Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.15.43 and fixes at least the following security issues: A race condition in the perf subsystem allows for a local privilege escalation. NOTE: Mageia kernels by default has disabled the perf usage for unprivileged users, effectively rendering this...

Unbreakable Enterprise kernel security update

5.4.17-2136.307.3.5 - KVM: x86: avoid calling x86 emulator without a decoded instruction Sean Christopherson Orabug: 34211496 CVE-2022-1852 CVE-2022-1852...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.307.3.5 - KVM: x86: avoid calling x86 emulator without a decoded instruction Sean Christopherson Orabug: 34211496 CVE-2022-1852...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2022-9442)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9442 advisory. 5.4.17-2136.307.3.5 - KVM: x86: avoid calling x86 emulator without a decoded instruction Sean Christopherson Orabug: 34211496 CVE-2022-1852 CVE-2022-1852...

CVE-2021-20257 affecting package qemu-kvm 4.2.0-38

CVE-2021-20257 affecting package qemu-kvm 4.2.0-38. A patched version of the package is available...

CVE-2021-3638 affecting package qemu-kvm 4.2.0-38

CVE-2021-3638 affecting package qemu-kvm 4.2.0-38. A patched version of the package is available...

CVE-2021-3748 affecting package qemu-kvm 4.2.0-38

CVE-2021-3748 affecting package qemu-kvm 4.2.0-38. A patched version of the package is available...

CVE-2022-1789

A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause a kernel oops condition on the host, resulting in a denial of service. Mitigation Mitigati...

USN-5442-1: Linux kernel vulnerabilities

Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or execute arbitrary code...

GHSA-99RX-9X8V-9J8P OpenStack Nova Live migration can leak root disk into ephemeral storage

The icreateimagesandbacking aka createimagesandbacking method in libvirt driver in OpenStack Compute Nova Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users vi...

OpenStack Nova Live migration can leak root disk into ephemeral storage

The icreateimagesandbacking aka createimagesandbacking method in libvirt driver in OpenStack Compute Nova Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users vi...

kernel security, bug fix, and enhancement update

4.18.0-372.9.1.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CVE-2022-0171

A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root host user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization SEV...

USN-5418-1: Linux kernel vulnerabilities

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive...

USN-5416-1: Linux kernel (OEM) vulnerabilities

Qiuhao Li, Gaoning Pan and Yongkang Jia discovered that the KVM implementation in the Linux kernel did not properly perform guest page table updates in some situations. An attacker in a guest vm could possibly use this to crash the host OS. CVE-2022-1158 It was discovered that the implementation ...

SUSE SLES15 Security Update : kernel (Live Patch 23 for SLE 15 SP2) (SUSE-SU-2022:1637-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1637-1 advisory. - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run...

Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5416-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5416-1 advisory. Qiuhao Li, Gaoning Pan and Yongkang Jia discovered that the KVM implementation in the Linux kernel did not properly perform guest page table updates in...

Moderate: Red Hat Security Advisory: virt:av and virt-devel:av security update

An update for the virt:av and virt-devel:av modules is now available for Advanced Virtualization for RHEL 8.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 8 : kernel-rt (RHSA-2022:1975)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1975 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

SUSE SLES15 Security Update : kernel (Live Patch 0 for SLE 15 SP3) (SUSE-SU-2022:1605-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1605-1 advisory. - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run...