MGASA-2019-0097 - Updated kernel packages fix security vulnerabilities

Publication date: 20 Feb 2019
URL: https://advisories.mageia.org/MGASA-2019-0097.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2018-16882,
     CVE-2018-16884,
     CVE-2018-19985,
     CVE-2019-3701,
     CVE-2019-3819,
     CVE-2019-6974,
     CVE-2019-7221,
     CVE-2019-7222

This kernel update is based on the upstream 4.14.100 and fixes atleast
the following security issues:

A use-after-free issue was found in the way the Linux kernel's KVM
hypervisor processed posted interrupts when nested(=1) virtualization is
enabled. In nested_get_vmcs12_pages(), in case of an error while
processing posted interrupt address, it unmaps the 'pi_desc_page' without
resetting 'pi_desc' descriptor address, which is later used in
pi_test_and_clear_on(). A guest user/process could use this flaw to crash
the host kernel resulting in DoS or potentially gain privileged access to
a system (CVE-2018-16882).

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares
mounted in different network namespaces at the same time can make
bc_svc_process() use wrong back-channel IDs and cause a use-after-free
vulnerability. Thus a malicious container user can cause a host kernel
memory corruption and a system panic. Due to the nature of the flaw,
privilege escalation cannot be fully ruled out (CVE-2018-16884).

A flaw was found in the Linux kernel in the function hso_probe() which
reads if_num value from the USB device (as an u8) and uses it without a
length check to index an array, resulting in an OOB memory read in
hso_probe() or hso_get_config_data(). An attacker with a forged USB
device and physical access to a system (needed to connect such a device)
can cause a system crash and a denial of service (CVE-2018-19985).

An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux
kernel through 4.19.13. The CAN frame modification rules allow bitwise
logical operations that can be also applied to the can_dlc field. Because
of a missing check, the CAN drivers may write arbitrary content beyond
the data registers in the CAN controller's I/O memory when processing
can-gw manipulated outgoing frames. This is related to cgw_csum_xor_rel.
An unprivileged user can trigger a system crash (general protection fault)
(CVE-2019-3701).

A flaw was found in the Linux kernel in the function hid_debug_events_read()
in drivers/hid/hid-debug.c file which may enter an infinite loop with
certain parameters passed from a userspace. A local privileged user ("root")
can cause a system lock up and a denial of service (CVE-2019-3819).

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in
virt/kvm/kvm_main.c mishandles reference counting because of a race
condition, leading to a use-after-free (CVE-2019-6974).

A use-after-free vulnerability was found in the way the Linux kernel's KVM
hypervisor emulates a preemption timer for L2 guests when nested (=1)
virtualization is enabled. This high resolution timer(hrtimer) runs when
a L2 guest is active. After VM exit, the sync_vmcs12() timer object is
stopped. The use-after-free occurs if the timer object is freed before
calling sync_vmcs12() routine. A guest user/process could use this flaw
to crash the host kernel resulting in a denial of service or, potentially,
gain privileged access to a system (CVE-2019-7221).

An information leakage issue was found in the way Linux kernel's KVM
hypervisor handled page fault exceptions while emulating instructions
like VMXON, VMCLEAR, VMPTRLD, and VMWRITE with memory address as an
operand. It occurs if the operand is a mmio address, as the returned
exception object holds uninitialized stack memory contents. A guest
user/process could use this flaw to leak host's stack memory contents
to a guest (CVE-2019-7222).

Other fixes in this update:
* Ndiswrapper has been updated to 1.62
* WireGuard has been updated to 0.0.20190123

For other uptstream fixes in this update, see the referenced changelogs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=24331
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.90
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.91
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.92
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.93
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.94
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.95
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.96
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.97
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.98
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.99
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.100
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16882
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16884
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19985
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3701
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3819
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6974
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7221
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7222

SRPMS:
- 6/core/kernel-4.14.100-1.mga6
- 6/core/kernel-userspace-headers-4.14.100-1.mga6
- 6/core/kmod-vboxadditions-5.2.24-4.mga6
- 6/core/kmod-virtualbox-5.2.24-4.mga6
- 6/core/kmod-xtables-addons-2.13-78.mga6
- 6/core/ndiswrapper-1.62-1.mga6
- 6/core/wireguard-tools-0.0.20190123-1.mga6