Test ID:	1.3.6.1.4.1.25623.1.1.10.2021.0348
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2021-0348)
Summary:	The remote host is missing an update for the 'kernel-linus' package(s) announced via the MGASA-2021-0348 advisory.
Description:	Summary: The remote host is missing an update for the 'kernel-linus' package(s) announced via the MGASA-2021-0348 advisory. Vulnerability Insight: This kernel-linus update is based on upstream 5.10.48 and fixes at least the following security issues: The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541). An issue was discovered in Linux: KVM through Improper handling of VM_IO VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543). kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument (CVE-2021-35039). For other upstream fixes, see the referenced changelogs. Affected Software/OS: 'kernel-linus' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-26541 https://lkml.org/lkml/2020/9/15/1871 Common Vulnerability Exposure (CVE) ID: CVE-2021-22543 FEDORA-2021-95f2f1cfc7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROQIXQB7ZAWI3KSGSHR6H5RDUWZI775S/ FEDORA-2021-fe826f202e https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4G5YBUVEPHZYXMKNGBZ3S6INFCTEEL4E/ [debian-lts-announce] 20211015 [SECURITY] [DLA 2785-1] linux-4.19 security update https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html [debian-lts-announce] 20211216 [SECURITY] [DLA 2843-1] linux security update https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html [oss-security] 20210626 Re: CVE-2021-22543 - /dev/kvm LPE http://www.openwall.com/lists/oss-security/2021/06/26/1 https://github.com/google/security-research/security/advisories/GHSA-7wq5-phmq-m584 https://security.netapp.com/advisory/ntap-20210708-0002/ Common Vulnerability Exposure (CVE) ID: CVE-2021-35039 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0c18f29aae7ce3dadd26d8ee3505d07cc982df75 https://www.openwall.com/lists/oss-security/2021/07/06/3 http://www.openwall.com/lists/oss-security/2021/07/06/3
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.