| Summary: | Update request: kernel-5.15.25-1.mga8 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Thomas Backlund <tmb> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | High | CC: | 79625490833, andrewsfarm, brtians1, chb0, davidwhodgins, fri, smout.jan, sysadmin-bugs, tarazed25, wilcal.int |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK, MGA8-32-OK | ||
| Source RPM: | kernel | CVE: | |
| Status comment: | |||
|
Description
Thomas Backlund
2022-03-07 17:46:54 CET
This contains a fix for a local root exploit through overwriting files, even read-only and immutable files Priority:
Normal =>
High kmods are building as soon as buildsystem gets to them...
Advisory, added to svn:
type: security
subject: Updated kernel packages fix security vulnerabilities
CVE:
- CVE-2022-0847
- CVE-2022-25258
- CVE-2022-25375
src:
8:
core:
- kernel-5.15.25-1.mga8
- kmod-virtualbox-6.1.32-1.7.mga8
- kmod-xtables-addons-3.18-1.57.mga8
description: |
This kernel update is based on upstream 5.15.25 and fixes at least the
following security issues:
A vulnerability in the Linux kernel since version 5.8 due to uninitialized
variables. It enables anybody to write arbitrary data to arbitrary files,
even if the file is O_RDONLY, immutable or on a MS_RDONLY filesystem.
It can be used to inject code into arbitrary processes (CVE-2022-0847).
An issue was discovered in drivers/usb/gadget/composite.c in the Linux
kernel before 5.16.10. The USB Gadget subsystem lacks certain validation
of interface OS descriptor requests (ones with a large array index and
ones associated with NULL function pointer retrieval). Memory corruption
might occur (CVE-2022-25258).
An issue was discovered in drivers/usb/gadget/function/rndis.c in the
Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of
the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive
information from kernel memory (CVE-2022-25375).
For other upstream fixes, see the referenced changelogs.
references:
- https://bugs.mageia.org/show_bug.cgi?id=30131
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.24
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.25Keywords:
(none) =>
advisory Intel i5-2500, Intel graphics, wired Internet but also rtl8192eu wifi device, mga8-64 Plasma system using the server kernel. No installation issues. Vbox and rtl8192eu modules appeared to build and install properly. Rebooted, and tried a few things in an abbreviated test. Was able to establish and hold a wifi connection (using it now). Firefox working, also using it now. Tried to run a MGA8 guest in VirtualBox long enough to see if it would boot up and shut down, only to discover that I had not yet installed the extension pack on this particular install. Took care of that, and Vbox worked as it should. That's as far as I went, but based on what I see the server kernel is OK on this hardware. CC:
(none) =>
andrewsfarm kmods: i586: xtables-addons-kernel-5.15.25-desktop-1.mga8-3.18-1.57.mga8.i586.rpm xtables-addons-kernel-5.15.25-desktop586-1.mga8-3.18-1.57.mga8.i586.rpm xtables-addons-kernel-5.15.25-server-1.mga8-3.18-1.57.mga8.i586.rpm xtables-addons-kernel-desktop586-latest-3.18-1.57.mga8.i586.rpm xtables-addons-kernel-desktop-latest-3.18-1.57.mga8.i586.rpm xtables-addons-kernel-server-latest-3.18-1.57.mga8.i586.rpm x86_64: virtualbox-kernel-5.15.25-desktop-1.mga8-6.1.32-1.7.mga8.x86_64.rpm virtualbox-kernel-5.15.25-server-1.mga8-6.1.32-1.7.mga8.x86_64.rpm virtualbox-kernel-desktop-latest-6.1.32-1.7.mga8.x86_64.rpm virtualbox-kernel-server-latest-6.1.32-1.7.mga8.x86_64.rpm xtables-addons-kernel-5.15.25-desktop-1.mga8-3.18-1.57.mga8.x86_64.rpm