Advisories ยป MGASA-2022-0379

Updated kernel packages fix security vulnerabilities

Publication date: 23 Oct 2022
Modification date: 27 Nov 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-0171 , CVE-2022-2308 , CVE-2022-2663 , CVE-2022-3061 , CVE-2022-3303 , CVE-2022-3586 , CVE-2022-20421 , CVE-2022-39842 , CVE-2022-40307 , CVE-2022-40768 , CVE-2022-41674 , CVE-2022-42719 , CVE-2022-42720 , CVE-2022-42721 , CVE-2022-42722

Description

This kernel update is based on upstream 5.15.74 and fixes at least the
following security issues:

A flaw was found in the Linux kernel. The existing KVM SEV API has a
vulnerability that allows a non-root (host) user-level application to
crash the host kernel by creating a confidential guest VM instance in
AMD CPU that supports Secure Encrypted Virtualization (SEV)
(CVE-2022-0171).

A flaw was found in vDPA with VDUSE backend. There are currently no checks
in VDUSE kernel driver to ensure the size of the device config space is in
line with the features advertised by the VDUSE userspace application. In
case of a mismatch, Virtio drivers config read helpers do not initialize
the memory indirectly passed to vduse_vdpa_get_config() returning
uninitialized memory from the stack. This could cause undefined behavior or
data leaks in Virtio drivers (CVE-2022-2308).

An issue was found in the Linux kernel in nf_conntrack_irc where the
message handling can be confused and incorrectly matches the message.
A firewall may be able to be bypassed when users are using unencrypted
IRC with nf_conntrack_irc configured (CVE-2022-2663).

A flaw in the i740 driver. The Userspace program could pass any values
to the driver through ioctl() interface. The driver doesn't check the
value of 'pixclock', so it may cause a divide by zero error
(CVE-2022-3061).

A race condition flaw was found in the Linux kernel sound subsystem due
to improper locking. It could lead to a NULL pointer dereference while
handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or
member of the audio group) could use this flaw to crash the system,
resulting in a denial of service condition (CVE-2022-3303).

A flaw was found in the Linux kernel networking code. A use-after-free
was found in the way the sch_sfb enqueue function used the socket buffer
(SKB) cb field after the same SKB had been enqueued (and freed) into a
child qdisc. This flaw allows a local, unprivileged user to crash the
system, causing a denial of service (CVE-2022-3586).

In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt
memory due to a use after free. This could lead to local escalation of
privilege with no additional execution privileges needed. User interaction
is not needed for exploitation (CVE-2022-20421).

An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write
in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict
of size_t versus int, causing an integer overflow and bypassing the size
check. After that, because it is used as the third argument to
copy_from_user(), a heap overflow may occur (CVE-2022-39842).

An issue was discovered in the Linux kernel through 5.19.8.
drivers/firmware/efi/capsule-loader.c has a race condition with a resultant
use-after-free (CVE-2022-40307).

drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users
to obtain sensitive information from kernel memory because
stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case
(CVE-2022-40768).

An issue was discovered in the Linux kernel before 5.19.16. Attackers able
to inject WLAN frames could cause a buffer overflow in the
ieee80211_bss_info_update function in net/mac80211/scan.c (CVE-2022-41674).

A use-after-free in the mac80211 stack when parsing a multi-BSSID element
in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by
attackers (able to inject WLAN frames) to crash the kernel and potentially
execute code (CVE-2022-42719).

Various refcounting bugs in the multi-BSS handling in the mac80211 stack
in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by
local attackers (able to inject WLAN frames) to trigger use-after-free
conditions to potentially execute code (CVE-2022-42720).

A list management bug in BSS handling in the mac80211 stack in the Linux
kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers
(able to inject WLAN frames) to corrupt a linked list and, in turn,
potentially execute code (CVE-2022-42721).

In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers
able to inject WLAN frames into the mac80211 stack could cause a NULL
pointer dereference denial-of-service attack against the beacon protection
of P2P devices (CVE-2022-42722).

For other upstream fixes in this update, see the referenced changelogs.

References

SRPMS

8/core