Advisories ยป MGASA-2021-0409

Updated kernel packages fix security vulnerabilities

Publication date: 23 Aug 2021
Modification date: 17 Feb 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2020-3702 , CVE-2021-3653 , CVE-2021-3656 , CVE-2021-38166 , CVE-2021-38205

Description

This kernel update is based on upstream 5.10.60 and fixes at least the
following security issues:

Specifically timed and handcrafted traffic can cause internal errors
in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a
consequent possibility of information disclosure over the air for a
discrete set of traffic in ath9k (CVE-2020-3702).

A missing validation of the "int_ctl" VMCB field allows a malicious L1
guest to enable AVIC support (Advanced Virtual Interrupt Controller)
for the L2 guest. The L2 guest is able to write to a limited but still
relatively large subset of the host physical memory, resulting in a
crash of the entire system, leak of sensitive data or potential
guest-to-host escape (CVE-2021-3653).

A missing validation of the the "virt_ext" VMCB field and allows a
malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS
(Virtual VMLOAD/VMSAVE) for the L2 guest. Under these circumstances,
the L2 guest is able to run VMLOAD/VMSAVE unintercepted, and thus
read/write portions of the host physical memory, resulting in a
crash of the entire system, leak of sensitive data or potential
guest-to-host escape (CVE-2021-3656).

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is
an integer overflow and out-of-bounds write when many elements are
placed in a single bucket (CVE-2021-38166).

drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before
5.13.3 makes it easier for attackers to defeat an ASLR protection
mechanism because it prints a kernel pointer (CVE-2021-38205).

Other fixes in this update:
- cfi_cmdset_0002: fix crash when erasing/writing AMD cards

For other upstream fixes, see the referenced changelogs.

References

SRPMS

8/core