Lucene search

K
mageiaGentoo FoundationMGASA-2021-0061
HistoryFeb 01, 2021 - 12:34 a.m.

Updated kernel packages fix security vulnerabilities

2021-02-0100:34:26
Gentoo Foundation
advisories.mageia.org
24

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

56.7%

This kernel update is based on upstream 5.10.12 and fixes at least the following security issues: fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS (CVE-2021-3178). An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel (CVE-2021-3347). nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (CVE-2021-3348). It also adds the following fixes: - ALSA: hda: Add Cometlake-R PCI ID - ALSA: hda: Add AlderLake-P PCI ID and HDMI codec vid - ALSA: hda/via: Apply the workaround generically for Clevo machines - ASoC: AMD Renoir - refine DMI entries for some Lenovo products - crypto: arm64/sha - add missing module aliases - drm/amdgpu: Add Missing Sienna Cichlid DID - drm/gpu/nouveau/dispnv50: Restore pushing of all data - fix and re-enamble 3rdparty rtl8821ce driver (mga#28150) - iwlwifi: provide gso_type to GSO packets (fixes upload speed regression) For other upstream fixes, see the referenced changelogs.

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

56.7%