| Description: | Summary:
The remote host is missing an update for the 'kernel, kernel-userspace-headers, kmod-virtualbox, kmod-xtables-addons, wireguard-tools' package(s) announced via the MGASA-2019-0288 advisory.
Vulnerability Insight:
This kernel update is based on the upstream 5.2.16 and fixes at least
the following security issues:
There is heap-based buffer overflow in the marvell wifi chip driver that
allows local users to cause a denial of service(system crash) or possibly
execute arbitrary code (CVE-2019-14814, CVE-2019-14815, CVE-2019-14816).
An out-of-bounds access issue was found in the way Linux kernel's KVM
hypervisor implements the Coalesced MMIO write operation. It operates on
an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write
indices 'ring->first' and 'ring->last' value could be supplied by a host
user-space process. An unprivileged host user or process with access to
'/dev/kvm' device could use this flaw to crash the host kernel, resulting
in a denial of service or potentially escalating privileges on the system
(CVE-2019-14821).
A buffer overflow flaw was found in the way Linux kernel's vhost
functionality that translates virtqueue buffers to IOVs, logged the buffer
descriptors during migration. A privileged guest user able to pass
descriptors with invalid length to the host when migration is underway,
could use this flaw to increase their privileges on the host
(CVE-2019-14835).
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c
allows attackers to obtain sensitive information from kernel stack memory
because tos and flags fields are not initialized (CVE-2019-16714)
WireGuard has been updated to 0.0.20190913.
For other uptstream fixes in this update, see the referenced changelogs.
Affected Software/OS:
'kernel, kernel-userspace-headers, kmod-virtualbox, kmod-xtables-addons, wireguard-tools' package(s) on Mageia 7.
Solution:
Please install the updated package(s).
CVSS Score:
7.2
CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
