SUSE-IU-2021:606-1: Security update of sles-15-sp3-chost-byos-v20210729
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Mon Aug 2 06:11:26 UTC 2021
SUSE Image Update Advisory: sles-15-sp3-chost-byos-v20210729
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2021:606-1
Image Tags : sles-15-sp3-chost-byos-v20210729:20210729
Image Release :
Severity : important
Type : security
References : 1047218 1099521 1152489 1153274 1154353 1155518 1157818 1158812
1158958 1158959 1158960 1159491 1159715 1159847 1159850 1160309
1160438 1160439 1164648 1164719 1165198 1172091 1172115 1172234
1172236 1172240 1172863 1173641 1173760 1176447 1176774 1176919
1177028 1177695 1178134 1182470 1184124 1184124 1184212 1184685
1185232 1185261 1185441 1185464 1185486 1185675 1185677 1185807
1185828 1185958 1185961 1186206 1186411 1186447 1186503 1186579
1186666 1186949 1187071 1187091 1187093 1187105 1187154 1187171
1187210 1187260 1187263 1187292 1187356 1187386 1187402 1187403
1187404 1187407 1187408 1187409 1187410 1187411 1187412 1187413
1187452 1187554 1187595 1187601 1187696 1187795 1187867 1187883
1187886 1187927 1187972 1187980 1188062 1188063 1188116 1188127
1188179 1188217 1188218 1188219 1188220 1188282 928700 928701
CVE-2015-3414 CVE-2015-3415 CVE-2019-19244 CVE-2019-19317 CVE-2019-19603
CVE-2019-19645 CVE-2019-19646 CVE-2019-19880 CVE-2019-19923 CVE-2019-19924
CVE-2019-19925 CVE-2019-19926 CVE-2019-19959 CVE-2019-20218 CVE-2020-13434
CVE-2020-13435 CVE-2020-13630 CVE-2020-13631 CVE-2020-13632 CVE-2020-15358
CVE-2020-35512 CVE-2020-9327 CVE-2021-0512 CVE-2021-0605 CVE-2021-22555
CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 CVE-2021-32760
CVE-2021-33624 CVE-2021-33909 CVE-2021-33910 CVE-2021-34693 CVE-2021-3573
-----------------------------------------------------------------
The container sles-15-sp3-chost-byos-v20210729 was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2205-1
Released: Wed Jun 30 09:17:41 2021
Summary: Recommended update for openldap2
Type: recommended
Severity: important
References: 1187210
This update for openldap2 fixes the following issues:
- Resolve issues in the idle / connection 'TTL' timeout implementation in OpenLDAP. (bsc#1187210)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2210-1
Released: Wed Jun 30 13:00:09 2021
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1184124
This update for lvm2 fixes the following issues:
- Link test as position independent executable and update packages with non-PIE binaries. (bsc#1184124)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2223-1
Released: Thu Jul 1 12:15:26 2021
Summary: Recommended update for chrony
Type: recommended
Severity: moderate
References: 1173760
This update for chrony fixes the following issues:
- Fixed an issue when chrony aborts in FIPS mode due to MD5. (bsc#1173760)
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2021:2249-1
Released: Mon Jul 5 15:40:46 2021
Summary: Optional update for gnutls
Type: optional
Severity: low
References: 1047218,1186579
This update for gnutls does not fix any user visible issues. It is therefore optional to install.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2273-1
Released: Thu Jul 8 09:48:48 2021
Summary: Recommended update for libzypp, zypper
Type: recommended
Severity: moderate
References: 1186447,1186503
This update for libzypp, zypper fixes the following issues:
- Enhance XML output of repo GPG options
- Add optional attributes showing the raw values actually present in the '.repo' file.
