putting on hold, a new one is coming with an ext4 regression fix and a remote dos fix...

Keywords: (none) => feedback

new set:


SRPM:
kernel-linus-5.15.117-1.mga8.src.rpm



i586:
kernel-linus-5.15.117-1.mga8-1-1.mga8.i586.rpm
kernel-linus-devel-5.15.117-1.mga8-1-1.mga8.i586.rpm
kernel-linus-devel-latest-5.15.117-1.mga8.i586.rpm
kernel-linus-doc-5.15.117-1.mga8.noarch.rpm
kernel-linus-latest-5.15.117-1.mga8.i586.rpm
kernel-linus-source-5.15.117-1.mga8-1-1.mga8.noarch.rpm
kernel-linus-source-latest-5.15.117-1.mga8.noarch.rpm



x86_64:
kernel-linus-5.15.117-1.mga8-1-1.mga8.x86_64.rpm
kernel-linus-devel-5.15.117-1.mga8-1-1.mga8.x86_64.rpm
kernel-linus-devel-latest-5.15.117-1.mga8.x86_64.rpm
kernel-linus-doc-5.15.117-1.mga8.noarch.rpm
kernel-linus-latest-5.15.117-1.mga8.x86_64.rpm
kernel-linus-source-5.15.117-1.mga8-1-1.mga8.noarch.rpm
kernel-linus-source-latest-5.15.117-1.mga8.noarch.rpm

Summary: Update request: kernel-linus-5.15.116-1.mga8 => Update request: kernel-linus-5.15.117-1.mga8
Keywords: feedback => (none)

Advisory, added to svn:

type: security
subject: Updated kernel-linus packages fix security vulnerabilities
CVE:
 - CVE-2022-48425
 - CVE-2023-2156
 - CVE-2023-2269
 - CVE-2023-31084
 - CVE-2023-32233
 - CVE-2023-34256
src:
  8:
   core:
     - kernel-linus-5.15.117-1.mga8
description: |
  This kernel-linus update is based on upstream 5.15.117 and fixes atleast
  the following security issues:

  In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree
  because it does not validate MFT flags before replaying logs
  (CVE-2022-48425).

  A flaw was found in the networking subsystem of the Linux kernel within
  the handling of the RPL protocol. This issue results from the lack of
  proper handling of user-supplied data, which can lead to an assertion
  failure. This may allow an unauthenticated remote attacker to create a
  denial of service condition on the system (CVE-2023-2156).

  A denial of service problem was found, due to a possible recursive locking
  scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c
  in the Linux Kernel Device Mapper-Multipathing sub-component
  (CVE-2023-2269).

  An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the
  Linux kernel 6.2. There is a blocking operation when a task is in
  !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is
  called; the condition is dvb_frontend_test_event(fepriv,events).
  In dvb_frontend_test_event, down(&fepriv->sem) is called. However,
  wait_event_interruptible would put the process to sleep, and
  down(&fepriv->sem) may block the process (CVE-2023-31084).

  In the Linux kernel through 6.3.1, a use-after-free in Netfilter
  nf_tables when processing batch requests can be abused to perform arbitrary
  read and write operations on kernel memory. Unprivileged local users can
  obtain root privileges. This occurs because anonymous sets are mishandled
  (CVE-2023-32233).

  An issue was discovered in the Linux kernel before 6.3.3. There is an
  out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c
  because ext4_group_desc_csum does not properly check an offset 
  (CVE-2023-34256).

  For other upstream fixes in this update, see the referenced changelogs.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=32002
 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.111
 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.112
 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.113
 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.114
 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.115
 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.116
 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.117

Keywords: (none) => advisory
Priority: Normal => High
Severity: normal => major

Mageia 8, x64 UEFI
Intel Core i9, nvidia GTX1080 (470.161)

Installed all the packages.  Smooth reboot with nvidia and virtualbox drivers being built on the fly.

glmark2 runs.  virtualbox launches clients which work fine.  bluetooth audio worked transparently.   Desktop working as expected.

CC: (none) => tarazed25

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0202.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED