MGASA-2022-0230: kernel-linus Mageia
Published
Published 13-06-2022Last modified 16-04-2026
Vulnerability summary
MGASA-2022-0230 is a vulnerability in kernel-linus Mageia with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 5 · Downstream 0Timeline
- 13-06-2022PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated kernel-linus packages fix security vulnerabilities This kernel-linus update is based on upstream 5.15.46 and fixes at least the following security issues: KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID (CVE-2022-1789). KVM: x86: avoid calling x86 emulator without a decoded instruction (CVE-2022-1852). A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue (CVE-2022-1966). An out-of-bound write vulnerability was identified within the netfilter subsystem which can be exploited to achieve privilege escalation to root. In order to trigger the issue it requires the ability to create user/net namespaces (CVE-2022-1972). fs/ntfs3: Fix invalid free in log_replay (CVE-2022-1973). For other upstream fixes, see the referenced changelogs.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Mageia1 product
- kernel-linus< 5.15.46-1.mga8
1 vendor · 1 product
References
5 linksRelated vulnerabilities
Insufficient evidenceMGASA-2023-0251mageia · kernel-linusmageia kernel-linusUpdated kernel-linus packages fix security vulnerabilities
This kerne-linusl update is based on upstream 5.15.126 and fixes or
adds mitigations for atleast the following security issues:
Information exposure through microarchitectural state after transient
execution in certain vector execution units for some Intel(R) Processors
may allow an authenticated user to potentially enable information disclosure
via local access (CVE-2022-40982, INTEL-SA-00828).
A hash collision flaw was found in the IPv6 connection lookup table in
the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN
flood attack. A user located in the local network or with a high bandwidth
connection can increase the CPU usage of the server that accepts IPV6
connections up to 95% (CVE-2023-1206).
A use-after-free flaw was found in the Linux kernel's netfilter in the
way a user triggers the nft_pipapo_remove function with the element,
without a NFT_SET_EXT_KEY_END. This issue could allow a local user to
crash the system or potentially escalate their privileges on the system
(CVE-2023-4004).
A use-after-free flaw was found in the Linux kernel’s Netfilter
functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw
allows a local user to crash or escalate their privileges on the system
(CVE-2023-4147).
A side channel vulnerability in some of the AMD CPUs may allow an attacker
to influence the return address prediction. This may result in speculative
execution at an attacker-controlled instruction pointer register,
potentially leading to information disclosure (CVE-2023-20569).
A buffer overrun vulnerability was found in the netback driver in Xen due
to an unusual split packet. This flaw allows an unprivileged guest to cause
a denial of service (DoS) of the host by sending network packets to the
backend, causing the backend to crash (CVE-2023-34319, XSA-432).
For other upstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2023-0243mageia · kernel-linusmageia kernel-linusUpdated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.122 and fixes atleast
the following security issues:
Under specific microarchitectural circumstances, a register in "Zen 2"
CPUs may not be written to 0 correctly. This may cause data from another
process and/or thread to be stored in the YMM register, which may allow
an attacker to potentially access sensitive information (CVE-2023-20593,
also known as Zenbleed).
This update adds a kernel-side mitigation for this issue to protect users
until Amd gets their fixed microcode / AGESA updates out for all affected
CPUs. The fixed microcode for Amd EPYC gen2 is available in the
microcode-0.20230613-2.mga8.nonfree package. For other affected CPUs, see
the referenced amd.com url that has info about estimated microcode update
timelines for various CPUs.
Linux Kernel nftables Use-After-Free Local Privilege Escalation
Vulnerability; nft_chain_lookup_byid() failed to check whether a chain
was active and CAP_NET_ADMIN is in any user or network namespace
(CVE-2023-31248).
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability;
nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN
is in any user or network namespace (CVE-2023-35001).
For other upstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2023-0238mageia · kernel-linusmageia kernel-linusUpdated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.120 and fixes atleast
the following security issues:
A flaw null pointer dereference in the Linux kernel DECnet networking
protocol was found. A remote user could use this flaw to crash the
system. This is fixed by removing DECnet support (CVE-2023-3338).
A use-after-free vulnerability was found in the Linux kernel's netfilter
subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with
NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same
transaction causing a use-after-free vulnerability. This flaw allows a
local attacker with user access to cause a privilege escalation issue
(CVE-2023-3390).
NOTE!!
This kernel also contains a fix for dkms builds hanging / stalling during
upgrade to Mageia 9 (mga#31982) due to the new make 4.4 series utility
ending up in a loop processing Makefile in kernel-devel packages.
So if you use dkms packaged drivers and kernel-linus, you need to be
running this kernel (or any later released ones) before you do an online
upgrade to avoid the upgrade stalling / hanging.
For other upstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2023-0202mageia · kernel-linusmageia kernel-linusUpdated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.117 and fixes atleast
the following security issues:
In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree
because it does not validate MFT flags before replaying logs
(CVE-2022-48425).
An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file
system in how a user restores an XFS image after failure (with a dirty log
journal). This flaw allows a local user to crash or potentially escalate
their privileges on the system (CVE-2023-2124).
A flaw was found in the networking subsystem of the Linux kernel within
the handling of the RPL protocol. This issue results from the lack of
proper handling of user-supplied data, which can lead to an assertion
failure. This may allow an unauthenticated remote attacker to create a
denial of service condition on the system (CVE-2023-2156).
A denial of service problem was found, due to a possible recursive locking
scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c
in the Linux Kernel Device Mapper-Multipathing sub-component
(CVE-2023-2269).
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c
in media access in the Linux Kernel. This flaw allows a local attacker to
crash the system at device disconnect, possibly leading to a kernel
information leak (CVE-2023-3141).
A NULL pointer dereference issue was found in the gfs2 file system in the
Linux kernel. It occurs on corrupt gfs2 file systems when the evict code
tries to reference the journal descriptor structure after it has been freed
and set to NULL. A privileged local user could use this flaw to cause a
kernel panic (CVE-2023-3212).
An out of bounds (OOB) memory access flaw was found in the Linux kernel in
relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could
allow a local attacker to crash the system or leak kernel internal
information (CVE-2023-3268).
An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the
Linux kernel 6.2. There is a blocking operation when a task is in
!TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is
called; the condition is dvb_frontend_test_event(fepriv,events).
In dvb_frontend_test_event, down(&fepriv->sem) is called. However,
wait_event_interruptible would put the process to sleep, and
down(&fepriv->sem) may block the process (CVE-2023-31084).
In the Linux kernel through 6.3.1, a use-after-free in Netfilter
nf_tables when processing batch requests can be abused to perform arbitrary
read and write operations on kernel memory. Unprivileged local users can
obtain root privileges. This occurs because anonymous sets are mishandled
(CVE-2023-32233).
An issue was discovered in the Linux kernel before 6.3.3. There is an
out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c
because ext4_group_desc_csum does not properly check an offset
(CVE-2023-34256).
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in
the Linux kernel before 6.3.7. It allows an out-of-bounds write in the
flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This
may result in denial of service or privilege escalation (CVE-2023-35788).
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free
was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c
(CVE-2023-35823).
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free
was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c
(CVE-2023-35824).
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free
was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c
(CVE-2023-35828).
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free
was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c
(CVE-2023-35829).
For other upstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2023-0173mageia · kernel-linusmageia kernel-linusUpdated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.110 and fixes atleast
the following security issues:
A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.
This issue could occur when assoc_info->req_len data is bigger than the
size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of
service (CVE-2023-1380).
It was discovered that a race condition existed in the Xen transport layer
implementation for the 9P file system protocol in the Linux kernel, leading
to a use-after-free vulnerability. A local attacker could use this to cause
a denial of service or expose sensitive information (CVE-2023-1859).
An insufficient permission check has been found in the Bluetooth subsystem
of the Linux kernel when handling ioctl system calls of HCI sockets.
This causes tasks without the proper CAP_NET_ADMIN capability can easily
mark HCI sockets as _trusted_. Trusted sockets are intended to enable the
sending and receiving of management commands and events, such as pairing
or connecting with a new device. As a result, unprivileged users can
acquire a trusted socket, leading to unauthorized execution of management
commands (CVE-2023-2002).
