ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2021.0347
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2021-0347)
Resumen:	The remote host is missing an update for the 'kernel, kmod-virtualbox, kmod-xtables-addons' package(s) announced via the MGASA-2021-0347 advisory.
Descripción:	Summary: The remote host is missing an update for the 'kernel, kmod-virtualbox, kmod-xtables-addons' package(s) announced via the MGASA-2021-0347 advisory. Vulnerability Insight: This kernel update is based on upstream 5.10.48 and fixes at least the following security issues: The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541). An issue was discovered in Linux: KVM through Improper handling of VM_IO VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543). kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument (CVE-2021-35039). Other fixes in this update: - ahci: Add support for Dell S140 and later controllers - ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445/450/630 G8 - drm/amdgpu: fix bad address translation for sienna_cichlid - drm/sched: Avoid data corruptions - net: ip: avoid OOM kills with large UDP sends over loopback - iwlwifi: Add support for ax201 in Samsung Galaxy Book Flex2 Alpha - virtio_net: Remove BUG() to avoid machine dead For other upstream fixes, see the referenced changelogs. Affected Software/OS: 'kernel, kmod-virtualbox, kmod-xtables-addons' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2020-26541 https://lkml.org/lkml/2020/9/15/1871 Common Vulnerability Exposure (CVE) ID: CVE-2021-22543 FEDORA-2021-95f2f1cfc7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROQIXQB7ZAWI3KSGSHR6H5RDUWZI775S/ FEDORA-2021-fe826f202e https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4G5YBUVEPHZYXMKNGBZ3S6INFCTEEL4E/ [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html [debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html [oss-security] 20210626 Re: CVE-2021-22543 - /dev/kvm LPE http://www.openwall.com/lists/oss-security/2021/06/26/1 https://github.com/google/security-research/security/advisories/GHSA-7wq5-phmq-m584 https://security.netapp.com/advisory/ntap-20210708-0002/ Common Vulnerability Exposure (CVE) ID: CVE-2021-35039 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0c18f29aae7ce3dadd26d8ee3505d07cc982df75 https://www.openwall.com/lists/oss-security/2021/07/06/3 http://www.openwall.com/lists/oss-security/2021/07/06/3
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.