kernel-4.18.0-240.22.1.el8_3
エラータID: AXSA:2021-1696:08
リリース日:
2021/04/21 Wednesday - 04:49
題名:
kernel-4.18.0-240.22.1.el8_3
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- linux/fs/eventpoll.c の do_epoll_ctl() および ep_loop_check_proc()
には、論理エラーのために解放後利用される可能性があるため、ローカルのユー
ザーにより、追加の実行特権を必要とせずに特権昇格を可能とする脆弱性が存
在します (CVE-2020-0466)
- arch/x86/kvm/ioapic.c の ioapic_lazy_update_eoi() には、割り込み処理
中に無限ループに陥りスタックがオーバーフローする問題があるため、ゲスト
OS のユーザーにより、ホスト OS のカーネルをクラッシュさせることを可能
とする脆弱性が存在します。(CVE-2020-27152)
- drivers/target/target_core_xcopy.c には、LIO SCSI ターゲットコードの
識別子チェックが不十分であるため、リモートの攻撃者により、XCOPY 要求の
ディレクトリトラバーサルを介して、ファイルを読み書きすることが可能とな
る脆弱性が存在します。(CVE-2020-28374)
- net/vmw_vsock/af_vsock.c には、誤ったロックが原因で AF_VSOCK の実装
内で複数の競合状態が発生する問題があるため、ローカルのユーザーにより、
特権昇格が可能となる脆弱性が存在します。 (CVE-2021-26708)
- iSCSI サブシステムには、カーネルポインタのリークを利用して
iscsi_transport 構造体のアドレスを判別できる問題があるため、iSCSI トラ
ンスポートが iSCSI サブシステムに登録されている場合、非特権ユーザーに
より、sysfs ファイルシステムの
/sys/class/iscsi_transport/TRANSPORT_NAME/handle を介して、トランスポー
トのハンドリングが可能となる脆弱性が存在します。 (CVE-2021-27363)
- drivers/scsi/scsi_transport_iscsi.c には、範囲外のメモリアクセスの問
題があるため、非特権ユーザーにより、 巧妙に細工された Netlink メッセー
ジを介して、機密情報の読み取りやサービス拒否状態にされる脆弱性が存在し
ます。 (CVE-2021-27364)
- iSCSI サブシステムには、特定の iSCSI データ構造において適切な長さの
制約やチェックがなく、PAGE_SIZE 値を超えてしまう問題があるため、非特権
ユーザーが最大のデータ長を持つ iSCSI と関連する Netlink メッセージを送
ることによりヒープバッファオーバーフローが発生し、サービス拒否状態にさ
れる脆弱性が存在します。 (CVE-2021-27365)
- PI futexes には、失敗処理中にカーネルスタックの解放後利用の問題があ
るため、ローカルユーザーにより、カーネル内で任意のコード実行が可能とな
る脆弱性が存在します。 (CVE-2021-3347)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2020-0466
In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel
In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel
CVE-2020-27152
An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.
An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.
CVE-2020-28374
In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.
In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.
CVE-2021-26708
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
CVE-2021-27363
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.
CVE-2021-27364
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.