A heap out-of-bounds read/write vulnerability in the Linux Kernel traffic
control (QoS) subsystem can be exploited to achieve local privilege
escalation. The qfq_change_class function does not properly limit the lmax
variable which can lead to out-of-bounds read/write. If the TCA_QFQ_LMAX
value is not offered through nlattr, lmax is determined by the MTU value
of the network device. The MTU of the loopback device can be set up to
2^31-1 and as a result, it is possible to have an lmax value that exceeds
QFQ_MIN_LMAX (CVE-2023-2248).
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13
allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX
(CVE-2023-31436).
For other upstream fixes in this update, see the referenced changelogs.CVSSUnscoredInsufficient evidenceMGASA-2023-0149mageia · kernel-linusmageia kernel-linusUpdated kernel-linus packages fix security vulnerability
This kernel-linus update is based on upstream 5.15.106 and fixes atleast the
following security issues:
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket
UID hardcoded to 0 due to a type confusion in their initialization function.
While it will be often correct, as tuntap devices require CAP_NET_ADMIN,
it may not always be the case, e.g., a non-root user only having that
capability. This would make tun/tap sockets being incorrectly treated in
filtering/routing decisions, possibly bypassing network filters
(CVE-2023-1076).
In the Linux kernel, pick_next_rt_entity() may return a type confused entry,
not detected by the BUG_ON condition, as the confused entry will not be
NULL, but list_head.The buggy error condition would lead to a type confused
entry with the list head,which would then be used as a type confused
sched_rt_entity,causing memory corruption (CVE-2023-1077).
A flaw was found in the Linux kernel. A use-after-free may be triggered in
asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device,
which advertises itself as an Asus device. Similarly to the previous known
CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the
LED controller while the device is disconnecting, triggering a use-after-free
on the struct asus_kbd_leds *led structure. A malicious USB device may
exploit the issue to cause memory corruption with controlled data
(CVE-2023-1079).
A flaw use after free in the Linux kernel integrated infrared receiver/
transceiver driver was found in the way user detaching rc device. A local
user could use this flaw to crash the system or potentially escalate their
privileges on the system (CVE-2023-1118).
A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c
in btrfs in the Linux Kernel.This flaw allows an attacker to crash the
system and possibly cause a kernel information leak (CVE-2023-1611).
A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card)
Ethernet driver was found.A local user could use this flaw to crash the
system or potentially escalate their privileges on the system
(CVE-2023-1670).
A use-after-free vulnerability in the Linux Kernel traffic control index
filter (tcindex) can be exploited to achieve local privilege escalation.
The tcindex_delete function which does not properly deactivate filters in
case of a perfect hashes while deleting the underlying structure which can
later lead to double freeing the structure. A local attacker user can use
this vulnerability to elevate its privileges to root (CVE-2023-1829).
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/
xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon).
This flaw could allow a local attacker to crash the system due to a race
problem. This vulnerability could even lead to a kernel information leak
problem (CVE-2023-1855).
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\
btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with
an unfinished job, may cause a race problem leading to a UAF on hdev
devices (CVE-2023-1989).
A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c
in the Linux Kernel. This flaw could allow an attacker to crash the system
due to a race problem (CVE-2023-1990).
A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using
a specific networking configuration (redirecting egress packets to ingress
using TC action "mirred") a local unprivileged user could trigger a CPU
soft lockup (ABBA deadlock) when the transport protocol in use (TCP or
SCTP) does a retransmission, resulting in a denial of service condition
(CVE-2022-4269).
A use-after-free vulnerability was found in __nfs42_ssc_open() in
fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to
conduct a remote denial of service (CVE-2022-4379).
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in
drivers/hid/hid-bigbenff.c via a crafted USB device because the LED
controllers remain registered for too long (CVE-2023-25012).
do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6
lacks a lock_sock call, leading to a race condition (with a resultant
use-after-free or NULL pointer dereference) (CVE-2023-28466).
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel
before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4
(CVE-2023-30456).
The Linux kernel before 6.2.9 has a race condition and resultant
use-after-free in drivers/power/supply/da9150-charger.c if a physically
proximate attacker unplugs a device (CVE-2023-30772).
For other upstream fixes in this update, see the referenced changelogs.CVSSUnscored