| Summary: | Update request: kernel-5.15.43-1.mga8 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Thomas Backlund <tmb> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | High | CC: | andrewsfarm, brtians1, chb0, davidwhodgins, fri, guillaume.royer, sysadmin-bugs, tarazed25, wilcal.int |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK, MGA8-32-OK | ||
| Source RPM: | kernel | CVE: | |
| Status comment: | |||
| Attachments: | Journal extract showing segfault | ||
|
Description
Thomas Backlund
2022-05-26 09:01:03 CEST
Thomas Backlund
2022-05-26 09:03:18 CEST
Severity:
major =>
critical
Advisory, added to svn:
type: security
subject: Updated kernel packages fix security vulnerabilities
CVE:
- CVE-2022-1729
- CVE-2022-1789
- CVE-2022-21499
src:
8:
core:
- kernel-5.15.43-1.mga8
- kmod-virtualbox-6.1.34-1.8.mga8
- kmod-xtables-addons-3.20-1.4.mga8
description: |
This kernel update is based on upstream 5.15.43 and fixes at least the
following security issues:
A race condition in the perf subsystem allows for a local privilege
escalation. NOTE: Mageia kernels by default has disabled the perf usage
for unprivileged users, effectively rendering this vulnerability harmless
(CVE-2022-1729).
KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
(CVE-2022-1789).
Kernel could allow a remote attacker to bypass security restrictions,
caused by a lockdown break issue. By sending a specially-crafted request
using the kernel debugger, an attacker could exploit this vulnerability
to perform read and write access to kernel memory (CVE-2022-21499).
Other fixes in this update:
- ice: fix crash at allocation failure
For other upstream fixes, see the referenced changelogs.
references:
- https://bugs.mageia.org/show_bug.cgi?id=30475
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.42
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.43Keywords:
(none) =>
advisory New hardware: Kernel: 5.15.43-desktop-1.mga8 x86_64 System: XDO.AI product: Pantera Pico PC Mobo: XDO Trade model: XDO Trade Co., LTD Quad Core Intel Celeron J4125 [MCP] Intel GeminiLake [UHD Graphics 600] driver: i915 OpenGL: renderer: Mesa Intel UHD Graphics 600 (GLK 2) Intel Gemini Lake PCH CNVi WiFi driver: iwlwifi Memory: 7.59 GiB No problems in Mate AFAICS. Not installing Virtualbox - not enough resources. NFS shares mounted successfully. Bluetooth connected portable audio device as soon as it was switched on. ping on LAN devices works. $ cpupower -c all frequency-info returns information for all four cores. Ran stress a couple of times and glmark2. Have to retract "No problems". Looks like this system is seriously underpowered. It seems to slow down after a few minutes use to the extent that it cannot keep up with my slow typing speed. Or maybe something else is wrong. In the past this sort of problem could be attributed to low batteries or possibly some failure at the USB end. Here the keyboard mouse combo transmits wireless to the USB 1.0 port. $ lsusb Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub Bus 001 Device 005: ID 8087:0aaa Intel Corp. Bluetooth 9460/9560 Jefferson Peak (JfP) Bus 001 Device 003: ID 0bda:0129 Realtek Semiconductor Corp. RTS5129 Card Reader Controller Bus 001 Device 004: ID 046d:c534 Logitech, Inc. Unifying Receiver Bus 001 Device 002: ID 05e3:0608 Genesys Logic, Inc. Hub Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub CC:
(none) =>
tarazed25 HP Probook 6550b, i3, Intel graphics, Intel wifi, MGA8-64 Plasma system. No installation issues, and no issues noted after reboot, so far. Firefox, vlc, Thunderbird, VirtualBox all OK. Did a quick, non-thorough test in a vbox MGA8 -64 guest, also OK. CC:
(none) =>
andrewsfarm Desktop computer, Plasma x86_64, AMD Ryzen
No issue so far.
