Test ID:	1.3.6.1.4.1.25623.1.1.10.2020.0140
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2020-0140)
Summary:	The remote host is missing an update for the 'kernel, kmod-virtualbox, kmod-xtables-addons' package(s) announced via the MGASA-2020-0140 advisory.
Description:	Summary: The remote host is missing an update for the 'kernel, kmod-virtualbox, kmod-xtables-addons' package(s) announced via the MGASA-2020-0140 advisory. Vulnerability Insight: This update is based on upstream 5.5.9 and fixes at least the following security vulnerabilities: In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer) (CVE-2019-19768). There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647). There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648). There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. (CVE-2020-8649). An issue was discovered in the Linux kernel through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2 (CVE-2020-9383). An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID- dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation (CVE-2020-9391). Other notable changes in this update: - kernel is built with the updated gcc-8.4.0, thus fixing the issue with nvidia drivers complaining about gcc mismatch and failing the dkms-nvidia* builds. - ahci: Add Intel Comet Lake H RAID PCI ID - update Amd Sensor Fusion Hub driver to v4 - replace staging exfat driver with new upstream exfat driver - update rtl8812au driver for more hw support (mga#26178) - fscrypt: don't evict dirty inodes after removing key Affected Software/OS: 'kernel, kmod-virtualbox, kmod-xtables-addons' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-19768 Debian Security Information: DSA-4698 (Google Search) https://www.debian.org/security/2020/dsa-4698 https://bugzilla.kernel.org/show_bug.cgi?id=205711 https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html SuSE Security Announcement: openSUSE-SU-2020:0388 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00039.html https://usn.ubuntu.com/4342-1/ https://usn.ubuntu.com/4344-1/ https://usn.ubuntu.com/4345-1/ https://usn.ubuntu.com/4346-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-8647 https://bugzilla.kernel.org/show_bug.cgi?id=206359 Common Vulnerability Exposure (CVE) ID: CVE-2020-8648 https://bugzilla.kernel.org/show_bug.cgi?id=206361 SuSE Security Announcement: openSUSE-SU-2020:0336 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html Common Vulnerability Exposure (CVE) ID: CVE-2020-8649 https://bugzilla.kernel.org/show_bug.cgi?id=206357 Common Vulnerability Exposure (CVE) ID: CVE-2020-9383 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=2f9ac30a54dc0181ddac3705cdcf4775d863c530 https://github.com/torvalds/linux/commit/2e90ca68b0d2f5548804f22f0dd61145516171e3 Common Vulnerability Exposure (CVE) ID: CVE-2020-9391 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O4LH35HOPBJIKYHYFXMBBM75DN75PZHZ/ https://bugzilla.redhat.com/show_bug.cgi?id=1797052 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dcde237319e626d1ec3c9d8b7613032f0fd4663a http://www.openwall.com/lists/oss-security/2020/02/25/6
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.