Advisories ยป MGASA-2023-0328

Updated kernel packages fix security vulnerabilities and other bugs

Publication date: 28 Nov 2023
Modification date: 28 Nov 2023
Type: security
Affected Mageia releases : 9
CVE: CVE-2020-26555 , CVE-2023-3772 , CVE-2023-3773 , CVE-2023-4155 , CVE-2023-5090 , CVE-2023-5178 , CVE-2023-5345 , CVE-2023-5633 , CVE-2023-5717 , CVE-2023-6176 , CVE-2023-25775 , CVE-2023-34319 , CVE-2023-34324 , CVE-2023-39189 , CVE-2023-46813

Description

This kernel update is based on upstream 6.5.11 and fixes or adds
mitigations for at least the following security issues:

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c`
in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP
subsystem in the Linux kernel. This issue may allow a malicious user to
cause a use-after-free and double-free problem, which may permit remote
code execution or lead to local privilege escalation in case that the
attacker already has local privileges. (CVE-2023-5178)

x86: KVM: SVM: always update the x2avic msr interception:
The following problem exists since x2avic was enabled in the KVM:
svm_set_x2apic_msr_interception is called to enable the interception of
the x2apic msrs.
In particular it is called at the moment the guest resets its apic.
Assuming that the guest's apic is in x2apic mode, the reset will bring
it back to the xapic mode.
The svm_set_x2apic_msr_interception however has an erroneous check for
'!apic_x2apic_mode()' which prevents it from doing anything in this case.
As a result of this, all x2apic msrs are left unintercepted, and that
exposes the bare metal x2apic (if enabled) to the guest.
Removing the erroneous '!apic_x2apic_mode()' check fixes that.
(CVE-2023-5090)

In unprivileged Xen guests event handling can cause a deadlock with
Xen console handling. The evtchn_rwlock and the hvc_lock are taken in
opposite sequence in __hvc_poll() and in Xen console IRQ handling.
This is fixed by xen/events: replace evtchn_rwlock with RCU
(CVE-2023-34324)

A use-after-free vulnerability in the Linux kernel's fs/smb/client
component can be exploited to achieve local privilege escalation. In
case of an error in smb3_fs_context_parse_param, ctx->password was freed
but the field was not set to NULL which could lead to double free. We
recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705
(CVE-2023-5345)

A flaw was found in the Netfilter subsystem in the Linux kernel. The
nfnl_osf_add_callback function did not validate the user mode controlled
opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)
attacker to trigger an out-of-bounds read, leading to a crash or
information disclosure. (CVE-2023-39189)

The reference count changes made as part of the CVE-2023-33951 and
CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory
objects were handled when they were being used to store a surface. When
running inside a VMware guest with 3D acceleration enabled, a local,
unprivileged user could potentially use this flaw to escalate their
privileges. (CVE-2023-5633)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux
Kernel Performance Events (perf) component can be exploited to achieve
local privilege escalation. If perf_read_group() is called while an
event's sibling_list is smaller than its child's sibling_list, it can
increment or write to memory locations outside of the allocated buffer.
We recommend upgrading past commit
32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

An issue was discovered in the Linux kernel before 6.5.9, exploitable by
local users with userspace access to MMIO registers. Incorrect access
checking in the #VC handler and instruction emulation of the SEV-ES
emulation of MMIO accesses could lead to arbitrary write access to
kernel memory (and thus privilege escalation). This depends on a race
condition through which userspace can replace an instruction before the
#VC handler reads it. (CVE-2023-46813)

A null pointer dereference flaw was found in the Linux kernel API for
the cryptographic algorithm scatterwalk functionality. This issue occurs
when a user constructs a malicious packet with specific socket
configuration, which could allow a local user to crash the system or
escalate their privileges on the system. (CVE-2023-6176)

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification
1.0B through 5.2 may permit an unauthenticated nearby device to spoof
the BD_ADDR of the peer device to complete pairing without knowledge of
the PIN. (CVE-2020-26555)

A flaw was found in the Linux kernel's IP framework for transforming
packets (XFRM subsystem). This issue may allow a malicious user with
CAP_NET_ADMIN privileges to directly dereference a NULL pointer in
xfrm_update_ae_params(), leading to a possible kernel crash and denial
of service. (CVE-2023-3772)

A flaw was found in the Linux kernel's IP framework for transforming
packets (XFRM subsystem). This issue may allow a malicious user with
CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of
XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to
potential leakage of sensitive heap data to userspace. (CVE-2023-3773)

A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the
Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs
can trigger a double fetch race condition vulnerability and invoke the
`VMGEXIT` handler recursively. If an attacker manages to call the handler
multiple times, they can trigger a stack overflow and cause a denial of
service or potentially guest-to-host escape in kernel configurations
without stack guard pages (`CONFIG_VMAP_STACK`). (CVE-2023-4155) 

Improper access control in the Intel(R) Ethernet Controller RDMA driver
for linux before version 1.9.30 may allow an unauthenticated user to
potentially enable escalation of privilege via network access.
(CVE-2023-25775)

The fix for XSA-423 added logic to Linux'es netback driver to deal with
a frontend splitting a packet in a way such that not all of the headers
would come in one piece. Unfortunately the logic introduced there didn't
account for the extreme case of the entire packet being split into as
many pieces as permitted by the protocol, yet still being smaller than
the area that's specially dealt with to keep all (possible) headers
together. Such an unusual packet would therefore trigger a buffer
overrun in the driver. (CVE-2023-34319) 

And fixes at least one normal bug about sleep lockups: (bug #32082)

References

SRPMS

9/core