Installation using QArepo
=========================
```
Paquetage Version Révision Arch
(média « QA Testing (64-bit) »)
cpupower 5.15.43 1.mga8 x86_64
kernel-desktop-5.15.43-1.mga8 1 1.mga8 x86_64
kernel-desktop-latest 5.15.43 1.mga8 x86_64
kernel-userspace-headers 5.15.43 1.mga8 x86_64
lib64bpf0 5.15.43 1.mga8 x86_64
virtualbox-kernel-5.15.43-des> 6.1.34 1.8.mga8 x86_64
virtualbox-kernel-desktop-lat> 6.1.34 1.8.mga8 x86_64
```
TESTS
=====
```
browser: ok
tunderbird: ok
nextcloud-client: ok
sound: ok
webcam: ok
virtualbox: ok
solaar (logitech mouse and keyboard): ok
Bluetooth: ok
boinc with openCL: ok
mock: ok
signal-desktop (Mageia package): ok
schildichat matrix client (Mageia package): ok
psensor / sensors-detect: ok (GPU fan speed still off but not worse, not better)
libreoffice with openCL: ok
```
SYSTEM CONFIGURATION
====================
```
System: Host: cbct-desk Kernel: 5.15.43-desktop-1.mga8 x86_64 bits: 64 Desktop: KDE Plasma 5.20.4
Distro: Mageia 8 mga8
Machine: Type: Desktop System: ASUS product: N/A v: N/A serial: <superuser required>
Mobo: ASUSTeK model: TUF GAMING B550M-PLUS v: Rev X.0x serial: <superuser required>
UEFI: American Megatrends v: 2423 date: 08/10/2021
CPU: Info: 12-Core model: AMD Ryzen 9 5900X bits: 64 type: MT MCP L2 cache: 6 MiB
Speed: 3459 MHz min/max: 2200/3700 MHz Core speeds (MHz): 1: 3459 2: 2929 3: 2810 4: 2814 5: 3235
6: 3219 7: 4327 8: 3260 9: 3623 10: 3665 11: 2239 12: 3589 13: 3497 14: 2540 15: 2965 16: 2641
17: 2690 18: 3402 19: 2884 20: 4483 21: 2557 22: 3367 23: 3040 24: 3317
Graphics: Device-1: Advanced Micro Devices [AMD/ATI] Ellesmere [Radeon RX 470/480/570/570X/580/580X/590]
driver: amdgpu v: kernel
Display: x11 server: Mageia X.org 1.20.14 driver: amdgpu,v4l resolution: 2560x1440~60Hz
OpenGL: renderer: AMD Radeon RX 570 Series (POLARIS10 DRM 3.42.0 5.15.43-desktop-1.mga8 LLVM 11.0.1)
v: 4.6 Mesa 21.3.8
Audio: Device-1: AMD Ellesmere HDMI Audio [Radeon RX 470/480 / 570/580/590] driver: snd_hda_intel
Device-2: Advanced Micro Devices [AMD] Starship/Matisse HD Audio driver: snd_hda_intel
Device-3: Logitech HD Webcam C525 type: USB driver: snd-usb-audio,uvcvideo
Sound Server: ALSA v: k5.15.43-desktop-1.mga8
Network: Device-1: Realtek RTL8125 2.5GbE driver: r8169
IF: enp6s0 state: up speed: 1000 Mbps duplex: full mac: f0:2f:74:2e:5b:c5
Drives: Local Storage: total: 1.59 TiB used: 750.56 GiB (46.0%)
ID-1: /dev/nvme0n1 vendor: Seagate model: FireCuda 520 SSD ZP500GM30002 size: 465.76 GiB
ID-2: /dev/sda vendor: Western Digital model: WD10EZEX-00RKKA0 size: 931.51 GiB
ID-3: /dev/sdb vendor: Samsung model: SSD 850 EVO 250GB size: 232.89 GiB
Partition: ID-1: / size: 83.11 GiB used: 34.46 GiB (41.5%) fs: ext4 dev: /dev/nvme0n1p2
ID-2: /home size: 369.38 GiB used: 186.21 GiB (50.4%) fs: ext4 dev: /dev/nvme0n1p4
Swap: ID-1: swap-1 type: file size: 16 GiB used: 0 KiB (0.0%) file: /swapfile
ID-2: swap-2 type: partition size: 3.91 GiB used: 768 KiB (0.0%) dev: /dev/nvme0n1p3
Sensors: System Temperatures: cpu: 41.5 C mobo: 38.0 C gpu: amdgpu temp: 49.0 C
Fan Speeds (RPM): fan-1: 938 fan-2: 906 fan-3: 0 fan-7: 736 gpu: amdgpu fan: 934
```CC:
(none) =>
chb0 mga8-64 OK here;
