Lucene search

K
mageiaGentoo FoundationMGASA-2020-0036
HistoryJan 13, 2020 - 7:51 p.m.

Updated kernel packages fix security vulnerability

2020-01-1319:51:20
Gentoo Foundation
advisories.mageia.org
18

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

44.9%

This update is based on upstream 5.4.10 and fixes at least the following security issues: ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero. (CVE-2019-19037) It also fixes various potential security issues related to buffer overflows, double frees, NUll pointer dereferences, improper / missing input validations and so on. Other fixes added in this update: - Revert ‘drm/amdgpu: Set no-retry as default.’, fixing amdgpu hang on Raven Ridge gpus (mga#25882) - drm/i915/gt: Detect if we miss WaIdleLiteRestore, fixes or at least works around gpu hang (mga#25930) - 3rdparty/rtl8812au: update to v5.6.4.2 (mga#25982) - add support for RTL8117 ethernet - rtl8xxxu: Add support for Edimax EW-7611ULB - mountpoint_last(): fix the treatment of LAST_BIND - HID: intel-ish-hid: ipc: Add Comet Lake H PCI device ID - HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID - HID: wacom: Recognize new MobileStudio Pro PID - updates to the arm64 defconfigs: - Enable some EFI stuff on arm64 (mga#26003) - Enable a lot of missing things on arm64 kernels (including ACPI and Amazon network driver) - Disable debug info on arm64 (mga#26015) - reduce difference between arm64 and x86_64 defconfigs WireGuard kernel module has been updated to 0.0.20200105 and the tools has been updated to 1.0.20200102. For other fixes in this update, see the referenced changelogs.

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

44.9%