MGASA-2021-0214: kernel Mageia

Vulnerability summary

MGASA-2021-0214 is a vulnerability in kernel Mageia with no CVSS score yet.

Timeline

1. 19-05-2021
   PublishedVulnerability first disclosed.
2. 16-04-2026
   Last modifiedVulnerability information updated.

Description

Updated kernel packages fix security vulnerabilities This kernel update is based on upstream 5.10.37 and fixes at least the following security issues: It was discovered that the io_uring implementation of the Linux kernel did not properly enforce the MAX_RW_COUNT limit in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code (CVE-2021-3491). An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information (CVE-2021-3506). A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. NOTE! This already had a fix in kernel-5.10.33, but that fix caused some systems to deadlock, so this is now fixed in a better way (CVE-2021-23133). bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds (CVE-2021-31440). kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previously operated on by the kernel (CVE-2021-31829). net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller (CVE-2021-32399). In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan. This leads to writing an arbitrary value. (CVE-2021-33034). Other fixes in this update: - Revert upstream iommu/vt-d fixes causing systems to hang at boot: * "iommu/vt-d: Preset Access/Dirty bits for IOVA over FL" * "iommu/vt-d: Remove WO permissions on second-level paging entries" - Revert "irqbypass: do not start cons/prod when failed connect" as it may cause VM freeze on arm64 with GICv4 - ACPI / EC: Fix media keys not working problem on more Asus laptops - ACPI: PM: Add ACPI ID of Alder Lake Fan - iwlwifi: add new pci id for 6235 - usb: xhci: Add reset resume quirk for AMD xhci controller - usb: xhci: Increase timeout for HC halt For other upstream fixes, see the referenced changelogs.

No weakness data has been published for this record.