MGASA-2018-0126: kernel-tmb Mageia
Published
Published 15-02-2018Last modified 16-04-2026
Vulnerability summary
MGASA-2018-0126 is a vulnerability in kernel-tmb Mageia with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 4 · Downstream 0Timeline
- 15-02-2018PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated kernel-tmb packages fix security vulnerabilities This kernel-tmb update is based on the upstream 4.14.18 and adds some support for mitigating Spectre, variant 1 (CVE-2017-5753) and as it is built with the retpoline-aware gcc-5.5.0-1.mga6, it now provides full retpoline mitigation for Spectre, variant 2 (CVE-2017-5715). The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715. To make attacker job harder introduce BPF_JIT_ALWAYS_ON config option that removes interpreter from the kernel in favor of JIT-only mode. This is now enabled by default in Mageia kernels. Other security fixes in this update: Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner (CVE-2017-1000410). The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (CVE-2017-8824). WireGuard has been updated to 0.0.20180202 This update also fixes the rtl8812au driver that got broken/missing in the upgrade to 4.14 series kernels (mga#22524). For other fixes in this update, read the referenced changelogs.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Mageia1 product
- kernel-tmb< 4.14.18-1.mga6
1 vendor · 1 product
References
8 linksRelated vulnerabilities
Insufficient evidenceMGASA-2019-0196mageia · kernel-tmbmageia kernel-tmbUpdated kernel-tmb packages fix security vulnerability
This kernel-tmb update is based on the upstream 4.14.127 and fixes at least
the following security issues:
Jonathan Looney discovered that it is possible to send a crafted sequence
of SACKs which will fragment the RACK send map. An attacker may be able to
further exploit the fragmented send map to cause an expensive linked-list
walk for subsequent SACKs received for that same TCP connection
(CVE-2019-5599).
A flaw was found in the Linux kernel's freescale hypervisor manager
implementation. A parameter passed via to an ioctl was incorrectly
validated and used in size calculations for the page size calculation.
An attacker can use this flaw to crash the system or corrupt memory
or, possibly, create other adverse security affects (CVE-2019-10142).
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value
was subject to an integer overflow in the Linux kernel when handling TCP
Selective Acknowledgments (SACKs). A remote attacker could use this to
cause a denial of service (CVE-2019-11477).
Jonathan Looney discovered that the TCP retransmission queue implementation
in tcp_fragment in the Linux kernel could be fragmented when handling
certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker
could use this to cause a denial of service (CVE-2019-11478).
Jonathan Looney discovered that the Linux kernel default MSS is hard-coded
to 48 bytes. This allows a remote peer to fragment TCP resend queues
significantly more than if a larger MSS were enforced. A remote attacker
could use this to cause a denial of service (CVE-2019-11479).
fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out
the unused memory region in the extent tree block, which might allow
local users to obtain sensitive information by reading uninitialized
data in the filesystem (CVE-2019-11833).
It also fixes an upstream regression that caused older 'legacy'
bluetooth adapters to stop working (mga #24840).
WireGuard has been updated to 0.0.20190601.
For other uptstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2019-0171mageia · kernel-tmbmageia kernel-tmbUpdated kernel-tmb packages fixes security vulnerabilities
This kernel update provides the upstream 4.14.119 that adds the kernel side
mitigations for the Microarchitectural Data Sampling (MDS, also called
ZombieLoad attack) vulnerabilities in Intel processors that can allow
attackers to retrieve data being processed inside a CPU. To complete the
mitigations new microcode is also needed, either by installing the
microcode-0.20190514-1.mga6 package, or get an updated bios / uefi
firmware from the motherboard vendor.
The fixed / mitigated issues are:
Modern Intel microprocessors implement hardware-level micro-optimizations
to improve the performance of writing data back to CPU caches. The write
operation is split into STA (STore Address) and STD (STore Data)
sub-operations. These sub-operations allow the processor to hand-off
address generation logic into these sub-operations for optimized writes.
Both of these sub-operations write to a shared distributed processor
structure called the 'processor store buffer'. As a result, an
unprivileged attacker could use this flaw to read private data resident
within the CPU's processor store buffer. (CVE-2018-12126)
Microprocessors use a ‘load port’ subcomponent to perform load operations
from memory or IO. During a load operation, the load port receives data
from the memory or IO subsystem and then provides the data to the CPU
registers and operations in the CPU’s pipelines. Stale load operations
results are stored in the 'load port' table until overwritten by newer
operations. Certain load-port operations triggered by an attacker can be
used to reveal data about previous stale requests leaking data back to the
attacker via a timing side-channel. (CVE-2018-12127)
A flaw was found in the implementation of the "fill buffer", a mechanism
used by modern CPUs when a cache-miss is made on L1 CPU cache. If an
attacker can generate a load operation that would create a page fault,
the execution will continue speculatively with incorrect data from the
fill buffer while the data is fetched from higher level caches. This
response time can be measured to infer data in the fill buffer.
