MGASA-2021-0282: kernel Mageia
Published
Published 23-06-2021Last modified 16-04-2026
Vulnerability summary
MGASA-2021-0282 is a vulnerability in kernel Mageia with no CVSS score yet.
Overall risk
0/100
0100
Minimal · default modelHow is this calculated?SSVCUnavailableNo CVSS score and no CISA entry. CveMate has too little data to estimate a decision.
CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 23-06-2021PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated kernel packages fix security and other issues The kernel update in MGASA-2021-0257 contained some security fixes that caused regressions in at least some container and chroot setups. This update provides upstream 5.10.45 that adds follow-up fixes to resolve the regressions and other various security-related and other bugfixes. For more info about the upstream fixes, see the referenced changelogs.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia6 products
- kernel< 5.10.45-2.mga7
- kmod-virtualbox< 6.1.22-1.8.mga7
- kmod-xtables-addons< 3.13-30.mga7
- kernel< 5.10.45-2.mga8
- kmod-virtualbox< 6.1.22-1.8.mga8
- kmod-xtables-addons< 3.18-1.8.mga8
1 vendor · 6 products
References
4 linksRelated vulnerabilities
UnscoredMGASA-2021-0296mageia · kernel +5 moremageia kernelUpdated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.46 and fixes at least the
following security issues:
In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can
be mispredicted (e.g., because of type confusion) and consequently an
unprivileged BPF program can read arbitrary memory locations via a
side-channel attack (CVE-2021-33624).
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to
obtain sensitive information from kernel stack memory because parts of a
data structure are uninitialized. (CVE-2021-34693).
For other upstream fixes, see the referenced changelog.UnscoredMGASA-2021-0257mageia · kernel +5 moremageia kernelUpdated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.43 and fixes at least the
following security issues:
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and
WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received
fragments be cleared from memory after (re)connecting to a network. Under
the right circumstances, when another device sends fragmented frames
encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary
network packets and/or exfiltrate user data (CVE-2020-24586).
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and
WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments
of a frame are encrypted under the same key. An adversary can abuse this to
decrypt selected fragments when another device sends fragmented frames and
the WEP, CCMP, or GCMP encryption key is periodically renewed
(CVE-2020-24587).
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and
WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU
flag in the plaintext QoS header field is authenticated. Against devices
that support receiving non-SSP A-MSDU frames (which is mandatory as part
of 802.11n), an adversary can abuse this to inject arbitrary network
packets (CVE-2020-24588).
An issue was discovered in the kernel. An Access Point (AP) forwards EAPOL
frames to other clients even though the sender has not yet successfully
authenticated to the AP. This might be abused in projected Wi-Fi networks
to launch denial-of-service attacks against connected clients and makes
it easier to exploit other vulnerabilities in connected clients
(CVE-2020-26139).
An issue was discovered in the kernel ath10k driver. The Wi-Fi
implementation does not verify the Message Integrity Check (authenticity)
of fragmented TKIP frames. An adversary can abuse this to inject and
possibly decrypt packets in WPA or WPA2 networks that support the TKIP
data-confidentiality protocol (CVE-2020-26141).
An issue was discovered in the kernel ath10k driver. The WEP, WPA, WPA2,
and WPA3 implementations accept second (or subsequent) broadcast fragments
even when sent in plaintext and process them as full unfragmented frames.
An adversary can abuse this to inject arbitrary network packets independent
of the network configuration (CVE-2020-26145).
An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and
WPA3 implementations reassemble fragments even though some of them were
sent in plaintext. This vulnerability can be abused to inject packets and/
or exfiltrate selected fragments when another device sends fragmented
frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used
(CVE-2020-26147).
A use after free vulnerability has been found in the hci_sock_bound_ioctl()
function of the Linux kernel. It can allow attackers to corrupt kernel
heaps (kmalloc-8k to be specific) and adopt further exploitations
(CVE-2021-3573).
There is a guest triggered use-after-free in Linux xen-netback. A malicious
or buggy network PV frontend can force Linux netback to disable the
interface and terminate the receive kernel thread associated with queue 0
in response to the frontend sending a malformed packet. Such kernel thread
termination will lead to a use-after-free in Linux netback when the backend
is destroyed, as the kernel thread associated with queue 0 will have already
exited and thus the call to kthread_stop will be performed against a stale
pointer. A malicious or buggy frontend driver can trigger a dom0 crash.
