CVE-2017-5715

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This kernel update is based on the upstream 4.4.111 and fixes several security issues.

The most important fix in this update is for the security issue named "Meltdown" that is fixed in theese kernels by enabling kernel Page Table Isolation (KTPI). Note that according to AMD, this issue does not effect Amd processors, so it is not enabled by default on systems using Amd CPU.

The list of known security fixes and mitigations in this kernel:

kvm: vmx: Scrub hardware GPRs at VM-exit. This enables partial mitigation in kvm for the security issue named "Spectre" (CVE-2017-5715, CVE-2017-5753).

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache (CVE-2017-5754, "Meltdown").

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (CVE-2017-15129).

The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (CVE-2017-17741).

The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic (CVE-2017-1000407).

The kernels are also fixed to allow loading cpu microcode for Amd family 17 (Zen) processors, and dracut have been fixed to properly support early firmware loading on the microcode on all Amd cpus.

For more info about Meltdown, Spectre and other fixes in this update, see the refences.

This kernel-tmb update is based on the upstream 4.4.111 and fixes several security issues.

The most important fix in this update is for the security issue named "Meltdown" that is fixed in theese kernels by enabling kernel Page Table Isolation (KTPI). Note that according to AMD, this issue does not effect Amd processors, so it is not enabled by default on systems using Amd CPU.

The list of known security fixes and mitigations in this kernel:

kvm: vmx: Scrub hardware GPRs at VM-exit. This enables partial mitigation in kvm for the security issue named "Spectre" (CVE-2017-5715, CVE-2017-5753).

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache (CVE-2017-5754, "Meltdown").

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (CVE-2017-15129).

The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (CVE-2017-17741).

The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic (CVE-2017-1000407).

The kernels are also fixed to allow loading cpu microcode for Amd family 17 (Zen) processors.

For more info about Meltdown, Spectre and other fixes in this update, see the refences.

This kernel update is based on the upstream 4.14.13 and fixes several security issues.

The most important fix in this update is for the security issue named "Meltdown" that is fixed in theese kernels by enabling kernel Page Table Isolation (KPTI). Note that according to AMD, this issue does not effect Amd processors, so it is not enabled by default on systems using Amd CPU.

The list of known security fixes and mitigations in this kernel:

kvm: vmx: Scrub hardware GPRs at VM-exit. This enables partial mitigation in kvm for the security issue named "Spectre" (CVE-2017-5715, CVE-2017-5753).

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache (CVE-2017-5754, "Meltdown").

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (CVE-2017-15129).

The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (CVE-2017-17741).

The kernels are also fixed to allow loading cpu microcode for Amd family 17 (Zen) processors, and dracut have been fixed to properly support early firmware loading on the microcode on all Amd cpus.

For more info about Meltdown, Spectre and other fixes in this update, see the refences.

This kernel-tmb update is based on the upstream 4.14.13 and fixes several security issues.

The most important fix in this update is for the security issue named "Meltdown" that is fixed in theese kernels by enabling kernel Page Table Isolation (KTPI). Note that according to AMD, this issue does not effect Amd processors, so it is not enabled by default on systems using Amd CPU.

The list of known security fixes and mitigations in this kernel:

kvm: vmx: Scrub hardware GPRs at VM-exit. This enables partial mitigation in kvm for the security issue named "Spectre" (CVE-2017-5715, CVE-2017-5753).

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache (CVE-2017-5754, "Meltdown").

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (CVE-2017-15129).

The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (CVE-2017-17741).

The kernels are also fixed to allow loading cpu microcode for Amd family 17 (Zen) processors.

For more info about Meltdown, Spectre and other fixes in this update, see the refences.

This update provides microcode fixes and mitigations for Spectre (CVE-2017-5715) for many Intel CPUs produced in the last 5 years.

So far the Intel microcode updates are for several processors from the Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake, Gemini Lake, Apollo Lake, Crystal Well and IVT platforms

We also have added the latest known microcode for Amd family 17 (Zen) processors.

We will provide more microcode updates when they are made available by Intel and Amd.

We also suggest that you check if there is updated BIOS and EFI firmwares from your hardware vendor.

This update provides version 384.111 from the R384 branch, in order to help mitigate Spectre and Meltdown CPU security issues and keeps the driver working with security hardened kernels.

Note that so far, nVidia does believe that their GPUs are immune to the referenced security issues.

It also adds support for newer GPUs and fixes some bugs.

The webkit2 package has been updated to version 2.18.5, containing Spectre mitigations.

Oracle VM VirtualBox incorporate the OpenSSL software libraries to provide cryptographic capabilities. OpenSSL versions through 1.0.2m and 1.1.0g are susceptible to a vulnerability that could allow an attacker to recover encryption keys and access protected communications (CVE-2017-3736).

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (CVE-2017-5715).

Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities that allows high privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it. While the vulnerability is in VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of VirtualBox
(CVE-2018-2676).

Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities that allows unauthenticated attacker with logon to the infrastructure where VirtualBox executes to compromise it. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of VirtualBox (CVE-2018-2685, CVE-2018-2686, CVE-2018-2687, CVE-2018-2688, CVE-2018-2689, CVE-2018-2690).