CVE-2021-3347
An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
追加情報:
N/A
ダウンロード:
SRPMS
- kernel-4.18.0-240.22.1.el8_3.src.rpm
MD5: 39e7df57054700a011b7f6fa49e4968a
SHA-256: 7dc656688eee546552a6530c519d18f1f281bc22b593c77a451362918c172fd5
Size: 113.05 MB
Asianux Server 8 for x86_64
- bpftool-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: df4f8bc4e672da73dc5b3f6244f0e4f1
SHA-256: 409f4fefe8139f250dbbc5744f7b0a05ced7dca20502aa3b6622e4b6f8c80d1e
Size: 5.00 MB - kernel-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 64708449179ce9816797fb1c2ab54fcd
SHA-256: b52deaeb7cf27ace76d0f1c0818a34d92cf4bb4a18ff56489146f869c028983c
Size: 4.35 MB - kernel-abi-whitelists-4.18.0-240.22.1.el8_3.noarch.rpm
MD5: ce534506f3d93037ca05a9c2076c2d4e
SHA-256: bbd61bf75fdf0e2745faf62231e75858f5832b5fd4e0651112954e45d9d3a5a3
Size: 4.36 MB - kernel-core-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: a1e088eabd6549303be81d0b36a44692
SHA-256: f0023a8c68bf4ce3dab3cdc93f6c3f33c586b78cf9f881cf5b2204f3e7e7e9f8
Size: 30.07 MB - kernel-cross-headers-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 09ac11c289f763eb31ce1eefd56eca90
SHA-256: 38b31ca6bb32a6b3ed8c9b856bf4900728ad42e63acbaaf4c99881275e170a5e
Size: 9.17 MB - kernel-debug-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 115c2d210fe34ad42e0b7b62aa46f8a5
SHA-256: 043b4c07d1bac2771c21b721848b09ea71fc5bf3b3f8546f833345ba891e9137
Size: 4.35 MB - kernel-debug-core-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 9b7dad51b84fb86ba1ca160b7c323f4a
SHA-256: 2c58bf6ad1d04cc16f117af45017b9aa8f88c0976b49d3da23199930bfb8a696
Size: 56.70 MB - kernel-debug-devel-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: d990fb2a5883d4b52fc33423add76632
SHA-256: 1b75081149940bbf48939c312541aa0838138f7dfb81318446a0839d2fe57e8f
Size: 16.82 MB - kernel-debug-modules-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: b607503438b8d0a0177b3103f897e355
SHA-256: fd481354fea7540515ac897ea62c8614a878c3f6a5d968b1f4db6253e6932e24
Size: 49.84 MB - kernel-debug-modules-extra-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 735c7ffd4a5792318393624d45d8a212
SHA-256: a5a1f591a072444c72911b5bbe982df6397ecea022629646de3dccee7d59354a
Size: 5.66 MB - kernel-devel-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: f407a64bc99d515512e308fe1bacd20a
SHA-256: e6d9688f19bd83b40c27a595ff7f19e4fef2c41b042f04f52ca5df9ea82bfa37
Size: 16.65 MB - kernel-doc-4.18.0-240.22.1.el8_3.noarch.rpm
MD5: 38ee67f044bcb33635fdeef834024d57
SHA-256: 51d1de5f3f9e8deab0db81d54420a19ed8c5b84c1fbbbf2b2849d0d2174e9ead
Size: 20.52 MB - kernel-headers-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 591dc416aa0f7f109c76cdf45517b566
SHA-256: aeabfc1a0a7e6adf082808240bc0bdfbc9f271281853d6ca27c1d9fd1d5265fa
Size: 5.57 MB - kernel-modules-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 4b926dedce13313295eeaa6e7ce32110
SHA-256: dba7b5120190801b17ccedd66d6abf6215ce98106e1ae56cae04e3510913ec1c
Size: 25.56 MB - kernel-modules-extra-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 2b32d6c0201d88f2b49f0cb6aeb3d5d9
SHA-256: f9bd1ee6b9f98617b121ce8314a0240c4f7d4f9f4d699510476cc9e34125f5dd
Size: 5.00 MB - kernel-tools-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 7029d205fe7cfecc03a4c41216909b8e
SHA-256: 719a96f3c8f0957ee936a0c872080b79fec963704acfff89c70e537bfc4535b6
Size: 4.55 MB - kernel-tools-libs-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 9785f9e6178e85e69dd7540309dcc982
SHA-256: 79c195ec1149f6d5c218a89f991fea8568d680fa17cba11329a020b4dc1d56be
Size: 4.36 MB - perf-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: 64e0e510f991e24905b9dc0bfa3c3ff8
SHA-256: a8df3e7f00b698499151b92f592134141a3c9ef1081ba3a72c7c0545b00108cc
Size: 6.42 MB - python3-perf-4.18.0-240.22.1.el8_3.x86_64.rpm
MD5: fcf56047360dfb3380f69c4386689378
SHA-256: 3cf2c05b55e12b0383fec8eaea749a59941915d287c9ef6e00ec801dadc06d5d
Size: 4.46 MB
English