xtables-addons-kernel-5.15.25-server-1.mga8-3.18-1.57.mga8.x86_64.rpm xtables-addons-kernel-desktop-latest-3.18-1.57.mga8.x86_64.rpm xtables-addons-kernel-server-latest-3.18-1.57.mga8.x86_64.rpm x86_64 Plasma i7-3520M, HD4000 graphics installed cpupower-5.15.25-1.mga8.x86_64.rpm cpupower-devel-5.15.25-1.mga8.x86_64.rpm kernel-desktop-5.15.25-1.mga8-1-1.mga8.x86_64.rpm kernel-desktop-devel-5.15.25-1.mga8-1-1.mga8.x86_64.rpm kernel-desktop-devel-latest-5.15.25-1.mga8.x86_64.rpm kernel-desktop-latest-5.15.25-1.mga8.x86_64.rpm kernel-userspace-headers-5.15.25-1.mga8.x86_64.rpm lib64bpf0-5.15.25-1.mga8.x86_64.rpm No installation issues Wifi works Bluetooth connections can be established and used Chrome/Chromium/Firefox works VB starts and works Games with steam works Sound works ... MGA8 64Bit OK x86_64 Plasma i9-11900KF, NVIDIA RTX 3080 Ti installed same packages as in comment 7 and performed same tests No installation issues Wifi works Bluetooth connections can be established and used Chrome/Chromium/Firefox works VB starts and works Games with steam works Sound works ... MGA8 64Bit OK On M8 hardware in a Vbox client, M8, Xfce, 32-bit clear uname -a urpmi kernel-desktop-latest urpmi kernel-userspace-headers urpmi cpupower urpmi virtualbox-guest-additions Linux localhost 5.15.23-desktop586-1.mga8 #1 SMP Fri Feb 11 09:54:44 UTC 2022 i686 i686 i386 GNU/Linux Package kernel-desktop-latest-5.15.23-1.mga8.i586 is already installed Package kernel-userspace-headers-5.15.23-1.mga8.i586 is already installed Package cpupower-5.15.23-1.mga8.i586 is already installed Package virtualbox-guest-additions-6.1.32-1.mga8.i586 is already installed Boots to a working desktop. Screen resolution is correct. Common apps work. install updates from from update_testing: clear uname -a urpmi --auto kernel-desktop-latest urpmi --auto kernel-userspace-headers urpmi --auto cpupower urpmi --auto virtualbox-guest-additions Reboot system. Linux localhost 5.15.25-desktop-1.mga8 #1 SMP Wed Feb 23 21:59:37 UTC 2022 i686 i686 i386 GNU/Linux Package kernel-desktop-latest-5.15.25-1.mga8.i586 is already installed Package kernel-userspace-headers-5.15.25-1.mga8.i586 is already installed Package cpupower-5.15.25-1.mga8.i586 is already installed Package virtualbox-guest-additions-6.1.32-1.mga8.i586 is already installed Boots to a working desktop. Screen resolution is correct. Common apps work. CC:
(none) =>
wilcal.int On M8 hardware in a Vbox client, M8, Plasma, 64-bit clear uname -a urpmi kernel-desktop-latest urpmi kernel-userspace-headers urpmi cpupower urpmi virtualbox-guest-additions Linux localhost 5.15.23-desktop-1.mga8 #1 SMP Fri Feb 11 09:56:46 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux Package kernel-desktop-latest-5.15.23-1.mga8.x86_64 is already installed Package kernel-userspace-headers-5.15.23-1.mga8.x86_64 is already installed Package cpupower-5.15.23-1.mga8.x86_64 is already installed Package virtualbox-guest-additions-6.1.32-1.mga8.x86_64 is already installed Boots to a working desktop. Screen resolution is correct. Common apps work. install updates from from update_testing: clear uname -a urpmi --auto kernel-desktop-latest urpmi --auto kernel-userspace-headers urpmi --auto cpupower urpmi --auto virtualbox-guest-additions Reboot system. Linux localhost 5.15.25-desktop-1.mga8 #1 SMP Wed Feb 23 19:39:18 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux Package kernel-desktop-latest-5.15.25-1.mga8.x86_64 is already installed Package kernel-userspace-headers-5.15.25-1.mga8.x86_64 is already installed Package cpupower-5.15.25-1.mga8.x86_64 is already installed Package virtualbox-guest-additions-6.1.32-1.mga8.x86_64 is already installed Boots to a working desktop. Screen resolution is correct. Common apps work. On real hardware, M8, Plasma, 64-bit