Privilege escalation and information leaks cannot be ruled out.
(CVE-2021-28691 / XSA-374).
There is a null pointer dereference in llcp_sock_getname in net/nfc/
llcp_sock.c of the Linux kernel. An unprivileged user can trigger this bug
and cause denial of service (CVE-2021-38208).
Other fixes in this update:
- bpf: Forbid trampoline attach for functions with variable arguments
- bpf: Add deny list of btf ids check for tracing programs
- net/nfc/rawsock.c: fix a permission check bug
- proc: Track /proc/$pid/attr/ opener mm_struct
- RDS tcp loopback connection can hang
For other upstream fixes, see the referenced changelogs.UnscoredMGASA-2021-0224mageia · kernel +5 moremageia kernelUpdated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.41 and fixes at least the
following security issues:
A double-free memory corruption in the Linux kernel HCI device
initialization subsystem was found in the way user attach malicious HCI
TTY Bluetooth device. A local user could use this flaw to crash the system
(CVE-2021-3564).
kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect
limits for pointer arithmetic operations. This can be abused to perform
out-of-bounds reads and writes in kernel memory, leading to local privilege
escalation to root. In particular, there is a corner case where the off reg
causes a masking direction change, which then results in an incorrect final
aux->alu_limit (CVE-2021-33200).
Other fixes in this update:
- proc: Check /proc/$pid/attr/ writes against file opener
For other upstream fixes, see the referenced changelogs.UnscoredMGASA-2021-0214mageia · kernel +5 moremageia kernelUpdated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.37 and fixes at least the
following security issues:
It was discovered that the io_uring implementation of the Linux kernel did
not properly enforce the MAX_RW_COUNT limit in some situations. A local
attacker could use this to cause a denial of service (system crash) or
execute arbitrary code (CVE-2021-3491).
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in
the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds
check failure allows a local attacker to gain access to out-of-bounds
memory leading to a system crash or a leak of internal kernel information
(CVE-2021-3506).
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before
5.12-rc8 can lead to kernel privilege escalation from the context of a
network service or an unprivileged process. If sctp_destroy_sock is called
without sock_net(sk)->sctp.addr_wq_lock then an element is removed from
the auto_asconf_splist list without any proper locking. This can be
exploited by an attacker with network service privileges to escalate to
root or from the context of an unprivileged user directly if a
BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some
SCTP socket.
NOTE! This already had a fix in kernel-5.10.33, but that fix caused some
systems to deadlock, so this is now fixed in a better way (CVE-2021-23133).
bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
(CVE-2021-31440).
kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable
speculative loads, leading to disclosure of stack content via side-channel
attacks. The specific concern is not protecting the BPF stack area against
speculative loads. Also, the BPF stack can contain uninitialized data that
might represent sensitive information previously operated on by the kernel
(CVE-2021-31829).
net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race
condition for removal of the HCI controller (CVE-2021-32399).
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a
use-after-free when destroying an hci_chan. This leads to writing an
arbitrary value. (CVE-2021-33034).
Other fixes in this update:
- Revert upstream iommu/vt-d fixes causing systems to hang at boot:
* "iommu/vt-d: Preset Access/Dirty bits for IOVA over FL"
* "iommu/vt-d: Remove WO permissions on second-level paging entries"
- Revert "irqbypass: do not start cons/prod when failed connect" as
it may cause VM freeze on arm64 with GICv4
- ACPI / EC: Fix media keys not working problem on more Asus laptops
- ACPI: PM: Add ACPI ID of Alder Lake Fan
- iwlwifi: add new pci id for 6235
- usb: xhci: Add reset resume quirk for AMD xhci controller
- usb: xhci: Increase timeout for HC halt
For other upstream fixes, see the referenced changelogs.UnscoredMGASA-2021-0204mageia · kernel +8 moremageia kernelUpdated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.33 and fixes at least the
following security issues:
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before
5.12-rc8 can lead to kernel privilege escalation from the context of a
network service or an unprivileged process. If sctp_destroy_sock is called
without sock_net(sk)->sctp.addr_wq_lock then an element is removed from
the auto_asconf_splist list without any proper locking. This can be
exploited by an attacker with network service privileges to escalate to
root or from the context of an unprivileged user directly if a
BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some
SCTP socket (CVE-2021-23133).