Hardware: My workstation "svarten": Mainboard: Sabertooth P67, CPU: i7-3770, RAM 16G, GM107 [GeForce GTX 750] using nvidia-current; GeForce 635 series and later, 4k display. Disk&Filesystem: SSD with /boot/EFI and ext4 /boot, LUKS{LVM {swap, ext4 /home & / } and a spinner at /mnt/spinner
$ uname -a
Linux svarten.tribun 5.15.43-desktop-1.mga8 #1 SMP Wed May 25 20:17:13 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
dkms status tells OK for nvidia and VirtualBox
BOINC detects CUDA and OpenCL
Tested: Plasma desktop; using Thunderbird, LibreOffice, Ktorrent, Nextcloud client, Syncthing, Firefox ESR with video (slow), flatpak Firefox, java program FriBOK, ...
Tests OK as VirtualBox Host:
Guest 1: my usual MSW7pro-64, tests OK: dynamic guest window resizing, bidirectional clipboard, host shared folders write protected and not, USB2 memory stick read&write (using upstream extension pack), video playing in Firefox and Chrome.
Guest 2: OK: BOINC LHC@home ATLAS simulation virtual machine 7CPU.CC:
(none) =>
fri ASUS Laptop - xfce N4000 - celeron UHD Graphics 600 (integrated) Gemini Lake Wifi The following 5 packages are going to be installed: - cpupower-5.15.43-1.mga8.x86_64 - kernel-desktop-5.15.43-1.mga8-1-1.mga8.x86_64 - kernel-desktop-latest-5.15.43-1.mga8.x86_64 - kernel-userspace-headers-5.15.43-1.mga8.x86_64 - lib64bpf0-5.15.43-1.mga8.x86_64 76MB of additional disk space will be used. -- rebooted $ uname -a Linux localhost 5.15.43-desktop-1.mga8 #1 SMP Wed May 25 20:17:13 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux - wifi works - firefox working properly - sound/video are good - suspend works CC:
(none) =>
brtians1 Pico Pantera system re comment 2: Rebooted to the server kernel with fewer workspaces and terminals. So far so good. 5.15.43-desktop-1.mga8 x86_64 Tried on three Intel systems, two with nvidia graphics. No regressions so far. Virtualbox running fine on the nvidia systems. Kernel: 5.15.43-server-1.mga8 x86_64 Quad Core Intel Core i7-4790 [MT MCP] NVIDIA GM204 [GeForce GTX 970] driver: nvidia 470.129.06 No problems in Mate. Bluetooth connection to audio device worked right away. Youtube videos in Firefox. LO writer, Virtualbox with NAS and NFS, Free-to-air TV, glmark2, stellarium, vlc video, OpenCPN, gimp, ristretto, all good. Created attachment 13276 [details]
Journal extract showing segfault
This is in an x86_64 guest. I'd run some basic tests, switched to an i586 guest
running on the same host. When I came back to the x86_64 guest, it was not
responsive. After resetting the guest, extracted the relevant journal entries from
journalctl -b -1.CC:
(none) =>
davidwhodgins I tried to recreate the situation that caused the segfault with no success. MGA 64 Core I3 6Go RAM, GeForce 520M driver 390. Driver Braidcom nonfree. Updated with QA repo ans rpms: cpupower 5.15.43 1.mga8 x86_64 kernel-desktop-5.15.43-1.mga8 1 1.mga8 x86_64 kernel-desktop-devel-5.15.43-> 1 1.mga8 x86_64 kernel-desktop-devel-latest 5.15.43 1.mga8 x86_64 kernel-desktop-latest 5.15.43 1.mga8 x86_64 kernel-userspace-headers 5.15.43 1.mga8 x86_64 lib64bpf0 5.15.43 1.mga8 x86_64 virtualbox-kernel-5.15.43-des> 6.1.34 1.8.mga8 x86_64 virtualbox-kernel-desktop-lat> 6.1.34 1.8.mga8 x86_64 No issues after reboot. VM (MGA Cauldron) Ok, Sound OK, Wi-fi connection Ok, switching with mageia-prime Ok Internet Browsing Ok CC:
(none) =>
guillaume.royer Other then the one virtualbox x86_64 guest segfault that I cannot recreate, no other regressions noticed on my two x86_64, one aarch64 rpi 4b systems or in the i586 and x86_64 guests. Foolishness, a Dell Inspiron 5100, P4, AMD RV200 graphics, ath3k wifi, MGA8-32 Xfce, using the desktop kernel. All looks good here. AMD Phenom II X4 910, AMD HD 8490 graphics, ath9k and rtl8192eu wifi, mga8-64 Plasma system. No installation issues. rtl8192eu and virtualbox kernel modules successfully built and installed. After reboot, everything looks OK. On M8 hardware in a Vbox client, M8, Xfce, 32-bit clear uname -a urpmi kernel-desktop-latest urpmi kernel-userspace-headers urpmi cpupower urpmi virtualbox-guest-additions Linux localhost 5.15.41-desktop586-1.mga8 #1 SMP Wed May 18 18:39:20 UTC 2022 i686 i686 i386 GNU/Linux Package kernel-desktop-latest-5.15.41-1.mga8.i586 is already installed Package kernel-userspace-headers-5.15.41-1.mga8.i586 is already installed Package cpupower-5.15.41-1.mga8.i586 is already installed Package virtualbox-guest-additions-6.1.34-1.2.mga8.i586 is already installed Boots to a working desktop. Screen resolution is correct. Common apps work. install updates from from update_testing: clear uname -a urpmi --auto kernel-desktop-latest urpmi --auto kernel-userspace-headers urpmi --auto cpupower urpmi --auto virtualbox-guest-additions Reboot system. Linux localhost 5.15.43-desktop-1.mga8 #1 SMP Wed May 25 20:44:45 UTC 2022 i686 i686 i386 GNU/Linux Package kernel-desktop-latest-5.15.43-1.mga8.i586 is already installed Package kernel-userspace-headers-5.15.43-1.mga8.i586 is already installed Package cpupower-5.15.43-1.mga8.i586 is already installed Package virtualbox-guest-additions-6.1.34-1.2.mga8.i586 is already installed Boots to a working desktop. Screen resolution is correct. Common apps work. CC:
(none) =>
wilcal.int On M8 hardware in a Vbox client, M8, Plasma, 64-bit clear uname -a urpmi kernel-desktop-latest urpmi kernel-userspace-headers urpmi cpupower urpmi virtualbox-guest-additions Linux localhost 5.15.41-desktop-1.mga8 #1 SMP Wed May 18 18:38:51 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux Package kernel-desktop-latest-5.15.41-1.mga8.x86_64 is already installed Package kernel-userspace-headers-5.15.41-1.mga8.x86_64 is already installed Package cpupower-5.15.41-1.mga8.x86_64 is already installed Package virtualbox-guest-additions-6.1.34-1.2.mga8.x86_64 is already installed Boots to a working desktop. Screen resolution is correct. Common apps work. install updates from from update_testing: clear uname -a urpmi --auto kernel-desktop-latest urpmi --auto kernel-userspace-headers urpmi --auto cpupower urpmi --auto virtualbox-guest-additions Reboot system. Linux localhost 5.15.43-desktop-1.mga8 #1 SMP Wed May 25 20:17:13 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux Package kernel-desktop-latest-5.15.43-1.mga8.x86_64 is already installed Package kernel-userspace-headers-5.15.43-1.mga8.x86_64 is already installed Package cpupower-5.15.43-1.mga8.x86_64 is already installed Package virtualbox-guest-additions-6.1.34-1.2.mga8.x86_64 is already installed Boots to a working desktop. Screen resolution is correct. Common apps work. On real hardware, M8, Plasma, 64-bit