Packages checked:
clear
uname -a
urpmi kernel-desktop-latest
urpmi virtualbox
urpmi x11-driver-video-vboxvideo
urpmi kernel-desktop-devel-latest
urpmi kernel-userspace-headers
urpmi cpupower
urpmi virtualbox-kernel-desktop-latest
urpmi dkms-virtualbox
Linux localhost 5.15.23-desktop-1.mga8 #1 SMP Fri Feb 11 09:56:46 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Package kernel-desktop-latest-5.15.23-1.mga8.x86_64 is already installed
Package virtualbox-6.1.32-1.mga8.x86_64 is already installed
Package x11-driver-video-vboxvideo-1.0.0-6.mga8.x86_64 is already installed
Package kernel-desktop-devel-latest-5.15.23-1.mga8.x86_64 is already installed
Package kernel-userspace-headers-5.15.23-1.mga8.x86_64 is already installed
Package cpupower-5.15.23-1.mga8.x86_64 is already installed
Package virtualbox-kernel-desktop-latest-6.1.32-1.6.mga8.x86_64 is already installed
Package dkms-virtualbox-6.1.32-1.mga8.x86_64 is already installed
[root@localhost wilcal]# lspci -k
00:02.0 VGA compatible controller: Intel Corporation Iris Plus Graphics G1 (Ice Lake) (rev 07)
DeviceName: To Be Filled by O.E.M.
Subsystem: Dell Device 097c
Kernel driver in use: i915
Kernel modules: i915
Boots to working desktop
M8 i586 Vbox Xfce Client, boots to a working desktop - Screen size correct
M8 x86_64 Vbox Plasma Client, boots to a working desktop - Screen size correct
install updates from from update_testing:
clear
uname -a
urpmi --auto kernel-desktop-latest
urpmi --auto virtualbox
urpmi --auto x11-driver-video-vboxvideo
urpmi --auto kernel-desktop-devel-latest
urpmi --auto kernel-userspace-headers
urpmi --auto cpupower
urpmi --auto virtualbox-kernel-desktop-latest
urpmi --auto dkms-virtualbox
reboot system
Linux localhost 5.15.25-desktop-1.mga8 #1 SMP Wed Feb 23 19:39:18 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Package kernel-desktop-latest-5.15.25-1.mga8.x86_64 is already installed
Package virtualbox-6.1.32-1.mga8.x86_64 is already installed
Package x11-driver-video-vboxvideo-1.0.0-6.mga8.x86_64 is already installed
Package kernel-desktop-devel-latest-5.15.25-1.mga8.x86_64 is already installed
Package kernel-userspace-headers-5.15.25-1.mga8.x86_64 is already installed
Package cpupower-5.15.25-1.mga8.x86_64 is already installed
Package virtualbox-kernel-desktop-latest-6.1.32-1.6.mga8.x86_64 is already installed
Package dkms-virtualbox-6.1.32-1.mga8.x86_64 is already installed
[root@localhost wilcal]# lspci -k
00:02.0 VGA compatible controller: Intel Corporation Iris Plus Graphics G1 (Ice Lake) (rev 07)
DeviceName: To Be Filled by O.E.M.
Subsystem: Dell Device 097c
Kernel driver in use: i915
Kernel modules: i915
M8 i586 Vbox Xfce Client, boots to a working desktop - Screen size correct
M8 x86_64 Vbox Plasma Client, boots to a working desktop - Screen size correct
No regressions noticed on any of my installs. server kernel on aarch64 on rpi4b, desktop on one x86_64 host, server on another x86_64 host, x86_64 desktop on one vb guest, server on another, i586 server on one vb guest. CC:
(none) =>
davidwhodgins Hi
Plasma x86_64 "barebone" =OK
TESTS
=====
```
browser: ok
tunderbird: ok
nextcloud-client: ok
sound: ok
webcam: ok
virtualbox: ok
solaar (logitech mouse and keboard): ok
Bluetooth: ok
boinc with openCL: ok
mock: ok
signal-desktop (Mageia package): ok
schildichat matrix client (Mageia package): ok
psensor / sensors-detect: ok (GPU fan speed still off but not worse, not better)
libreoffice with openCL: ok
darktable with openCL: ok
```
INSTALLATION
============
```
Via QArepo. No issues.
