| Description: | Summary:
The remote host is missing an update for the 'kernel-linus' package(s) announced via the MGASA-2023-0243 advisory.
Vulnerability Insight:
This kernel-linus update is based on upstream 5.15.122 and fixes at least
the following security issues:
Under specific microarchitectural circumstances, a register in 'Zen 2'
CPUs may not be written to 0 correctly. This may cause data from another
process and/or thread to be stored in the YMM register, which may allow
an attacker to potentially access sensitive information (CVE-2023-20593,
also known as Zenbleed).
This update adds a kernel-side mitigation for this issue to protect users
until Amd gets their fixed microcode / AGESA updates out for all affected
CPUs. The fixed microcode for Amd EPYC gen2 is available in the
microcode-0.20230613-2.mga8.nonfree package. For other affected CPUs, see
the referenced amd.com url that has info about estimated microcode update
timelines for various CPUs.
Linux Kernel nftables Use-After-Free Local Privilege Escalation
Vulnerability, nft_chain_lookup_byid() failed to check whether a chain
was active and CAP_NET_ADMIN is in any user or network namespace
(CVE-2023-31248).
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability,
nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN
is in any user or network namespace (CVE-2023-35001).
For other upstream fixes in this update, see the referenced changelogs.
Affected Software/OS:
'kernel-linus' package(s) on Mageia 8.
Solution:
Please install the updated package(s).
CVSS Score:
6.8
CVSS Vector:
AV:L/AC:L/Au:S/C:C/I:C/A:C
|
