SB2021122254 - Fedora 34 update for kernel
Published: December 22, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Improper Resource Shutdown or Release (CVE-ID: CVE-2021-28714)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. A remote user can use a UDP connection on a fast interface to trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Improper Resource Shutdown or Release (CVE-ID: CVE-2021-28715)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. A remote user can use a UDP connection on a fast interface to trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Resource exhaustion (CVE-ID: CVE-2021-28711)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
4) Resource exhaustion (CVE-ID: CVE-2021-28712)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Resource exhaustion (CVE-ID: CVE-2021-28713)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper limits for number of events driver domains could send to other guest VMs. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.