(CVE-2018-12130)
Uncacheable memory on some microprocessors utilizing speculative execution
may allow an authenticated user to potentially enable information disclosure
via a side channel with local access. (CVE-2019-11091)
It also fixes at least the following security issues:
Cross-hyperthread Spectre v2 mitigation is now provided by the Single
Thread Indirect Branch Predictors (STIBP) support. Note that STIBP also
requires the functionality be supported by the Intel microcode in use.
It was found that cephx authentication protocol did not verify ceph clients
correctly and was vulnerable to replay attack. Any attacker having access
to ceph cluster network who is able to sniff packets on network can use
this vulnerability to authenticate with ceph service and perform actions
allowed by ceph service (CVE-2018-1128).
A flaw was found in the way signature calculation was handled by cephx
authentication protocol. An attacker having access to ceph cluster network
who is able to alter the message payload was able to bypass signature
checks done by cephx protocol (CVE-2018-1129).
A flaw was found in the Linux Kernel where an attacker may be able to have
an uncontrolled read to kernel-memory from within a vm guest. A race
condition between connect() and close() function may allow an attacker
using the AF_VSOCK protocol to gather a 4 byte information leak or possibly
intercept or corrupt AF_VSOCK messages destined to other clients
(CVE-2018-14625).
A security flaw was found in the Linux kernel in a way that the cleancache
subsystem clears an inode after the final file truncation (removal). The
new file created with the same inode may contain leftover pages from
cleancache and the old file data instead of the new one (CVE-2018-16862).
A use-after-free issue was found in the way the Linux kernel's KVM
hypervisor processed posted interrupts when nested(=1) virtualization is
enabled. In nested_get_vmcs12_pages(), in case of an error while
processing posted interrupt address, it unmaps the 'pi_desc_page' without
resetting 'pi_desc' descriptor address, which is later used in
pi_test_and_clear_on(). A guest user/process could use this flaw to crash
the host kernel resulting in DoS or potentially gain privileged access to
a system (CVE-2018-16882).
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares
mounted in different network namespaces at the same time can make
bc_svc_process() use wrong back-channel IDs and cause a use-after-free
vulnerability. Thus a malicious container user can cause a host kernel
memory corruption and a system panic. Due to the nature of the flaw,
privilege escalation cannot be fully ruled out (CVE-2018-16884).
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles
access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing
local users to write data into holes in a tmpfs file (if the user has
read-only access to that file, and that file contains holes)
(CVE-2018-18397).
In the Linux kernel through 4.19.6, a local user could exploit a
use-after-free in the ALSA driver by supplying a malicious USB Sound device
(with zero interfaces) (CVE-2018-19824).
A flaw was found in the Linux kernel in the function hso_probe() which
reads if_num value from the USB device (as an u8) and uses it without a
length check to index an array, resulting in an OOB memory read in
hso_probe() or hso_get_config_data(). An attacker with a forged USB
device and physical access to a system (needed to connect such a device)
can cause a system crash and a denial of service (CVE-2018-19985).
Linux kernel version at least v4.8 onwards, probably well before
contains a Insufficient input validation vulnerability in bnx2x network
card driver that can result in DoS: Network card firmware assertion takes
card off-line. This attack appear to be exploitable via An attacker on a
must pass a very large, specially crafted packet to the bnx2x card.
This can be done from an untrusted guest VM (CVE-2018-1000026)
An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux
kernel through 4.19.13. The CAN frame modification rules allow bitwise
logical operations that can be also applied to the can_dlc field. Because
of a missing check, the CAN drivers may write arbitrary content beyond
the data registers in the CAN controller's I/O memory when processing
can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel.
An unprivileged user can trigger a system crash (general protection fault)
(CVE-2019-3701).
A flaw was found in the Linux kernel in the function hid_debug_events_read()
in drivers/hid/hid-debug.c file which may enter an infinite loop with
certain parameters passed from a userspace. A local privileged user ("root")
can cause a system lock up and a denial of service (CVE-2019-3819).
A flaw was found in the Linux kernel's vfio interface implementation that
permits violation of the user's locked memory limit. If a device is bound
to a vfio driver, such as vfio-pci, and the local attacker is
administratively granted ownership of the device, it may cause a system
memory exhaustion and thus a denial of service (DoS) (CVE-2019-3882).