Oracle VM VirtualBox Guest Additions prior to 5.2.6 has an easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of VirtualBox (CVE-2018-2693).

Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities that allows low privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it. While the vulnerability is in VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of VirtualBox (CVE-2018-2694, CVE-2018-2698).

For other fixes in this update, see the referenced changelog.

This kernel update is based on the upstream 4.14.16 and fixes several security issues.

The most important fixes in this update is for the security issue named "Spectre, variant 2 (CVE-2017-5715)" that is partly mitigated by enabling retpoline support. For full retpoline mitigation, kernel needs to be built with a retpoline-aware cpmpiler (something we just added in testing), so next kernel will be built with full retpoline mititgation. For the security issue known as "Spectre, variant 1" there are some lfence bits added but full fix also needs microcode support, and that is something we dont have control over.

The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715. To make attacker job harder introduce BPF_JIT_ALWAYS_ON config option that removes interpreter from the kernel in favor of JIT-only mode. This is now enabled by default in Mageia kernels.

KVM on x86 gained a memory barrier on vmcs field lookup as part of mitigating Spectre variant 2 (CVE-2017-5753).

Other security fixes in this update:

Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner (CVE-2017-1000410).

The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (CVE-2017-8824).

WireGuard has been updated to 0.0.20180118.

For other fixes, see the referenced changelogs.

This kernel update is based on the upstream 4.4.114 and fixes several security issues.

The most important fixes in this update is for the security issue named "Spectre, variant 2 (CVE-2017-5715)" that is partly mitigated by enabling retpoline support. For full retpoline mitigation, kernel needs to be built with a retpoline-aware cpmpiler, something that wont happend in Mga5 as Mageia 5 has reached End of Support at December 31st, 2017 (even if we have been providing some extended support due to Meltdown/Spectre issues. If you want to receive further fixes regarding theese issues, you really need to upgrade to Mageia 6.

The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715. To make attacker job harder introduce BPF_JIT_ALWAYS_ON config option that removes interpreter from the kernel in favor of JIT-only mode. Note: In Mageia 5 we have BPF disabled by default, so it's not really an issue, but the fixes are still needed in case someone enables it

KVM on x86 gained a memory barrier on vmcs field lookup as part of mitigating Spectre variant 2 (CVE-2017-5753).

Other security fixes in this update:

The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP (CVE-2017-16911).

The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet (CVE-2017-16912).

The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet (CVE-2017-16913).

The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer dereference) via a specially crafted USB over IP packet (CVE-2017-16914).

Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner (CVE-2017-1000410).

The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (CVE-2017-8824).

For other fixes, see the referenced changelogs.

This update provides and update to 5.5.0 maintenance release and adds support for retpoline, a mitigation technique for CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' that is needed at least for the kernels.

This kernel update is based on the upstream 4.14.18 and adds some support for mitigating Spectre, variant 1 (CVE-2017-5753) and as it is built with the retpoline-aware gcc-5.5.0-1.mga6, it now provides full retpoline mitigation for Spectre, variant 2 (CVE-2017-5715).

WireGuard has been updated to 0.0.20180202

This update also fixes the rtl8812au driver that got broken/missing in the upgrade to 4.14 series kernels (mga#22524).

For other fixes in this update, read the referenced changelogs.

This kernel-tmb update is based on the upstream 4.14.18 and adds some support for mitigating Spectre, variant 1 (CVE-2017-5753) and as it is built with the retpoline-aware gcc-5.5.0-1.mga6, it now provides full retpoline mitigation for Spectre, variant 2 (CVE-2017-5715).

The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715. To make attacker job harder introduce BPF_JIT_ALWAYS_ON config option that removes interpreter from the kernel in favor of JIT-only mode. This is now enabled by default in Mageia kernels.

Other security fixes in this update:

Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner (CVE-2017-1000410).

The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (CVE-2017-8824).

WireGuard has been updated to 0.0.20180202

This update also fixes the rtl8812au driver that got broken/missing in the upgrade to 4.14 series kernels (mga#22524).

For other fixes in this update, read the referenced changelogs.

This kernel-linus update is based on the upstream 4.14.18 and adds some support for mitigating Spectre, variant 1 (CVE-2017-5753) and as it is built with the retpoline-aware gcc-5.5.0-1.mga6, it now provides full retpoline mitigation for Spectre, variant 2 (CVE-2017-5715).

The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715. To make attacker job harder introduce BPF_JIT_ALWAYS_ON config option that removes interpreter from the kernel in favor of JIT-only mode. This is now enabled by default in Mageia kernels.

Other security fixes in this update:

Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner (CVE-2017-1000410).

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (CVE-2017-15129).

The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (CVE-2017-17741).

For other fixes in this update, read the referenced changelogs.

This kernel update is based on the upstream 4.14.20 and adds KPTI mitigation for Meltdown (CVE-2017-5754) on 32bit x86. Arm platorm has now also addedmitigations for Meltdown (CVE-2017-5754) and Spectre, variant 2 (CVE-2017-5715).

For other fixes in this update, read the referenced changelogs.