ALSA-2022:1988 — Important: kernel security, bug fix, and enhancement update

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

* kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

* kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

* kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

* kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

* kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

* kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

* kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

* kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

* kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

* kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

* kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

* kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

* kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

* kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

* kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

* kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

* kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

* kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

* kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

* kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

* hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

* kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

* kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

* kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

* kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

* kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

* kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

* kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

* kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

* kernel: information leak in the IPv6 implementation (CVE-2021-45485)

* kernel: information leak in the IPv4 implementation (CVE-2021-45486)

* hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

* hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

* kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

* kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

* kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

* kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 20

Release	Package	Fixed in
AlmaLinux · 8	bpftool	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-abi-stablelists	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-core	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-cross-headers	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-debug	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-debug-core	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-debug-devel	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-debug-modules	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-debug-modules-extra	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-devel	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-doc	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-headers	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-modules	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-modules-extra	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-tools	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-tools-libs	4.18.0-372.9.1.el8
AlmaLinux · 8	kernel-tools-libs-devel	4.18.0-372.9.1.el8
AlmaLinux · 8	perf	4.18.0-372.9.1.el8
AlmaLinux · 8	python3-perf	4.18.0-372.9.1.el8

Vulnerabilities 40

Medium 6.5

CVE-2022-0001 Public exploit

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 11, 2022
Medium 6.5

CVE-2022-0002

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 11, 2022
Medium 5.6

CVE-2017-5715 Public exploit EPSS 73%

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disc…

Intel Microprocessors with Speculative Execution linux-raspi2 linux-hwe Debian Ubuntu Alpine

Jan 4, 2018
Medium 5.1

CVE-2020-4788

IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the da…

IBM AIX VIOS linux-raspi2 Debian Ubuntu

Nov 20, 2020
Medium 4.4

CVE-2021-4037

Kernel: security regression for cve-2018-13405

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a sc…

Linux Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu

Aug 24, 2022
Medium 4.0

CVE-2021-21781

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. Th…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Aug 18, 2021
Unscored —

CVE-2018-13405 Public exploit

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 6, 2018
Unscored —

CVE-2020-0404

In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. Thi…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Sep 17, 2020
Unscored —

CVE-2020-13974

An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_a…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jun 9, 2020
Unscored —

CVE-2020-27820

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if rem…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 2, 2021
Unscored —

CVE-2021-0941

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to …

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Oct 25, 2021
Unscored —

CVE-2021-20322

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functiona…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 18, 2022
Unscored —

CVE-2021-26401

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

AMD AMD Processors linux-raspi2 linux-hwe Debian Ubuntu Alpine

Mar 11, 2022
Unscored —

CVE-2021-29154

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Apr 8, 2021
Unscored —

CVE-2021-3612

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 9, 2021
Unscored —

CVE-2021-3669

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segm…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Aug 26, 2022
Unscored —

CVE-2021-37159

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checkin…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jul 21, 2021
Unscored —

CVE-2021-3743

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sa…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 4, 2022
Unscored —

CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c,…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 4, 2022
Unscored —

CVE-2021-3752

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket a…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 16, 2022
Unscored —

CVE-2021-3759

A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 23, 2022
Unscored —

CVE-2021-3764

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a de…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Aug 23, 2022
Unscored —

CVE-2021-3772

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through inv…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 2, 2022
Unscored —

CVE-2021-3773 Public exploit

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…

linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

Feb 16, 2022
Unscored —

CVE-2021-4002

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 3, 2022
Unscored —

CVE-2021-4083

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 18, 2022
Unscored —

CVE-2021-4157

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way user…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2021-41864

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to tr…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Oct 1, 2021
Unscored —

CVE-2021-4197

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 23, 2022
Unscored —

CVE-2021-4203

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2021-42739

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/fire…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Oct 20, 2021
Unscored —

CVE-2021-43056

An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the ho…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Oct 28, 2021
Unscored —

CVE-2021-43389

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_ca…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Nov 4, 2021
Unscored —

CVE-2021-43976

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Nov 17, 2021
Unscored —

CVE-2021-44733 Public exploit

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 22, 2021
Unscored —

CVE-2021-45485 Public exploit

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 25, 2021
Unscored —

CVE-2021-45486

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 25, 2021
Unscored —

CVE-2022-0286

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of ser…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 31, 2022
Unscored —

CVE-2022-0322

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2022-1011 Public exploit

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 18, 2022

References

report
https://vulners.com/cve/CVE-2020-0404
report
https://vulners.com/cve/CVE-2020-13974
report
https://vulners.com/cve/CVE-2020-27820
report
https://vulners.com/cve/CVE-2020-4788
report
https://vulners.com/cve/CVE-2021-0941
report
https://vulners.com/cve/CVE-2021-20322
report
https://vulners.com/cve/CVE-2021-21781
report
https://vulners.com/cve/CVE-2021-26401
report
https://vulners.com/cve/CVE-2021-29154
report
https://vulners.com/cve/CVE-2021-3612
report
https://vulners.com/cve/CVE-2021-3669
report
https://vulners.com/cve/CVE-2021-37159
report
https://vulners.com/cve/CVE-2021-3743
report
https://vulners.com/cve/CVE-2021-3744
report
https://vulners.com/cve/CVE-2021-3752
report
https://vulners.com/cve/CVE-2021-3759
report
https://vulners.com/cve/CVE-2021-3764
report
https://vulners.com/cve/CVE-2021-3772
report
https://vulners.com/cve/CVE-2021-3773
report
https://vulners.com/cve/CVE-2021-4002
report
https://vulners.com/cve/CVE-2021-4037
report
https://vulners.com/cve/CVE-2021-4083
report
https://vulners.com/cve/CVE-2021-4157
report
https://vulners.com/cve/CVE-2021-41864
report
https://vulners.com/cve/CVE-2021-4197
report
https://vulners.com/cve/CVE-2021-4203
report
https://vulners.com/cve/CVE-2021-42739
report
https://vulners.com/cve/CVE-2021-43056
report
https://vulners.com/cve/CVE-2021-43389
report
https://vulners.com/cve/CVE-2021-43976
report
https://vulners.com/cve/CVE-2021-44733
report
https://vulners.com/cve/CVE-2021-45485
report
https://vulners.com/cve/CVE-2021-45486
report
https://vulners.com/cve/CVE-2022-0001
report
https://vulners.com/cve/CVE-2022-0002
report
https://vulners.com/cve/CVE-2022-0286
report
https://vulners.com/cve/CVE-2022-0322
report
https://vulners.com/cve/CVE-2022-1011

Important: kernel security, bug fix, and enhancement update

Summary

Fixed packages 20

Vulnerabilities 40

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disc…

IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the da…

Kernel: security regression for cve-2018-13405

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. Th…

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an…

In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. Thi…

An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_a…

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if rem…

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to …

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functiona…

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them…

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc…

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segm…

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checkin…

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sa…

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c,…

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket a…

A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a …

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a de…

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through inv…

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way user…

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to tr…

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found …

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race …

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/fire…

An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the ho…

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_ca…

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (…

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of…

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash…

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of ser…

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the…

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…

References