Advisories » MGASA-2023-0008

Updated kernel-linus packages fix security vulnerabilities

Publication date: 22 Jan 2023
Modification date: 22 Jan 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-3424 , CVE-2022-3534 , CVE-2022-3545 , CVE-2022-3643 , CVE-2022-36280 , CVE-2022-41218 , CVE-2022-45934 , CVE-2022-47929 , CVE-2023-0210 , CVE-2023-0266 , CVE-2023-23454 , CVE-2023-23455

Description

This kernel-linus update is based on upstream 5.15.88 and fixes atleast
the following security issues:

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in
the way the first gru_file_unlocked_ioctl function is called by the user,
where a fail pass occurs in the gru_check_chiplet_assignment function.
This flaw allows a local user to crash or potentially escalate their
privileges on the system (CVE-2022-3424).

A vulnerability in the function btf_dump_name_dups of the file 
tools/lib/bpf/ btf_dump.c of the component libbpf. This flaw allows a
manipulation that may lea to a use-after-free issue (CVE-2022-3534).

A vulnerability was found in area_cache_get in drivers/net/ethernet/
netronome/nfp/nfpcore/nfp_cppcore.c in the Netronome Flow Processor (NFP)
driver in the Linux kernel. This flaw allows a manipulation that may lead
to a use-after-free issue (CVE-2022-3545).

Guests can trigger NIC interface reset/abort/crash via netback. It is
possible for a guest to trigger a NIC interface reset/abort/crash in a
Linux based network backend by sending certain kinds of packets. It appears
to be an (unwritten?) assumption in the rest of the Linux network stack
that packet  protocol headers are all contained within the linear section
of the SKB and some NICs behave badly if this is not the case. This has
been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780
(bnx2x) though it may be an issue with other NICs/drivers as well. In case
the frontend is sending requests with split headers, netback will forward
those violating above mentioned assumption to the networking core,
resulting in said misbehavior (CVE-2022-3643, XSA-423).

An out-of-bounds memory write vulnerability was found in the Linux kernel
vmwgfx driver in vmw_kms_cursor_snoop due to a missing check of a memcpy
length. This flaw allows a local, unprivileged attacker with access to
either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an
ioctl() on the resulting file descriptor, to crash the system, causing
a denial of service (CVE-2022-36280).

A use-after-free flaw was found in the Linux kernel’s dvb-core subsystem
(DVB API used by Digital TV devices) in how a user physically removed a
USB device (such as a DVB demultiplexer device) while running malicious
code. This flaw allows a local user to crash or potentially escalate their
privileges on the system (CVE-2022-41218).

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req
in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ
packets (CVE-2022-45934).

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the
traffic control subsystem allows an unprivileged user to trigger a denial
of service (system crash) via a crafted traffic control configuration that
is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft
in net/sched/sch_api.c (CVE-2022-47929).

A vulnerability in the kernel ksmbd allows a remote attacker to perform a
denial of service (DoS) attack. The vulnerability exists due to a boundary
error within the ksmbd_decode_ntlmssp_auth_blob() function in ksmbd when
handling NTLMv2 authentication. A remote attacker can send specially
crafted data to ksmbd, trigger a heap-based buffer overflow and perform a
denial of service (DoS) attack (CVE-2023-0210).

ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
(CVE-2023-0266).

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows
attackers to cause a denial of service (slab-out-of-bounds read) because of
type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT
condition rather than valid classification results) (CVE-2023-23454).

atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4
allows attackers to cause a denial of service because of type confusion
(non-negative numbers can sometimes indicate a TC_ACT_SHOT condition
rather than valid classification results) (CVE-2023-23455).

For other upstream fixes in this update, see the referenced changelogs.

References

SRPMS

8/core