Advisories » MGASA-2023-0007

Updated kernel packages fix security vulnerabilities

Publication date: 22 Jan 2023
Modification date: 22 Jan 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-3424 , CVE-2022-3534 , CVE-2022-3545 , CVE-2022-36280 , CVE-2022-41218 , CVE-2022-45934 , CVE-2022-47929 , CVE-2023-0179 , CVE-2023-0210 , CVE-2023-0266 , CVE-2023-23454 , CVE-2023-23455

Description

This kernel update is based on upstream 5.15.88 and fixes atleast the
following security issues:

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in
the way the first gru_file_unlocked_ioctl function is called by the user,
where a fail pass occurs in the gru_check_chiplet_assignment function.
This flaw allows a local user to crash or potentially escalate their
privileges on the system (CVE-2022-3424).

A vulnerability in the function btf_dump_name_dups of the file 
tools/lib/bpf/ btf_dump.c of the component libbpf. This flaw allows a
manipulation that may lea to a use-after-free issue (CVE-2022-3534).

A vulnerability was found in area_cache_get in drivers/net/ethernet/
netronome/nfp/nfpcore/nfp_cppcore.c in the Netronome Flow Processor (NFP)
driver in the Linux kernel. This flaw allows a manipulation that may lead
to a use-after-free issue (CVE-2022-3545).

An out-of-bounds memory write vulnerability was found in the Linux kernel
vmwgfx driver in vmw_kms_cursor_snoop due to a missing check of a memcpy
length. This flaw allows a local, unprivileged attacker with access to
either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an
ioctl() on the resulting file descriptor, to crash the system, causing
a denial of service (CVE-2022-36280).

A use-after-free flaw was found in the Linux kernel’s dvb-core subsystem
(DVB API used by Digital TV devices) in how a user physically removed a
USB device (such as a DVB demultiplexer device) while running malicious
code. This flaw allows a local user to crash or potentially escalate their
privileges on the system (CVE-2022-41218).

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req
in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ
packets (CVE-2022-45934).

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the
traffic control subsystem allows an unprivileged user to trigger a denial
of service (system crash) via a crafted traffic control configuration that
is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft
in net/sched/sch_api.c (CVE-2022-47929).

A buffer overflow vulnerability was found in the Netfilter subsystem in the
Linux Kernel. This issue could allow the leakage of both stack and heap
addresses, and potentially allow Local Privilege Escalation to the root
user via arbitrary code execution (CVE-2023-0179).

A vulnerability in the kernel ksmbd allows a remote attacker to perform a
denial of service (DoS) attack. The vulnerability exists due to a boundary
error within the ksmbd_decode_ntlmssp_auth_blob() function in ksmbd when
handling NTLMv2 authentication. A remote attacker can send specially
crafted data to ksmbd, trigger a heap-based buffer overflow and perform a
denial of service (DoS) attack (CVE-2023-0210).

ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
(CVE-2023-0266).

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows
attackers to cause a denial of service (slab-out-of-bounds read) because of
type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT
condition rather than valid classification results) (CVE-2023-23454).

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4
allows attackers to cause a denial of service because of type confusion
(non-negative numbers can sometimes indicate a TC_ACT_SHOT condition
rather than valid classification results) (CVE-2023-23455).

Other fixes in this update:
- fixes broken sound on Intel Tiger Lake systems (regression in kernel
  5.15.82 released in MGASA-2022-0477 (mga #31319).
- xtables-addons have been updated to 3.23.

For other upstream fixes in this update, see the referenced changelogs.

References

SRPMS

8/core