Test Kennung:	1.3.6.1.4.1.25623.1.1.10.2023.0007
Kategorie:	Mageia Linux Local Security Checks
Titel:	Mageia: Security Advisory (MGASA-2023-0007)
Zusammenfassung:	The remote host is missing an update for the 'kernel, kmod-virtualbox, kmod-xtables-addons, xtables-addons' package(s) announced via the MGASA-2023-0007 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'kernel, kmod-virtualbox, kmod-xtables-addons, xtables-addons' package(s) announced via the MGASA-2023-0007 advisory. Vulnerability Insight: This kernel update is based on upstream 5.15.88 and fixes at least the following security issues: A use-after-free flaw was found in the Linux kernel's SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-3424). A vulnerability in the function btf_dump_name_dups of the file tools/lib/bpf/ btf_dump.c of the component libbpf. This flaw allows a manipulation that may lea to a use-after-free issue (CVE-2022-3534). A vulnerability was found in area_cache_get in drivers/net/ethernet/ netronome/nfp/nfpcore/nfp_cppcore.c in the Netronome Flow Processor (NFP) driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue (CVE-2022-3545). An out-of-bounds memory write vulnerability was found in the Linux kernel vmwgfx driver in vmw_kms_cursor_snoop due to a missing check of a memcpy length. This flaw allows a local, unprivileged attacker with access to either the /dev/dri/card0 or /dev/dri/rendererD128 and able to issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service (CVE-2022-36280). A use-after-free flaw was found in the Linux kernel's dvb-core subsystem (DVB API used by Digital TV devices) in how a user physically removed a USB device (such as a DVB demultiplexer device) while running malicious code. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-41218). An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets (CVE-2022-45934). In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with 'tc qdisc' and 'tc class' commands. This affects qdisc_graft in net/sched/sch_api.c (CVE-2022-47929). A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution (CVE-2023-0179). A vulnerability in the kernel ksmbd allows a remote attacker to perform a denial of service (DoS) attack. The vulnerability exists due to a boundary error within the ksmbd_decode_ntlmssp_auth_blob() function in ksmbd when handling NTLMv2 authentication. A remote attacker can send specially crafted data to ksmbd, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack (CVE-2023-0210). ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'kernel, kmod-virtualbox, kmod-xtables-addons, xtables-addons' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 7.7 CVSS Vector: AV:A/AC:L/Au:S/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2022-3424 https://bugzilla.redhat.com/show_bug.cgi?id=2132640 https://github.com/torvalds/linux/commit/643a16a0eb1d6ac23744bb6e90a00fc21148a9dc https://lore.kernel.org/all/20221019031445.901570-1-zyytlz.wz@163.com/ https://www.spinics.net/lists/kernel/msg4518970.html https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html Common Vulnerability Exposure (CVE) ID: CVE-2022-3534 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=93c660ca40b5d2f7c1b1626e955a8e9fa30e0749 https://vuldb.com/?id.211032 Common Vulnerability Exposure (CVE) ID: CVE-2022-3545 Debian Security Information: DSA-5324 (Google Search) https://www.debian.org/security/2023/dsa-5324 https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=02e1a114fdb71e59ee6770294166c30d437bf86a https://vuldb.com/?id.211045 https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html Common Vulnerability Exposure (CVE) ID: CVE-2022-36280 https://bugzilla.openanolis.cn/show_bug.cgi?id=2071 Common Vulnerability Exposure (CVE) ID: CVE-2022-41218 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fd3d91ab1c6ab0628fe642dd570b56302c30a792 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/media/dvb-core/dmxdev.c https://lore.kernel.org/all/20220908132754.30532-1-tiwai@suse.de/ http://www.openwall.com/lists/oss-security/2022/09/23/4 http://www.openwall.com/lists/oss-security/2022/09/24/2 http://www.openwall.com/lists/oss-security/2022/09/24/1 Common Vulnerability Exposure (CVE) ID: CVE-2022-45934 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAKCGDW6CQ6G3RZWYZJO454R3L5CTQB/ https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=ae4569813a6e931258db627cdfe50dfb4f917d5d Common Vulnerability Exposure (CVE) ID: CVE-2022-47929 https://tldp.org/HOWTO/Traffic-Control-HOWTO/components.html https://www.spinics.net/lists/netdev/msg555705.html Common Vulnerability Exposure (CVE) ID: CVE-2023-0179 http://packetstormsecurity.com/files/171601/Kernel-Live-Patch-Security-Notice-LNS-0093-1.html https://bugzilla.redhat.com/show_bug.cgi?id=2161713 https://seclists.org/oss-sec/2023/q1/20 Common Vulnerability Exposure (CVE) ID: CVE-2023-0210 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=797805d81baa814f76cf7bdab35f86408a79d707 https://github.com/cifsd-team/ksmbd/commit/8824b7af409f51f1316e92e9887c2fd48c0b26d6 https://www.openwall.com/lists/oss-security/2023/01/04/1 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit https://securityonline.info/cve-2023-0210-flaw-in-linux-kernel-allows-unauthenticated-remote-dos-attacks/ https://www.openwall.com/lists/oss-security/2023/01/11/1 Common Vulnerability Exposure (CVE) ID: CVE-2023-0266 https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4 https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1 Common Vulnerability Exposure (CVE) ID: CVE-2023-23454 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12 https://www.openwall.com/lists/oss-security/2023/01/10/1 https://www.openwall.com/lists/oss-security/2023/01/10/4 Common Vulnerability Exposure (CVE) ID: CVE-2023-23455 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2965c7be0522eaa18808684b7b82b248515511b
Copyright	Copyright (C) 2023 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.