Test ID:	1.3.6.1.4.1.25623.1.1.10.2023.0238
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2023-0238)
Summary:	The remote host is missing an update for the 'kernel-linus' package(s) announced via the MGASA-2023-0238 advisory.
Description:	Summary: The remote host is missing an update for the 'kernel-linus' package(s) announced via the MGASA-2023-0238 advisory. Vulnerability Insight: This kernel-linus update is based on upstream 5.15.120 and fixes at least the following security issues: A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system. This is fixed by removing DECnet support (CVE-2023-3338). A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue (CVE-2023-3390). NOTE!! This kernel also contains a fix for dkms builds hanging / stalling during upgrade to Mageia 9 (mga#31982) due to the new make 4.4 series utility ending up in a loop processing Makefile in kernel-devel packages. So if you use dkms packaged drivers and kernel-linus, you need to be running this kernel (or any later released ones) before you do an online upgrade to avoid the upgrade stalling / hanging. For other upstream fixes in this update, see the referenced changelogs. Affected Software/OS: 'kernel-linus' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-3338 Debian Security Information: DSA-5480 (Google Search) https://www.debian.org/security/2023/dsa-5480 RHBZ#2218618 https://bugzilla.redhat.com/show_bug.cgi?id=2218618 https://access.redhat.com/security/cve/CVE-2023-3338 https://seclists.org/oss-sec/2023/q2/276 https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html Common Vulnerability Exposure (CVE) ID: CVE-2023-3390 Debian Security Information: DSA-5448 (Google Search) https://www.debian.org/security/2023/dsa-5448 Debian Security Information: DSA-5461 (Google Search) https://www.debian.org/security/2023/dsa-5461 http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1240eb93f0616b21c675416516ff3d74798fdc97 https://kernel.dance/1240eb93f0616b21c675416516ff3d74798fdc97 https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.