{
  "schema_version": "1.7.0",
  "id": "MGASA-2019-0217",
  "published": "2019-08-03T21:18:59Z",
  "modified": "2022-02-17T18:21:47Z",
  "summary": "Updated kernel packages fix security vulnerability",
  "details": "This kernel update is based on the upstream 5.1.20 and fixes at least\nthe following security issue:\n\nWith Xen, virtual device backends and device models running in domain 0,\nor other backend driver domains, need to be able to map guest memory\n(either via grant mappings, or via the foreign mapping interface). For\nLinux to keep track of these mappings, it needs to have a page structure\nfor each one. In PV dom0, a range of pfns are typically set aside at boot\n(“pre-ballooned”) for this purpose; for PVH and Arm dom0s, no memory is\nset aside to begin with. In either case, when more of this “foreign / grant\nmap pfn space” is needed, dom0 will balloon out extra pages to use for this\npurpose. Unfortunately, in Linux, there are no limits, either on the total\namount of memory which dom0 will attempt to balloon down to, nor on the\namount of “foreign / grant map” memory which any individual guest can\nconsume. As a result, a malicious guest may be able, with crafted requests\nto the backend, to cause dom0 to exhaust its own memory, leading to a host\ncrash; and if this is not possible, it may be able to monopolize all of the\nforeign / grant map pfn space, starving out other guests (XSA-300).\n\nOther changes in this update:\n- kernel configs:\n  * enable Full dynticks system (tickless) (NO_HZ_FULL)\n  * enable CONFIG_RCU_NOCB_CPU (mga#24701)\n- add kernel side support for temperature monitoring on Amd Ryzen 3000\n  series (lm_sensors 3.5.0-2.1.mga7 or newer is also needed)\n\nFor other upstream changes in this update, see the referenced changelogs.\n\nNote! This is the last update that is based on the upstream 5.1 series.\n      Next update will be based on the upstream 5.2 series.\n",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2019-0217.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=25185"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=24701"
    },
    {
      "type": "ADVISORY",
      "url": "https://xenbits.xen.org/xsa/advisory-300.html"
    },
    {
      "type": "WEB",
      "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.19"
    },
    {
      "type": "WEB",
      "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.20"
    },
    {
      "type": "WEB",
      "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.21"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:7",
        "name": "kernel",
        "purl": "pkg:rpm/mageia/kernel?arch=source&distro=mageia-7"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.20-2.mga7"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    },
    {
      "package": {
        "ecosystem": "Mageia:7",
        "name": "kernel-userspace-headers",
        "purl": "pkg:rpm/mageia/kernel-userspace-headers?arch=source&distro=mageia-7"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.20-1.mga7"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    },
    {
      "package": {
        "ecosystem": "Mageia:7",
        "name": "kmod-virtualbox",
        "purl": "pkg:rpm/mageia/kmod-virtualbox?arch=source&distro=mageia-7"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.10-2.mga7"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    },
    {
      "package": {
        "ecosystem": "Mageia:7",
        "name": "kmod-xtables-addons",
        "purl": "pkg:rpm/mageia/kmod-xtables-addons?arch=source&distro=mageia-7"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3-56.mga7"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}