- Link all executables with -PIE (bsc#1186447)
- Ship an empty '/etc/zypp/needreboot' per default (jsc#PM-2645)
- Add 'Solvable::isBlacklisted' as superset of retracted and ptf packages (bsc#1186503)
- Fix segv if 'ZYPP_FULLOG' is set.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2286-1
Released: Fri Jul 9 17:38:53 2021
Summary: Recommended update for dosfstools
Type: recommended
Severity: moderate
References: 1172863
This update for dosfstools fixes the following issue:
- Fixed a bug that was causing an installation issue when trying to create
an EFI partition on an NVMe-over-Fabrics device (bsc#1172863)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2292-1
Released: Mon Jul 12 08:25:20 2021
Summary: Security update for dbus-1
Type: security
Severity: important
References: 1187105,CVE-2020-35512
This update for dbus-1 fixes the following issues:
- CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2308-1
Released: Tue Jul 13 13:36:03 2021
Summary: Recommended update for cpupower
Type: recommended
Severity: moderate
References:
This update for cpupower provides the following fix:
- cpupower updates for Milan. (jsc#SLE-17797)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2316-1
Released: Wed Jul 14 13:49:55 2021
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1185807,1185828,1185958,1186411,1187154,1187292
This update for systemd fixes the following issues:
- Restore framebuffer devices as possible master of seat. Until simpledrm driver is released, this change is prematured as some graphical chips don't have DRM driver and fallback to framebuffer. (bsc#1187154)
- Fixed an issue when '/var/lock/subsys' dropped when the creation of 'filesystem' package took the initialization of the generic paths over. (bsc#1187292)
- 'udev' requires systemd in its %post (bsc#1185958)
nspawn: turn on higher optimization level in seccomp
nspawn: return ENOSYS by default, EPERM for 'known' calls (bsc#1186411)
shared/seccomp-util: added functionality to make list of filtred syscalls
hared/syscall-list: filter out some obviously platform-specific syscalls
shared/seccomp: reduce scope of indexing variables
generate-syscall-list: require python3
shared: add @known syscall list
meson: add syscall-names-update target
shared/seccomp: use _cleanup_ in one more place
home: fix homed.conf install location
- We need to make sure that the creation of the symlinks is done after updating udev DB so if worker A is preempted by worker B before A updates the DB but after it creates the symlinks, worker B won't
manage to overwrite the freshly created symlinks (by A) because A
has still yet not registered the symlinks in the DB. (bsc#1185828)
- Expect 644 permissions for /usr/lib/udev/compat-symlink-generation (bsc#1185807)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2320-1
Released: Wed Jul 14 17:01:06 2021
Summary: Security update for sqlite3
Type: security
Severity: important
References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701,CVE-2015-3414,CVE-2015-3415,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
This update for sqlite3 fixes the following issues:
- Update to version 3.36.0
- CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener
optimization (bsc#1173641)
- CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in
isAuxiliaryVtabOperator (bsc#1164719)
- CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error (bsc#1160439)
- CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input (bsc#1160438)
- CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer
dereference (bsc#1160309)
- CVE-2019-19924: improper error handling in sqlite3WindowRewrite() (bsc#1159850)
- CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive (bsc#1159847)
- CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c (bsc#1159715)
- CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference
(bsc#1159491)
- CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with
a shadow table name (bsc#1158960)
- CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated
columns (bsc#1158959)
- CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views
in conjunction with ALTER TABLE statements (bsc#1158958)
- CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column,
which allows attackers to cause a denial of service (bsc#1158812)
- CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a
sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage (bsc#1157818)
- CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability (bsc#928701)
- CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names (bsc#928700)
- CVE-2020-13434: integer overflow in sqlite3_str_vappendf (bsc#1172115)
- CVE-2020-13630: (bsc#1172234: use-after-free in fts3EvalNextRow
- CVE-2020-13631: virtual table allowed to be renamed to one of its shadow tables (bsc#1172236)
- CVE-2020-13632: NULL pointer dereference via crafted matchinfo() query (bsc#1172240)
- CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (bsc#1172091)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2352-1
Released: Thu Jul 15 15:16:01 2021
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1152489,1153274,1154353,1155518,1164648,1176447,1176774,1176919,1177028,1178134,1182470,1184212,1184685,1185486,1185675,1185677,1186206,1186666,1186949,1187171,1187263,1187356,1187402,1187403,1187404,1187407,1187408,1187409,1187410,1187411,1187412,1187413,1187452,1187554,1187595,1187601,1187795,1187867,1187883,1187886,1187927,1187972,1187980,CVE-2021-0512,CVE-2021-0605,CVE-2021-33624,CVE-2021-34693,CVE-2021-3573
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
- CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
- CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
- CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
- CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
The following non-security bugs were fixed:
- 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
- alx: Fix an error handling path in 'alx_probe()' (git-fixes).
- ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
- ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
- ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
- ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
- ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
- ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
- batman-adv: Avoid WARN_ON timing related checks (git-fixes).
