/[advisories]/28163.adv
ViewVC logotype

Contents of /28163.adv

Parent Directory Parent Directory | Revision Log Revision Log


Revision 11260 - (show annotations) (download)
Wed Jan 20 21:58:36 2021 UTC (5 weeks ago) by tmb
File size: 1546 byte(s)
MGASA-2021-0047: kernel-5.10.8-2.mga7, kmod-virtualbox-6.1.16-10.mga7, kmod-xtables-addons-3.13-6.mga7
1 type: security
2 subject: Updated kernel packages fix security vulnerability
3 CVE:
4 - CVE-2020-28374
5 src:
6 7:
7 core:
8 - kernel-5.10.8-2.mga7
9 - kmod-virtualbox-6.1.16-10.mga7
10 - kmod-xtables-addons-3.13-6.mga7
11 description: |
12 This kernel update is based on upstream 5.10.8 and fixes atleast the
13 following security issue:
14
15 SCSI “EXTENDED COPY” (XCOPY) requests sent to a Linux SCSI target (LIO)
16 allow an attacker to read or write anywhere on any LIO backstore configured
17 on the host, provided the attacker has access to one LUN and knowledge of
18 the victim backstore’s vpd_unit_serial (AKA “wwn”). This is possible
19 regardless of the transport/HBA settings for the victim backstore
20 (CVE-2020-28374).
21
22 It also adds the following fixes:
23 - fix up kernel-devel packages to not cause errors during dkms installs
24 (mga# 27080)
25 - backported crypto AES-NI XTS fixes the performance regression introduced
26 by the retpoline fixes
27 - backported support for nVidia RTX3xxx (Ampere) modesetting
28 - backported fixes for broken Intel Haswell GT1 graphics
29 - backported fixes for iwlwifi causing some systems to hang on boot
30 - backport fix so the admin can chose to disable i915 security mitigations
31 to recover from the big performance loss on older hardware caused
32 by earlier security fixes
33 references:
34 - https://bugs.mageia.org/show_bug.cgi?id=28163
35 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.7
36 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.8
37 ID: MGASA-2021-0047

  ViewVC Help
Powered by ViewVC 1.1.28