018-5390).

An issue was discovered in the Linux kernel through 4.17.11, as used
in Xen through 4.11.x. The xen_failsafe_callback entry point in 
arch/x86/entry/entry_64.S does not properly maintain RBX, which allows
local users to cause a denial of service (uninitialized memory usage
and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can
trigger a guest OS crash or possibly gain privileges (CVE-2018-14678).

Other changes in this update:
* WireGuard has been updated to 0.0.20180802.

For other upstream fixes in this update, see the referenced changelogs.

References

SRPMS

6/core