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in
virt/kvm/kvm_main.c mishandles reference counting because of a race
condition, leading to a use-after-free (CVE-2019-6974).
A use-after-free vulnerability was found in the way the Linux kernel's KVM
hypervisor emulates a preemption timer for L2 guests when nested (=1)
virtualization is enabled. This high resolution timer(hrtimer) runs when
a L2 guest is active. After VM exit, the sync_vmcs12() timer object is
stopped. The use-after-free occurs if the timer object is freed before
calling sync_vmcs12() routine. A guest user/process could use this flaw
to crash the host kernel resulting in a denial of service or, potentially,
gain privileged access to a system (CVE-2019-7221).
An information leakage issue was found in the way Linux kernel's KVM
hypervisor handled page fault exceptions while emulating instructions
like VMXON, VMCLEAR, VMPTRLD, and VMWRITE with memory address as an
operand. It occurs if the operand is a mmio address, as the returned
exception object holds uninitialized stack memory contents. A guest
user/process could use this flaw to leak host's stack memory contents
to a guest (CVE-2019-7222).
kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable
out-of-bounds speculation on pointer arithmetic in various cases, including
cases of different branches with different state or limits to sanitize,
leading to side-channel attacks (CVE-2019-7308).
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks
a check for the mmap minimum address, which makes it easier for attackers
to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is
related to a capability check for the wrong task (CVE-2019-9213).
The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the
Linux kernel before 5.0.8 has multiple race conditions (CVE-2019-11486).
The coredump implementation in the Linux kernel before 5.0.10 does not use
locking or other mechanisms to prevent vma layout or vma flags changes while
it runs, which allows local users to obtain sensitive information, cause a
denial of service, or possibly have unspecified other impact by triggering
a race condition with mmget_not_zero or get_task_mm calls (CVE-2019-11599).
It also fixes signal handling issues causing powertop to crash and some
tracing tools to fail on execve tests.
Ndiswrapper has been updated to 1.62
WireGuard has been updated to 0.0.20190406.
For other uptstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2018-0418mageia · kernel-tmbmageia kernel-tmbUpdated kernel-tmb packages fix security vulnerabilities
This kernel-tmb update is based on the upstream 4.14.78 and adds additional
fixes for the L1TF security issues. It also fixes at least the following
security issues:
Linux kernel from versions 3.9 and up, is vulnerable to a denial of
service attack with low rates of specially modified packets targeting IP
fragment re-assembly. An attacker may cause a denial of service condition
by sending specially crafted IP fragments (CVE-2018-5391, FragmentSmack).
An issue was discovered in the fd_locked_ioctl function in
drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy
driver will copy a kernel pointer to user memory in response to the
FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the
obtained kernel pointer to discover the location of kernel code and data
and bypass kernel security protections such as KASLR (CVE-2018-7755).
A security flaw was found in the chap_server_compute_md5() function in the
ISCSI target code in the Linux kernel in a way an authentication request
from an ISCSI initiator is processed. An unauthenticated remote attacker
can cause a stack buffer overflow and smash up to 17 bytes of the stack.
The attack requires the iSCSI target to be enabled on the victim host.
Depending on how the target's code was built (i.e. depending on a compiler,
compile flags and hardware architecture) an attack may lead to a system
crash and thus to a denial-of-service or possibly to a non-authorized
access to data exported by an iSCSI target. Due to the nature of the flaw,
privilege escalation cannot be fully ruled out, although we believe it is
highly unlikely (CVE-2018-14633).
A security flaw was found in the ip_frag_reasm() function in
net/ipv4/ip_fragment.c in the Linux kernel caused by fixes for
CVE-2018-5391, which can cause a later system crash in ip_do_fragment().
With certain non-default, but non-rare, configuration of a victim host,
an attacker can trigger this crash remotely, thus leading to a remote
denial-of-service (CVE-2018-14641).
An issue was discovered in xenvif_set_hash_mapping in
drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used
in Xen through 4.11.x and other products. The Linux netback driver allows
frontends to control mapping of requests to request queues. When processing
a request to set or change this mapping, some input validation (e.g., for
an integer overflow) was missing or flawed, leading to OOB access in hash
handling. A malicious or buggy frontend may cause the (usually privileged)
backend to make out of bounds memory accesses, potentially resulting in
one or more of privilege escalation, Denial of Service (DoS), or
information leaks (CVE-2018-15471).
