MGASA-2017-0278

    Dashboard / Vulnerabilities / MGASA-2017-0278

    MGASA-2017-0278

    Published: 18 Aug 2017Last Modified: 16 Apr 2026

    Summary: Updated kernel packages fixes security and other bugs

    Details: This kernel update is based on upstream 4.9.43 and fixes at least the following security issues: The curseg->segno call in f2fs driver can be malformed so that it will have a value that triggers an out of boundary write that could cause memory corruption on the affected devices, leading to code execution in the kernel context. This would allow for more data to be accessed and controlled by the malware (CVE-2017-10663). The UDP Fragmentation Offload (UFO) feature is vulnerable to out-of-bounds writes causing exploitable memory corruption. If unprivileged user namespaces are available, this bug can be exploited to gain root privileges (CVE-2017-1000112). For other upstream fixes in this update, read the referenced changelogs.

    References: https://advisories.mageia.org/MGASA-2017-0278.html, https://bugs.mageia.org/show_bug.cgi?id=21518, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.41, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.42, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.43

    Affected packages

    Package

    Name: kernel

    Purl: pkg:rpm/mageia/kernel?arch=source&distro=mageia-6

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.9.43-1.mga6

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High