{"id":"MGASA-2021-0152","summary":"Updated kernel-linus packages fix security issues","details":"This kernel-linus update is based on upstream 5.10.25 and fixes at least the\nfollowing security issues:\n\nA NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau\ndriver functionality in versions prior to 5.12-rc1 in the way the user calls\nioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to\ncrash the system. (CVE-2020-25639).\n\nUnprivileged BPF programs running on affected systems can bypass the\nprotection and execute speculatively out-of-bounds loads from any location\nwithin the kernel memory. This can be abused to extract contents of kernel\nmemory via side-channel (CVE-2020-27170).\n\nUnprivileged BPF programs running on affected 64-bit systems can exploit\nthis to execute speculatively out-of-bounds loads from 4GB window within\nthe kernel memory. This can be abused to extract contents of kernel memory\nvia side-channel (CVE-2020-27171).\n\nAn issue was discovered in the Linux kernel through 5.11.3. A kernel pointer\nleak can be used to determine the address of the iscsi_transport structure.\nWhen an iSCSI transport is registered with the iSCSI subsystem, the\ntransport's handle is available to unprivileged users via the sysfs file\nsystem, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the\nshow_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is\ncalled, which leaks the handle. This handle is actually the pointer to an\niscsi_transport struct in the kernel module's global variables\n(CVE-2021-27363).\n\nAn issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/\nscsi_transport_iscsi.c is adversely affected by the ability of an\nunprivileged user to craft Netlink messages (CVE-2021-27364).\n\nAn issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI\ndata structures do not have appropriate length constraints or checks, and\ncan exceed the PAGE_SIZE value. An unprivileged user can send a Netlink\nmessage that is associated with iSCSI, and has a length up to the maximum\nlength of a Netlink message (CVE-2021-27365).\n\nAn issue was discovered in the Linux kernel through 5.11.3, as used with\nXen PV. A certain part of the netback driver lacks necessary treatment of\nerrors such as failed memory allocations (as a result of changes to the\nhandling of grant mapping errors). A host OS denial of service may occur\nduring misbehavior of a networking frontend driver. NOTE: this issue\nexists because of an incomplete fix for CVE-2021-26931.\n(CVE-2021-28038 / XSA-367)\n\nAn issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used\nwith Xen. In some less-common configurations, an x86 PV guest OS user can\ncrash a Dom0 or driver domain via a large amount of I/O activity. The\nissue relates to misuse of guest physical addresses when a configuration\nhas CONFIG_XEN_UNPOPULATED_ALLOC but not CONFIG_XEN_BALLOON_MEMORY_HOTPLUG.\n(CVE-2021-28039 / XSA-369)\n\nAn issue was discovered in the Linux kernel through 5.11.6.\nfastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user\napplications from sending kernel RPC messages (CVE-2021-28375).\n\nIt also adds a critical fix for filesystem level corruption:\n- on setups with swapfiles on filesystems sitting on top of brd, zram,\n  btt or pmem, then when the system starts to swap out pages, at which\n  point it corrupts filesystem blocks that don't belong to the swapfile.\n\nIt also adds the following fixes:\n- arm(64): enable W1_MASTER_GPIO (mga#28596)\n\nFor other upstream fixes, see the referenced changelogs.\n","modified":"2026-02-04T02:39:49.546559Z","published":"2021-03-22T17:17:19Z","related":["CVE-2020-25639","CVE-2020-27170","CVE-2020-27171","CVE-2021-27363","CVE-2021-27364","CVE-2021-27365","CVE-2021-28038","CVE-2021-28039","CVE-2021-28375"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2021-0152.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=28611"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=28596"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.20"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.21"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.22"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.23"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.24"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.25"}],"affected":[{"package":{"name":"kernel-linus","ecosystem":"Mageia:7","purl":"pkg:rpm/mageia/kernel-linus?arch=source&distro=mageia-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.25-1.mga7"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2021-0152.json"}},{"package":{"name":"kernel-linus","ecosystem":"Mageia:8","purl":"pkg:rpm/mageia/kernel-linus?arch=source&distro=mageia-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.25-1.mga8"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2021-0152.json"}}],"schema_version":"1.7.3","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}