MGASA-2019-0221
- Source
- https://advisories.mageia.org/MGASA-2019-0221.html
- Import Source
- https://advisories.mageia.org/MGASA-2019-0221.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2019-0221
- Related
- Published
- 2019-08-12T21:08:18Z
- Modified
- 2022-02-17T18:21:47Z
- Summary
- Updated kernel packages fix security vulnerabilities
- Details
-
This kernel update is based on the upstream 4.14.137 and fixes at least the following security issues:
A Spectre SWAPGS gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reveal private data through a Spectre like side channel (CVE-2019-1125).
A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (CVE-2019-3846).
An infinite loop issue was found in the vhostnet kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handlerx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario (CVE-2019-3900).
A flaw was found in the Linux kernelâs Bluetooth implementation of UART. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash (CVE-2019-10207).
WireGuard has been updated to 0.0.20190702.
For other uptstream fixes in this update, see the referenced changelogs.
- References
-
- https://advisories.mageia.org/MGASA-2019-0221.html
- https://bugs.mageia.org/show_bug.cgi?id=25239
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.132
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.133
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.134
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.135
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.136
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.137
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:6 / kernel
Package
- Name
- kernel
- Purl
- pkg:rpm/mageia/kernel?distro=mageia-6
Mageia:6 / kernel-userspace-headers
Package
- Name
- kernel-userspace-headers
- Purl
- pkg:rpm/mageia/kernel-userspace-headers?distro=mageia-6
Mageia:6 / kmod-vboxadditions
Package
- Name
- kmod-vboxadditions
- Purl
- pkg:rpm/mageia/kmod-vboxadditions?distro=mageia-6
Mageia:6 / kmod-virtualbox
Package
- Name
- kmod-virtualbox
- Purl
- pkg:rpm/mageia/kmod-virtualbox?distro=mageia-6
Mageia:6 / kmod-xtables-addons
Package
- Name
- kmod-xtables-addons
- Purl
- pkg:rpm/mageia/kmod-xtables-addons?distro=mageia-6
Mageia:6 / wireguard-tools
Package
- Name
- wireguard-tools
- Purl
- pkg:rpm/mageia/wireguard-tools?distro=mageia-6