SYSTEM CONFIGURATION
====================
```
System: Host: cbct-desk Kernel: 5.15.25-desktop-1.mga8 x86_64 bits: 64 Desktop: KDE Plasma 5.20.4 Distro: Mageia 8 mga8
Machine: Type: Desktop System: ASUS product: N/A v: N/A serial: <superuser required>
Mobo: ASUSTeK model: TUF GAMING B550M-PLUS v: Rev X.0x serial: <superuser required> UEFI: American Megatrends
v: 2423 date: 08/10/2021
CPU: Info: 12-Core model: AMD Ryzen 9 5900X bits: 64 type: MT MCP L2 cache: 6 MiB
Speed: 3707 MHz min/max: 2200/3700 MHz Core speeds (MHz): 1: 3707 2: 3879 3: 4526 4: 3402 5: 3669 6: 4330
7: 3735 8: 3705 9: 3714 10: 4643 11: 3295 12: 3306 13: 3733 14: 3297 15: 3172 16: 4567 17: 3517 18: 3760
19: 3684 20: 4629 21: 3663 22: 3611 23: 3658 24: 3652
Graphics: Device-1: Advanced Micro Devices [AMD/ATI] Ellesmere [Radeon RX 470/480/570/570X/580/580X/590] driver: amdgpu
v: kernel
Display: x11 server: Mageia X.org 1.20.14 driver: amdgpu,v4l resolution: 2560x1440~60Hz
OpenGL: renderer: AMD Radeon RX 570 Series (POLARIS10 DRM 3.42.0 5.15.25-desktop-1.mga8 LLVM 11.0.1)
v: 4.6 Mesa 21.3.6
Audio: Device-1: AMD Ellesmere HDMI Audio [Radeon RX 470/480 / 570/580/590] driver: snd_hda_intel
Device-2: Advanced Micro Devices [AMD] Starship/Matisse HD Audio driver: snd_hda_intel
Device-3: Logitech HD Webcam C525 type: USB driver: snd-usb-audio,uvcvideo
Sound Server: ALSA v: k5.15.25-desktop-1.mga8
Network: Device-1: Realtek RTL8125 2.5GbE driver: r8169
IF: enp6s0 state: up speed: 1000 Mbps duplex: full mac: f0:2f:74:2e:5b:c5
Drives: Local Storage: total: 1.59 TiB used: 711.29 GiB (43.6%)
ID-1: /dev/nvme0n1 vendor: Seagate model: FireCuda 520 SSD ZP500GM30002 size: 465.76 GiB
ID-2: /dev/sda vendor: Western Digital model: WD10EZEX-00RKKA0 size: 931.51 GiB
ID-3: /dev/sdb vendor: Samsung model: SSD 850 EVO 250GB size: 232.89 GiB
Partition: ID-1: / size: 83.17 GiB used: 39.63 GiB (47.7%) fs: ext4 dev: /dev/nvme0n1p2
ID-2: /home size: 369.45 GiB used: 167.93 GiB (45.5%) fs: ext4 dev: /dev/nvme0n1p4
Swap: ID-1: swap-1 type: file size: 16 GiB used: 0 KiB (0.0%) file: /swapfile
ID-2: swap-2 type: partition size: 3.91 GiB used: 1024 KiB (0.0%) dev: /dev/nvme0n1p3
Sensors: System Temperatures: cpu: 40.0 C mobo: 36.0 C gpu: amdgpu temp: 47.0 C
Fan Speeds (RPM): fan-1: 983 fan-2: 1000 fan-3: 0 fan-7: 782 gpu: amdgpu fan: 919
Info: Processes: 469 Uptime: 1h 59m Memory: 31.33 GiB used: 7.1 GiB (22.6%) Shell: Bash inxi: 3.2.01
openCL AMD by installing manually some files of amdgpu-pro-20.20-1089974-rhel-8.2
```CC:
(none) =>
chb0 MGA8-64, Gnome, Asus Laptop AMD A6-9225 RADEON R4 RTL8723BE Bluetooth The following 3 packages are going to be installed: - cpupower-5.15.25-1.mga8.x86_64 - kernel-desktop-5.15.25-1.mga8-1-1.mga8.x86_64 - kernel-desktop-latest-5.15.25-1.mga8.x86_64 ---- restarted $ uname -a Linux localhost.localdomain 5.15.25-desktop-1.mga8 #1 SMP Wed Feb 23 19:39:18 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux - suspend/wake-up work - audio works - wifi/bluetooth work - firefox works - Chromium works - libreoffice working CC:
