MGASA-2018-0337

Dashboard / Vulnerabilities / MGASA-2018-0337

MGASA-2018-0337

Summary: Updated kernel packages fix security vulnerabilities

Details: This kernel update is based on the upstream 4.14.62 and fixes at least the following security issues: Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A remote attacker could consume a lot of CPU resources in the kernel networking stack with just a low bandwidth or single host attack by using lots of small TCP segments packets. Usually large botnets are needed for similar effect. The rate needed for this denial of service attack to be effective is several magnitudes lower than the usual packet processing capability of the machine, as the attack exploits worst case behaviour of existing algorithms (CVE-2018-5390). An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges (CVE-2018-14678). Other changes in this update: * WireGuard has been updated to 0.0.20180802. For other upstream fixes in this update, see the referenced changelogs.

References: https://advisories.mageia.org/MGASA-2018-0337.html, https://bugs.mageia.org/show_bug.cgi?id=23417, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.57, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.58, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.59, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.60, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.61, https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.62