An issue was discovered in the Linux kernel through 4.18.8. The
vmacache_flush_all function in mm/vmacache.c mishandles sequence number
overflows. An attacker can trigger a use-after-free (and possibly gain
privileges) via certain thread creation, map, unmap, invalidation, and
dereference operations (CVE-2018-17182).
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes
after dropping pagetable locks. If a syscall such as ftruncate() removes
entries from the pagetables of a task that is in the middle of mremap(),
a stale TLB entry can remain for a short time that permits access to a
physical page after it has been released back to the page allocator and
reused (CVE-2018-18281).
In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before
4.18.13, faulty computation of numeric bounds in the BPF verifier permits
out-of-bounds memory accesses because adjust_scalar_min_max_vals in
kernel/bpf/verifier.c mishandles 32-bit right shifts (CVE-2018-18445).
Other fixes in this update:
* WireGuard has been updated 0.0.20181018
For other uptstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2018-0374mageia · kernel-tmbmageia kernel-tmbUpdated kernel-tmb packages fix security vulnerabilities
This kernel-tmb update is based on the upstream 4.14.69 and adds additional
fixes for the L1TF and Spectre security issues. It also fixes at least
the following security issues:
Memory leak in the irda_bind function in net/irda/af_irda.c and later in
drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows
local users to cause a denial of service (memory consumption) by repeatedly
binding an AF_IRDA socket (CVE-2018-6554).
The irda_setsockopt function in net/irda/af_irda.c and later in
drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows
local users to cause a denial of service (ias_object use-after-free and
system crash) or possibly have unspecified other impact via an AF_IRDA
socket (CVE-2018-6555).
Other fixes in this update:
* WireGuard has been updated to 0.0.20180904
* all SPI_INTEL_SPI config options have been disable to prevent a potential
bios corrupting bug (mga#23560)
For other changes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2018-0346mageia · kernel-tmbmageia kernel-tmbUpdated kernel-tmb packages fix security vulnerabilities
This kernel-tmb update is based on the upstream 4.14.65 and adds fixes
and mitigations for the now publically known security issue affecting
Intel processors called L1 Terminal Fault (L1TF):
Systems with microprocessors utilizing speculative execution and Intel
Software Guard Extensions (Intel SGX) may allow unauthorized disclosure
of information residing in the L1 data cache from an enclave to an
attacker with local user access via side-channel analysis (CVE-2018-3615).
Systems with microprocessors utilizing speculative execution and address
translations may allow unauthorized disclosure of information residing in
the L1 data cache to an attacker with local user access via a terminal
page fault and side-channel analysis (CVE-2018-3620).
Systems with microprocessors utilizing speculative execution and address
translations may allow unauthorized disclosure of information residing in
the L1 data cache to an attacker with local user access with guest OS
privilege via a terminal page fault and side-channel analysis
(CVE-2018-3646).
The impact of the L1TF security issues:
* Malicious applications may be able to infer the values of data in the
operating system memory, or data from other applications.
* A malicious guest virtual machine (VM) may be able to infer the values
of data in the VMM’s memory, or values of data in the memory of other
guest VMs.
* Malicious software running outside of SMM may be able to infer values
of data in SMM memory.
* Malicious software running outside of an Intel® SGX enclave or within an
enclave may be able to infer data from within another Intel SGX enclave.
NOTE! You also need to install the 0.20180807-1.mga6.nonfree microcode
update (mga#23457) or a bios update from your hardware vendor containing
the updated microcodes to get all current set of fixes and mitigations
for L1TF.
Other changes in this update:
* WireGuard has been updated to 0.0.20180809
* added hwmon support for Threadripper2
For other upstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2018-0340mageia · kernel-tmbmageia kernel-tmbUpdated kernel-tmb packages fix security vulnerabilities
This kernel-tmb update is based on the upstream 4.14.62 and fixes at least
the following security issues:
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1,
kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the
Linux kernel's KVM hypervisor handled exceptions delivered after a stack
switch operation via Mov SS or Pop SS instructions. During the stack switch
operation, the processor did not deliver interrupts and exceptions, rather
they are delivered once the first instruction after the stack switch is
executed. An unprivileged KVM guest user could use this flaw to crash the
guest or, potentially, escalate their privileges in the guest
(CVE-2018-1087).
Linux kernel vhost since version 4.8 does not properly initialize memory in
messages passed between virtual guests and the host operating system in the
vhost/vhost.c:vhost_new_msg() function. This can allow local privileged
users to read some kernel memory contents when reading from the
/dev/vhost-net device file (CVE-2018-1118).