Packages checked:
clear
uname -a
urpmi kernel-desktop-latest
urpmi virtualbox
urpmi x11-driver-video-vboxvideo
urpmi kernel-desktop-devel-latest
urpmi kernel-userspace-headers
urpmi cpupower
urpmi virtualbox-kernel-desktop-latest
urpmi dkms-virtualbox
Linux localhost 5.15.41-desktop-1.mga8 #1 SMP Wed May 18 18:38:51 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Package kernel-desktop-latest-5.15.41-1.mga8.x86_64 is already installed
Package virtualbox-6.1.34-1.2.mga8.x86_64 is already installed
Package x11-driver-video-vboxvideo-1.0.0-6.mga8.x86_64 is already installed
Package kernel-desktop-devel-latest-5.15.41-1.mga8.x86_64 is already installed
Package kernel-userspace-headers-5.15.41-1.mga8.x86_64 is already installed
Package cpupower-5.15.41-1.mga8.x86_64 is already installed
Package virtualbox-kernel-desktop-latest-6.1.34-1.7.mga8.x86_64 is already installed
Package dkms-virtualbox-6.1.34-1.2.mga8.x86_64 is already installed
[root@localhost wilcal]# lspci -k
00:02.0 VGA compatible controller: Intel Corporation Iris Plus Graphics G1 (Ice Lake) (rev 07)
DeviceName: To Be Filled by O.E.M.
Subsystem: Dell Device 097c
Kernel driver in use: i915
Kernel modules: i915
Boots to working desktop
M8 i586 Vbox Xfce Client, boots to a working desktop - Screen size correct
M8 x86_64 Vbox Plasma Client, boots to a working desktop - Screen size correct
install updates from from update_testing:
clear
uname -a
urpmi --auto kernel-desktop-latest
urpmi --auto virtualbox
urpmi --auto x11-driver-video-vboxvideo
urpmi --auto kernel-desktop-devel-latest
urpmi --auto kernel-userspace-headers
urpmi --auto cpupower
urpmi --auto virtualbox-kernel-desktop-latest
urpmi --auto dkms-virtualbox
reboot system
Linux localhost 5.15.43-desktop-1.mga8 #1 SMP Wed May 25 20:17:13 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Package kernel-desktop-latest-5.15.43-1.mga8.x86_64 is already installed
Package virtualbox-6.1.34-1.2.mga8.x86_64 is already installed
Package x11-driver-video-vboxvideo-1.0.0-6.mga8.x86_64 is already installed
Package kernel-desktop-devel-latest-5.15.43-1.mga8.x86_64 is already installed
Package kernel-userspace-headers-5.15.43-1.mga8.x86_64 is already installed
Package cpupower-5.15.43-1.mga8.x86_64 is already installed
Package virtualbox-kernel-desktop-latest-6.1.34-1.8.mga8.x86_64 is already installed
Package dkms-virtualbox-6.1.34-1.2.mga8.x86_64 is already installed
[root@localhost wilcal]# lspci -k
00:02.0 VGA compatible controller: Intel Corporation Iris Plus Graphics G1 (Ice Lake) (rev 07)
DeviceName: To Be Filled by O.E.M.
Subsystem: Dell Device 097c
Kernel driver in use: i915
Kernel modules: i915
M8 i586 Vbox Xfce Client, boots to a working desktop - Screen size correct
M8 x86_64 Vbox Plasma Client, boots to a working desktop - Screen size correct
Thomas Backlund
2022-05-28 09:57:15 CEST
CC:
(none) =>
sysadmin-bugs An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0212.html Resolution:
(none) =>
FIXED |