- be2net: Fix an error handling path in 'be_probe()' (git-fixes).
- block: Discard page cache of zone reset target range (bsc#1187402).
- Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
- Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
- bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
- bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- bpfilter: Specify the log level for the kmsg message (bsc#1155518).
- can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
- ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
- cfg80211: avoid double free of PMSR request (git-fixes).
- cfg80211: make certificate generation more robust (git-fixes).
- cgroup1: do not allow '\n' in renaming (bsc#1187972).
- cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
- cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
- cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
- cxgb4: fix wrong shift (git-fixes).
- cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
- dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
- dax: Add an enum for specifying dax wakup mode (bsc#1187411).
- dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
- dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
- dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
- dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions (git-fixes).
- dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc (git-fixes).
- dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM (git-fixes).
- dmaengine: stedma40: add missing iounmap() on error in d40_probe() (git-fixes).
- drm: Fix use-after-free read in drm_getunique() (git-fixes).
- drm: Lock pointer access in drm_master_release() (git-fixes).
- drm/amd/amdgpu:save psp ring wptr to avoid attack (git-fixes).
- drm/amd/display: Allow bandwidth validation for 0 streams (git-fixes).
- drm/amd/display: Fix potential memory leak in DMUB hw_init (git-fixes).
- drm/amdgpu: refine amdgpu_fru_get_product_info (git-fixes).
- drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device (git-fixes).
- drm/tegra: sor: Do not leak runtime PM reference (git-fixes).
- drm/vc4: hdmi: Make sure the controller is powered in detect (git-fixes).
- drm/vc4: hdmi: Move the HSM clock enable to runtime_pm (git-fixes).
- dt-bindings: reset: meson8b: fix duplicate reset IDs (git-fixes).
- ethtool: strset: fix message length calculation (bsc#1176447).
- ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed (bsc#1187408).
- ext4: fix check to prevent false positive report of incorrect used inodes (bsc#1187404).
- ext4: fix error code in ext4_commit_super (bsc#1187407).
- ext4: fix memory leak in ext4_fill_super (bsc#1187409).
- FCOE: fcoe_wwn_from_mac kABI fix (bsc#1187886).
- fs: fix reporting supported extra file attributes for statx() (bsc#1187410).
- ftrace: Do not blindly read the ip address in ftrace_bug() (git-fixes).
- ftrace: Free the trampoline when ftrace_startup() fails (git-fixes).
- fuse: BUG_ON correction in fuse_dev_splice_write() (bsc#1187356).
- HID: Add BUS_VIRTUAL to hid_connect logging (git-fixes).
- HID: gt683r: add missing MODULE_DEVICE_TABLE (git-fixes).
- HID: hid-input: add mapping for emoji picker key (git-fixes).
- HID: hid-sensor-hub: Return error for hid_set_field() failure (git-fixes).
- HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65 (git-fixes).
- HID: usbhid: fix info leak in hid_submit_ctrl (git-fixes).
- HID: usbhid: Fix race between usbhid_close() and usbhid_stop() (git-fixes).
- hwmon: (scpi-hwmon) shows the negative temperature properly (git-fixes).
- i2c: mpc: Make use of i2c_recover_bus() (git-fixes).
- ice: add ndo_bpf callback for safe mode netdev ops (jsc#SLE-7926).
- ice: parameterize functions responsible for Tx ring management (jsc#SLE-12878).
- isdn: mISDN: netjet: Fix crash in nj_probe: (git-fixes).
- kernel-binary.spec.in: Regenerate makefile when not using mkmakefile.
- kernel: kexec_file: fix error return code of kexec_calculate_store_digests() (git-fixes).
- kthread_worker: split code for canceling the delayed work timer (bsc#1187867).
- kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() (bsc#1187867).
- kyber: fix out of bounds access when preempted (bsc#1187403).
- lib: vdso: Remove CROSS_COMPILE_COMPAT_VDSO (bsc#1164648,jsc#SLE-11493).
- media: mtk-mdp: Check return value of of_clk_get (git-fixes).
- media: mtk-mdp: Fix a refcounting bug on error in init (git-fixes).
- media: s5p-g2d: Fix a memory leak in an error handling path in 'g2d_probe()' (git-fixes).
- mlxsw: reg: Spectrum-3: Enforce lowest max-shaper burst size of 11 (bsc#1176774).
- mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk (git-fixes).
- module: limit enabling module.sig_enforce (git-fixes).
- net: mvpp2: add mvpp2_phylink_to_port() helper (bsc#1187171).
- net/mlx5: Consider RoCE cap before init RDMA resources (git-fixes).
- net/mlx5: E-Switch, Allow setting GUID for host PF vport (jsc#SLE-15172).
- net/mlx5: E-Switch, Read PF mac address (jsc#SLE-15172).
- net/mlx5: Fix PBMC register mapping (git-fixes).
- net/mlx5: Fix placement of log_max_flow_counter (git-fixes).
- net/mlx5: Fix sleep while atomic in mlx5_eswitch_get_vepa (git-fixes).
- net/mlx5: Reset mkey index on creation (jsc#SLE-15172).
- net/mlx5e: Block offload of outer header csum for UDP tunnels (git-fixes).
- net/mlx5e: Fix page reclaim for dead peer hairpin (git-fixes).
- net/mlx5e: Remove dependency in IPsec initialization flows (git-fixes).
- net/nfc/rawsock.c: fix a permission check bug (git-fixes).
- net/sched: act_ct: handle DNAT tuple collision (bsc#1154353).
- net/x25: Return the correct errno code (git-fixes).
- netxen_nic: Fix an error handling path in 'netxen_nic_probe()' (git-fixes).
- NFS: Fix a potential NULL dereference in nfs_get_client() (git-fixes).
- NFS: Fix use-after-free in nfs4_init_client() (git-fixes).
- NFS: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode() (git-fixes).
- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- ocfs2: fix data corruption by fallocate (bsc#1187412).
- PCI: aardvark: Do not rely on jiffies while holding spinlock (git-fixes).
- PCI: aardvark: Fix kernel panic during PIO transfer (git-fixes).
- PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
- PCI: Mark some NVIDIA GPUs to avoid bus reset (git-fixes).
- PCI: Mark TI C667X to avoid bus reset (git-fixes).
- PCI: Work around Huawei Intelligent NIC VF FLR erratum (git-fixes).
- perf/x86/intel/uncore: Fix a kernel WARNING triggered by maxcpus=1 (git-fixes).
- perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3 (bsc#1184685).
- powerpc/perf: Fix crash in perf_instruction_pointer() when ppmu is not set (jsc#SLE-13513 bsc#1176919 ltc#186162 git-fixes).
- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470 bsc#1185486).
- qlcnic: Fix an error handling path in 'qlcnic_probe()' (git-fixes).
- radeon: use memcpy_to/fromio for UVD fw upload (git-fixes).
- regulator: bd70528: Fix off-by-one for buck123 .n_voltages setting (git-fixes).
- Removed patch that was incorrectly added to SLE15-SP2 (bsc#1186949)
- Revert 'ecryptfs: replace BUG_ON with error handling code' (bsc#1187413).
- Revert 'ibmvnic: simplify reset_long_term_buff function' (bsc#1186206 ltc#191041).
- Revert 'PCI: PM: Do not read power state in pci_enable_device_flags()' (git-fixes).
- Revert 'video: hgafb: fix potential NULL pointer dereference' (git-fixes).
- Revert 'video: imsttfb: fix potential NULL pointer dereferences' (bsc#1152489)
- s390/dasd: add missing discipline function (git-fixes).
- s390/stack: fix possible register corruption with stack switch helper (bsc#1185677).
- sched/debug: Fix cgroup_path[] serialization (git-fixes)
- sched/fair: Keep load_avg and load_sum synced (git-fixes)
- scsi: core: Fix race between handling STS_RESOURCE and completion (bsc#1187883).
- scsi: fcoe: Fix mismatched fcoe_wwn_from_mac declaration (bsc#1187886).
- scsi: ufs: Fix imprecise load calculation in devfreq window (bsc#1187795).
- SCSI: ufs: fix ktime_t kabi change (bsc#1187795).
- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- spi: spi-nxp-fspi: move the register operation after the clock enable (git-fixes).
- spi: sprd: Add missing MODULE_DEVICE_TABLE (git-fixes).
- spi: stm32-qspi: Always wait BUSY bit to be cleared in stm32_qspi_wait_cmd() (git-fixes).
- SUNRPC: Handle major timeout in xprt_adjust_timeout() (git-fixes).