Security researchers from FICORA have identified a remote denial of
service attack against the Linux kernel caused by inefficient
implementation of TCP segment reassembly, named "SegmentSmack".
A remote attacker could consume a lot of CPU resources in the kernel
networking stack with just a low bandwidth or single host attack by
using lots of small TCP segments packets. Usually large botnets are
needed for similar effect. The rate needed for this denial of service
attack to be effective is several magnitudes lower than the usual
packet processing capability of the machine, as the attack exploits
worst case behaviour of existing algorithms (CVE-2018-5390).
In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c
in the Linux kernel through 4.15, an integer signedness error allows
arbitrary information leakage for the FBIOPUTCMAP_SPARC and
FBIOGETCMAP_SPARC commands (CVE-2018-6412).
In some circumstances, some operating systems or hypervisors may not expect
or properly handle an Intel architecture hardware debug exception. The error
appears to be due to developer interpretation of existing documentation for
certain Intel architecture interrupt/exception instructions, namely MOV SS
and POP SS. An authenticated attacker may be able to read sensitive data in
memory or control low-level operating system functions (CVE-2018-8897).
Linux kernel is vulnerable to a heap-based buffer overflow in the
fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit
this by operating on a mounted crafted ext4 image (CVE-2018-10840).
The kvm functions that were used in the emulation of fxrstor, fxsave,
sgdt and sidt were originally meant for task switching, and as such they
did not check privilege levels. This allowed guest userspace to guest
kernel write (CVE-2018-10853).
A flaw was found in Linux kernel ext4 File System. A use-after-free in
ext4_ext_remove_space() when mounting and operating a crafted ext4 image
(CVE-2018-10876).
Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the
ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem
image (CVE-2018-10877).
A flaw was found in Linux kernel ext4 filesystem. A local user can cause a
use-after-free in ext4_xattr_set_entry function and so a denial of service
or possibly unspecified other impact by when renaming a file in a crafted
ext4 filesystem image (CVE-2018-10879).
A flaw was found in Linux kernel ext4 filesystem code. A stack-out-of-bounds
write in ext4_update_inline_data() is possible when mounting and writing to
a crafted ext4 image. An attacker could use this to cause a system crash
and a denial of service (CVE-2018-10880).
A flaw was found in Linux kernel ext4 filesystem. A local user can cause an
out-of-bound access in ext4_get_group_info function and so a denial of
service and a system crash by mounting and operating on a crafted ext4
filesystem image (CVE-2018-10881).
A flaw was found in Linux kernel ext4 File System. An out-of-bound write
when unmounting a crafted ext4 image in fs/jbd2/transaction.c. An attacker
could use this to cause a denial of service (system crash) (CVE-2018-10882).
A flaw was found in Linux kernel ext4 File System. An out-of-bound write in
jbd2_journal_dirty_metadata() that kernel cannot handle when mounting and
operating a crafted ext4 image. An attacker could use this to cause a
denial of service (system crash) (CVE-2018-10883).
In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in
fs/ext4/inline.c performs a memcpy with an untrusted length value in certain
circumstances involving a crafted filesystem that stores the system.data
extended attribute value in a dedicated inode (CVE-2018-11412).
In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested
virtualization is used, local attackers could cause L1 KVM guests to
VMEXIT, potentially allowing privilege escalations and denial of service
attacks due to lack of checking of CPL (CVE-2018-12904).
The inode_init_owner function in fs/inode.c in the Linux kernel through
4.17.4 allows local users to create files with an unintended group
ownership, in a scenario where a directory is SGID to a certain group and
is writable by a user who is not a member of that group. Here, the
non-member can trigger creation of a plain file whose group ownership is
that group. The intended behavior was that the non-member can trigger
creation of a directory (but not a plain file) whose group ownership is
that group. The non-member can escalate privileges by making the plain
file executable and SGID (CVE-2018-13405).
An issue was discovered in the Linux kernel through 4.17.11, as used
in Xen through 4.11.x. The xen_failsafe_callback entry point in
arch/x86/entry/entry_64.S does not properly maintain RBX, which allows
local users to cause a denial of service (uninitialized memory usage
and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can
trigger a guest OS crash or possibly gain privileges (CVE-2018-14678).
Other changes in this update:
* WireGuard has been updated to 0.0.20180802
* enable Mellanox5 support (mga#23263)
* enable SMARTPQI support (mga#23305)
* ext4: check for allocation block validity with block group locked,
fixes possible data corruption under heavy load
* Add PCI ID for Cannon Lake PCH-LP and Ice Lake LP AHCI
For other upstream fixes in this update, see the referenced changelogs.CVSSUnscored