(none) =>
brtians1 Foolishness, my Dell Inspiron 5100, 32-bit P4, Radeon RV200 graphics, aged Atheros-based wifi, MGA8-32 Xfce system. No installation issues. After reboot, no issues noted. Performance isn't what I'm used to, but that's due to the limits of this 20 year old hardware. Just having it still work with a modern OS is a marvel. Mageia8, x86_64. Quad Core Intel Core i7-4790 NVIDIA GM204 [GeForce GTX 970] - NVIDIA 470.74 Desktop and server versions updated cleanly. Omitted kernel source. Mate desktop running without issues. Bluetooth recent connection to portable speaker reestablished. stress tests OK, perf test completed. $ cpupower -c 0,4-6 frequency-info ..... stellarium looks good. Video and pulseaudio working with vlc. Networking functional - NFS shares mounted, NAS accessible. Virtualbox running fine. Looks good so far. CC:
(none) =>
tarazed25 Thanks for the tests, flushing out Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0092.html Status:
NEW =>
RESOLVED OK here mga8-64, i7, nvidia-current
System was running backport kernel 5.16.10-2
Disabled backports repo and downgraded 5.16.10-2 versions to 5.15.25-1:
$ sudo urpmi --downgrade cpupower kernel-userspace-headers lib64bpf0
Installed
- kernel-desktop-5.15.25-1.mga8-1-1.mga8.x86_64
- kernel-desktop-devel-5.15.25-1.mga8-1-1.mga8.x86_64
- virtualbox-kernel-5.15.25-desktop-1.mga8-6.1.32-1.7.mga8.x86_64
$ uname -a
Linux svarten.tribun 5.15.25-desktop-1.mga8 #1 SMP Wed Feb 23 19:39:18 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
$ dkms status showing OK
BOINC detects CUDA and OpenCL
Hardware:
My workstation "svarten": Mainboard: Sabertooth P67, CPU: i7-3770, RAM 16G, GM107 [GeForce GTX 750] using nvidia-current; GeForce 635 series and later, 4k display. Disk&Filesystem: SSD with /boot/EFI and ext4 /boot, LUKS{LVM {swap, ext4 /home & / } and a spinner at /mnt/spinner
Tested:
Plasma desktop; using Thunderbird, LibreOffice, Ktorrent, Tor realy, Nextcloud client, Firefox ESR, flatpak Firefox, flatpak Spotify, java program FriBOK, ...
Stress test: While working with other things BOINC use all cores to 100%, videos do not stutter in Chromium, nor Firefox ESR but do in flatpak version
VirtualBox tests OK:
a) Guest: my usual MSW7pro-64, tests OK: bidirectional clipboard, shared folders write protected and not, USB2 memory stick read&write (using upstream extension pack), drag file from Dolphin to Windows Explorer, video playing in Firefox and Chrome while CPU is heavily loaded.
b) Guest: Mageia 8 -64 LXDE: booted before and after kernel update update in guest. Test OK: Window resizing, bidirectional clipboard, host file sharing, internet, video, USB flashstick.
c) Guest: BOINC Rosetta Python ProjectsCC:
(none) =>
fri |