- SUNRPC: Handle major timeout in xprt_adjust_timeout() (git-fixes).
- tracing: Correct the length check which causes memory corruption (git-fixes).
- tracing: Do no increment trace_clock_global() by one (git-fixes).
- tracing: Do not stop recording cmdlines when tracing is off (git-fixes).
- tracing: Do not stop recording comms if the trace file is being read (git-fixes).
- tracing: Restructure trace_clock_global() to never block (git-fixes).
- USB: core: hub: Disable autosuspend for Cypress CY7C65632 (git-fixes).
- USB: dwc3: core: fix kernel panic when do reboot (git-fixes).
- USB: dwc3: core: fix kernel panic when do reboot (git-fixes).
- USB: dwc3: debugfs: Add and remove endpoint dirs dynamically (git-fixes).
- USB: dwc3: ep0: fix NULL pointer exception (git-fixes).
- USB: f_ncm: only first packet of aggregate needs to start timer (git-fixes).
- USB: f_ncm: only first packet of aggregate needs to start timer (git-fixes).
- USB: fix various gadget panics on 10gbps cabling (git-fixes).
- USB: fix various gadget panics on 10gbps cabling (git-fixes).
- USB: gadget: eem: fix wrong eem header operation (git-fixes).
- USB: gadget: eem: fix wrong eem header operation (git-fixes).
- USB: gadget: f_fs: Ensure io_completion_wq is idle during unbind (git-fixes).
- USB: gadget: f_fs: Ensure io_completion_wq is idle during unbind (git-fixes).
- USB: serial: ftdi_sio: add NovaTech OrionMX product ID (git-fixes).
- USB: serial: ftdi_sio: add NovaTech OrionMX product ID (git-fixes).
- USB: serial: omninet: add device id for Zyxel Omni 56K Plus (git-fixes).
- USB: serial: omninet: add device id for Zyxel Omni 56K Plus (git-fixes).
- video: hgafb: correctly handle card detect failure during probe (git-fixes).
- video: hgafb: fix potential NULL pointer dereference (git-fixes).
- vrf: fix maximum MTU (git-fixes).
- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate() (bsc#1178134).
- x86/pkru: Write hardware init value to PKRU when xstate is init (bsc#1152489).
- x86/process: Check PF_KTHREAD and not current->mm for kernel threads (bsc#1152489).
- xen-blkback: fix compatibility bug with single page rings (git-fixes).
- xen-pciback: reconfigure also from backend watch handler (git-fixes).
- xen-pciback: redo VF placement in the virtual topology (git-fixes).
- xen/evtchn: Change irq_info lock to raw_spinlock_t (git-fixes).
- xfrm: policy: Read seqcount outside of rcu-read side in xfrm_policy_lookup_bytype (bsc#1185675).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2394-1
Released: Mon Jul 19 12:06:53 2021
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: moderate
References: 1177695,1187093
This update for suse-module-tools provides the following fixes:
- Fix treatment of compressed modules. (bsc#1187093)
- modprobe.d: Remove dma=none setting for parport_pc. (bsc#1177695)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2395-1
Released: Mon Jul 19 12:08:34 2021
Summary: Recommended update for efivar
Type: recommended
Severity: moderate
References: 1187386
This update for efivar provides the following fix:
- Fix the eMMC sysfs parsing. (bsc#1187386)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2399-1
Released: Mon Jul 19 19:06:22 2021
Summary: Recommended update for release packages
Type: recommended
Severity: moderate
References: 1099521
This update for the release packages provides the following fix:
- Fix grub menu entries after migration from SLE-12*. (bsc#1099521)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2410-1
Released: Tue Jul 20 14:41:26 2021
Summary: Security update for systemd
Type: security
Severity: important
References: 1188063,CVE-2021-33910
This update for systemd fixes the following issues:
- CVE-2021-33910: Fixed a denial of service (stack exhaustion) in systemd (PID 1) (bsc#1188063)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2412-1
Released: Tue Jul 20 15:25:21 2021
Summary: Security update for containerd
Type: security
Severity: moderate
References: 1188282,CVE-2021-32760
This update for containerd fixes the following issues:
- CVE-2021-32760: Fixed a bug which allows untrusted container images to change permissions in the host's filesystem. (bsc#1188282)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2415-1
Released: Tue Jul 20 16:11:34 2021
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1188062,1188116,CVE-2021-22555,CVE-2021-33909
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.
