ALT-PU-2022-3411

Высокий

ALT-PU-2022-3411: package kernel-image-centos update to version 5.14.0.226-alt1.el9

Источник

errata.altlinux.org

Дата публикации

23.12.2022

Дата обновления

23.12.2022

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades kernel-image-centos to version 5.14.0.226-alt1.el9.

Устраненные уязвимости5

BDU:2022-07074

Высокий 8.8

Дата публикации: 02.12.2022

Уязвимость функций l2cap_connect и l2cap_le_connect_req (net/bluetooth/l2cap_core.c) ядра операционных систем Linux, позволяющая нарушителю выполнить произвольный код

CVSS 3.1

Высокий 8.8

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Adjacent_network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Высокий 8.3

AV:A/AC:L/Au:N/C:C/I:C/A:C

Access vector: Adjacent_network
Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Ссылки

BDU:2022-07074 https://bdu.fstec.ru/vul/2022-07074

Ссылки1

ALT-PU-2022-3411 https://errata.altlinux.org/ALT-PU-2022-3411

Связанные уязвимости

CVE-2022-21505

CVSS3: 6.7

ubuntu

почти 2 года назад

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).