SB2021033062 - Fedora 32 update for kernel, kernel-headers, kernel-tools
Published: March 30, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2021-29264)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the gfar_add_rx_frag() and gfar_clean_rx_ring() functions in drivers/net/ethernet/freescale/gianfar.c. A local user can perform a denial of service (DoS) attack.
2) Input validation error (CVE-ID: CVE-2021-29646)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the tipc_nl_node_dump_monitor_peer() function in net/tipc/node.c. A local user can perform a denial of service (DoS) attack.
3) Information disclosure (CVE-ID: CVE-2021-29647)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to an error in qrtr_recvmsg(0 function in net/qrtr/qrtr.c caused by a partially uninitialized data structure. A local user can read sensitive information from kernel memory.
4) Improper Initialization (CVE-ID: CVE-2021-29648)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper initialization within the check_btf_info() function in kernel/bpf/verifier.c, within the map_create() function in kernel/bpf/syscall.c. A local user can perform a denial of service (DoS) attack.
5) Memory leak (CVE-ID: CVE-2021-29649)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the umd_cleanup() function in kernel/usermode_driver.c, within the finish() and load_umd() functions in kernel/bpf/preload/bpf_preload_kern.c. A local user can perform a denial of service (DoS) attack.
6) Buffer overflow (CVE-ID: CVE-2021-29650)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the netfilter subsystem in net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h. A local user can trigger memory corruption upon the assignment of a new table value and cause denial of service.
Remediation
Install update from vendor's website.