Security issues fixed:
- CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116).
- CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062).
The following non-security bugs were fixed:
- usb: dwc3: Fix debugfs creation flow (git-fixes).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2439-1
Released: Wed Jul 21 13:46:48 2021
Summary: Security update for curl
Type: security
Severity: moderate
References: 1188217,1188218,1188219,1188220,CVE-2021-22922,CVE-2021-22923,CVE-2021-22924,CVE-2021-22925
This update for curl fixes the following issues:
- CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220)
- CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219)
- CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218)
- CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2456-1
Released: Thu Jul 22 15:28:39 2021
Summary: Recommended update for pam-config
Type: recommended
Severity: moderate
References: 1187091
This update for pam-config fixes the following issues:
- Add 'revoke' to the option list for 'pam_keyinit'.
- Fixed an issue when pam-config fails to create a new service config file. (bsc#1187091)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2464-1
Released: Fri Jul 23 14:20:23 2021
Summary: Recommended update for shim
Type: recommended
Severity: moderate
References: 1185232,1185261,1185441,1185464,1185961,1187071,1187260,1187696
This update for shim fixes the following issues:
- shim-install: Always assume 'removable' for Azure to avoid the endless reset loop (bsc#1185464)
- Avoid deleting the mirrored RT variables (bsc#1187696)
- Split the keys in vendor-dbx.bin to vendor-dbx-sles and
vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce
the size of MokListXRT (bsc#1185261)
+ Also update generate-vendor-dbx.sh in dbx-cert.tar.xz
- Handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071)
- Relax the maximum variable size check for u-boot (bsc#1185621)
- Relax the check for import_mok_state() when Secure Boot is off. (bsc#1185261)
- Ignore the odd LoadOptions length (bsc#1185232)
- shim-install: reset def_shim_efi to 'shim.efi' if the given file doesn't exist
- Fided the size of rela sections for AArch64
- Disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261)
- Avoid potential crash when calling QueryVariableInfo in EFI 1.10 machines (bsc#1187260)
- Avoid buffer overflow when copying data to the MOK config table (bsc#1185232)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2477-1
Released: Tue Jul 27 13:32:50 2021
Summary: Recommended update for growpart-rootgrow
Type: recommended
Severity: important
References: 1165198,1188179
This update for growpart-rootgrow fixes the following issues:
- Change the logic to determine the partition ID of the root filesystem
(bsc#1188179)
+ Previously the algorithm depended on the order of the output
from lsblk using an index to keep track of the known partitions.
The new implementation is order independent, it depends on the
partition ID being numerical in nature and at the end of the device
string.
- Add coverage config.
Omit version module from coverage check.
- Fix string formatting for flake8 formatting.
- Replace travis testing with GitHub actions.
Add ci testing workflow action.
- Switch implementation to use Popen for Python 3.4 compatibility (bsc#1165198)
- Bump version: 1.0.2 → 1.0.3
- Fixed unit tests and style
This clobbers several fixes into one. Sorry about it but I
started on already made changes done by other people.
This commit includes several pep8 style fixes mostly on
the indentation level. In addition it fixes the unit
tests to really cover all code and to make the exception
tests really effective.
- Switch to use Popen instead of run
The run() fuction in the subprocess module was implemented after
Python 3.4. However, we need to support Python 3.4 for SLES 12
- Bump version: 1.0.1 → 1.0.2
- Package LICENSE file
The LICENSE file is part of the source repo but was not
packaged with the rpm package
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2481-1
Released: Tue Jul 27 14:20:27 2021
Summary: Recommended update for sysconfig
Type: recommended
Severity: moderate
References: 1184124
This update for sysconfig fixes the following issues:
- Link as Position Independent Executable (bsc#1184124).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2573-1
Released: Thu Jul 29 14:21:52 2021
Summary: Recommended update for timezone
Type: recommended
Severity: moderate
References: 1188127
This update for timezone fixes the following issue:
- From systemd v249: when enumerating time zones the timedatectl tool will now consult the 'tzdata.zi' file shipped by
the IANA time zone database package, in addition to 'zone1970.tab', as before. This makes sure time zone aliases are
now correctly supported. This update adds the 'tzdata.zi' file (bsc#1188127).
More information about the sle-security-updates
mailing list