An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/
verifier.c performs undesirable out-of-bounds speculation on pointer
arithmetic, leading to side-channel attacks that defeat Spectre mitigations
and obtain sensitive information from kernel memory. Specifically, for
sequences of pointer arithmetic operations, the pointer modification
performed by the first operation is not correctly accounted for when
restricting subsequent operations (CVE-2021-29155).
This update also contains the following:
- xtables-addons has been updated to 3.18 (only in Mageia 8)
- wireguard-tools has been updated to v1.0.20210424-1.mga8
For other upstream fixes, see the referenced changelogs.UnscoredMGASA-2021-0197mageia · kmod-virtualbox +3 moremageia kmod-virtualboxUpdated virtualbox packages fix security vulnerabilities
This update provides the upstream 6.1.20 maintenance release that fixes
at least the following security vulnerabilities:
A difficult to exploit vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows high privileged attacker with
logon to the infrastructure where Oracle VM VirtualBox executes to
compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM
VirtualBox, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in takeover of Oracle
VM VirtualBox (CVE-2021-2145, CVE-2021-2309, CVE-2021-2310).
An easily exploitable vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows high privileged attacker
with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle
VM VirtualBox, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in takeover of Oracle
VM VirtualBox (CVE-2021-2250).
An easily exploitable vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows low privileged attacker with
logon to the infrastructure where Oracle VM VirtualBox executes to
compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM
VirtualBox, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in unauthorized
creation, deletion or modification access to critical data or all Oracle
VM VirtualBox accessible data as well as unauthorized access to critical
data or complete access to all Oracle VM VirtualBox accessible data
(CVE-2021-2264).
An easily exploitable vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows high privileged attacker with
logon to the infrastructure where Oracle VM VirtualBox executes to
compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM
VirtualBox, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in unauthorized access
to critical data or complete access to all Oracle VM VirtualBox accessible
data (CVE-2021-2266, CVE-2021-2306).
A difficult to exploit vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows unauthenticated attacker with
network access via RDP to compromise Oracle VM VirtualBox. Successful
attacks of this vulnerability can result in takeover of Oracle VM
VirtualBox (CVE-2021-2279).
An easily exploitable vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows unauthenticated attacker with
logon to the infrastructure where Oracle VM VirtualBox executes to
compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM
VirtualBox, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in unauthorized access
to critical data or complete access to all Oracle VM VirtualBox accessible
data (CVE-2021-2280, CVE-2021-2282, CVE-2021-2283, CVE-2021-2284,
CVE-2021-2285, CVE-2021-2287).
An easily exploitable vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows unauthenticated attacker with
logon to the infrastructure where Oracle VM VirtualBox executes to
compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM
VirtualBox, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in unauthorized
creation, deletion or modification access to critical data or all Oracle
VM VirtualBox accessible data. (CVE-2021-2281, CVE-2021-2284,
CVE-2021-2286).
An easily exploitable vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows low privileged attacker with
logon to the infrastructure where Oracle VM VirtualBox executes to
compromise Oracle VM VirtualBox. Successful attacks of this vulnerability
can result in unauthorized access to critical data or complete access to
all Oracle VM VirtualBox accessible data (CVE-2021-2291).
An easily exploitable vulnerability in the Oracle VM VirtualBox
(component: Core) prior to 6.1.20 allows high privileged attacker with
logon to the infrastructure where Oracle VM VirtualBox executes to
compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM
VirtualBox, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in unauthorized access
to critical data or complete access to all Oracle VM VirtualBox accessible
data (CVE-2021-2296, CVE-2021-2297).
This update also fixes the following issues:
- fixes a zombie spawning process for Virtualbox (mga#27362)
- adds a workaround for a non-working file selection dialog with Plasma
(Mageia 8 only, mga#27433)
- fixes installing the packaged Oracle VBoxDTrace Extension Pack (mga#27936)
- removes a broken VBoxREM.so symlink that belongs to a feature not supported
in virtualbox 6.1 series (mga#28734).
For other upstream fixes in this update, see the referenced changelog.