SUSE-SU-2021:3848-1: important: Security update for the Linux Kernel

sle-security-updates at sle-security-updates at
Wed Dec 1 20:44:16 UTC 2021

   SUSE Security Update: Security update for the Linux Kernel

Announcement ID:    SUSE-SU-2021:3848-1
Rating:             important
References:         #1094840 #1114648 #1141655 #1188601 #1190351 
                    #1190397 #1190523 #1190795 #1191713 #1191790 
                    #1191888 #1191961 #1192045 #1192267 #1192273 
                    #1192379 #1192718 #1192750 #1192753 #1192781 
                    #1192802 #1192906 SLE-22573 
Cross-References:   CVE-2021-0941 CVE-2021-20322 CVE-2021-31916
                    CVE-2021-34981 CVE-2021-37159 CVE-2021-3772
CVSS scores:
                    CVE-2021-0941 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-20322 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
                    CVE-2021-31916 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-31916 (SUSE): 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-34981 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
                    CVE-2021-37159 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-37159 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-3772 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:
                    SUSE Linux Enterprise Server 12-SP5

   An update that solves 6 vulnerabilities, contains one
   feature and has 16 fixes is now available.


   The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive
   various security and bugfixes.

   The following security bugs were fixed:

   - Unprivileged BPF has been disabled by default to reduce attack surface
     as too many security issues have happened in the past (jsc#SLE-22573)

     You can reenable via systemctl setting
   /proc/sys/kernel/unprivileged_bpf_disabled to 0.
   (kernel.unprivileged_bpf_disabled = 0)

   - CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible
     out of bounds read due to a use after free. This could lead to local
     escalation of privilege with System execution privileges needed. User
     interaction is not needed for exploitation (bnc#1192045).
   - CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in
     list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module
     in the Linux kernel A bound check failure allowed an attacker with
     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds
     memory leading to a system crash or a leak of internal kernel
     information. The highest threat from this vulnerability is to system
     availability (bnc#1192781).
   - CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less
     predictive to avoid information leaks about UDP ports in use.
   - CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device
     fails  (bsc#1191961).
   - CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the
     Linux kernel calls unregister_netdev without checking for the
     NETREG_REGISTERED state, leading to a use-after-free and a double free
   - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).

   The following non-security bugs were fixed:

   - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
   - Revert "ibmvnic: check failover_pending in login response" (bsc#1190523
   - Revert "x86/kvm: fix vcpu-id indexed array sizes" (git-fixes).
   - USB: iowarrior: fix control-message timeouts (git-fixes).
   - USB: serial: keyspan: fix memleak on probe errors (git-fixes).
   - arm64/sve: Use correct size when reinitialising SVE state (git-fixes).
   - arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
   - bpf: Fix potential race in tail call compatibility check (git-fixes).
   - bpf: Move owner type, jited info into array auxiliary data (bsc#1141655).
   - bpf: Use kvmalloc for map values in syscall (stable-5.14.16).
   - btrfs: fix memory ordering between normal and ordered work functions
   - ceph: take snap_empty_lock atomically with snaprealm refcount change
   - Build cve/linux-4.12 against SLE15-SP1. SLE15 is no longer
     updated and we will need recent update to suse-module-tools to continue
     building the kernel.
   - crypto: qat - detect PFVF collision after ACK (git-fixes).
   - crypto: qat - disregard spurious PFVF interrupts (git-fixes).
   - crypto: s5p-sss - Add error handling in s5p_aes_probe() (git-fixes).
   - drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()
   - drm: fix spectre issue in vmw_execbuf_ioctl (bsc#1192802).
   - ethernet: dwmac-stm32: Fix copyright (git-fixes).
   - ftrace: Fix scripts/ due to new binutils (bsc#1192267).
   - fuse: fix page stealing (bsc#1192718).
   - gigaset: fix spectre issue in do_data_b3_req (bsc#1192802).
   - hisax: fix spectre issues (bsc#1192802).
   - hrtimer: Move copyout of remaining time to do_nanosleep() (bsc#1191713).
   - hrtimer_nanosleep(): Pass rmtp in restart_block (bsc#1191713).
   - hysdn: fix spectre issue in hycapi_send_message (bsc#1192802).
   - i2c: synquacer: fix deferred probing (git-fixes).
   - ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
   - ibmvnic: check failover_pending in login response (bsc#1190523
   - ibmvnic: delay complete() (bsc#1094840 ltc#167098 git-fixes).
   - ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
   - infiniband: fix spectre issue in ib_uverbs_write (bsc#1192802).
   - ipv4: fix race condition between route lookup and invalidation
   - iwlwifi: fix spectre issue in iwl_dbgfs_update_pm (bsc#1192802).
   - kernel, fs: Introduce and use set_restart_fn() and
     arch_set_restart_data() (bsc#1191713).
   - media: dvb_ca_en50221: prevent using slot_info for Spectre attacs
   - media: dvb_ca_en50221: sanity check slot number from userspace
   - media: wl128x: get rid of a potential spectre issue (bsc#1192802).
   - mm/hugetlb: initialize hugetlb_usage in mm_init (bsc#1192906).
   - mpt3sas: fix spectre issues (bsc#1192802).
   - net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() (bsc#1192802).
   - net: stmmac: Avoid VLA usage (git-fixes).
   - net: stmmac: First Queue must always be in DCB mode (git-fixes).
   - net: stmmac: Fix TX timestamp calculation (git-fixes).
   - net: stmmac: Fix bad RX timestamp extraction (git-fixes).
   - net: stmmac: Fix stmmac_get_rx_hwtstamp() (git-fixes).
   - net: stmmac: Prevent infinite loop in get_rx_timestamp_status()
   - net: stmmac: WARN if tx_skbuff entries are reused before cleared
   - net: stmmac: add error handling in stmmac_mtl_setup() (git-fixes).
   - net: stmmac: discard disabled flags in interrupt status register
   - net: stmmac: do not clear tx_skbuff entries in
     stmmac_xmit()/stmmac_tso_xmit() (git-fixes).
   - net: stmmac: dwc-qos-eth: Fix typo in DT bindings parsing (git-fixes).
   - net: stmmac: ensure that the MSS desc is the last desc to set the own
     bit (git-fixes).
   - net: stmmac: fix LPI transitioning for dwmac4 (git-fixes).
   - net: stmmac: honor error code from stmmac_dt_phy() (git-fixes).
   - net: stmmac: make dwmac4_release_tx_desc() clear all descriptor fields
   - net: stmmac: remove redundant enable of PMT irq (git-fixes).
   - net: stmmac: rename GMAC_INT_DEFAULT_MASK for dwmac4 (git-fixes).
   - net: stmmac: use correct barrier between coherent memory and MMIO
   - objtool-don-t-fail-on-missing-symbol-table.patch needed for vanilla
     flavor as well.
   - objtool: Do not fail on missing symbol table (bsc#1192379).
   - ocfs2: Fix data corruption on truncate (bsc#1190795).
   - ocfs2: do not zero pages beyond i_size (bsc#1190795).
   - osst: fix spectre issue in osst_verify_frame (bsc#1192802).
   - prctl: allow to setup brk for et_dyn executables (git-fixes).
   - printk/console: Allow to disable console output by using console="" or
     console=null (bsc#1192753).
   - printk: handle blank console arguments passed in (bsc#1192753).
   - scsi: BusLogic: Fix missing pr_cont() use (git-fixes).
   - scsi: FlashPoint: Rename si_flags field (git-fixes).
   - scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe()
   - scsi: core: Fix error handling of scsi_host_alloc() (git-fixes).
   - scsi: core: Fix spelling in a source code comment (git-fixes).
   - scsi: core: Only put parent device if host state differs from
     SHOST_CREATED (git-fixes).
   - scsi: core: Put .shost_dev in failure path if host state changes to
     RUNNING (git-fixes).
   - scsi: core: Retry I/O for Notify (Enable Spinup) Required error
   - scsi: csiostor: Add module softdep on cxgb4 (git-fixes).
   - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
   - scsi: dc395: Fix error case unwinding (git-fixes).
   - scsi: iscsi: Fix iface sysfs attr detection (git-fixes).
   - scsi: libsas: Use _safe() loop in sas_resume_port() (git-fixes).
   - scsi: mpt3sas: Fix error return value in _scsih_expander_add()
   - scsi: qedf: Add pointer checks in qedf_update_link_speed() (git-fixes).
   - scsi: qedf: Fix error codes in qedf_alloc_global_queues() (git-fixes).
   - scsi: qedi: Fix error codes in qedi_alloc_global_queues() (git-fixes).
   - scsi: qla2xxx: Fix a memory leak in an error path of
     qla2x00_process_els() (git-fixes).
   - scsi: qla2xxx: Make sure that aborted commands are freed (git-fixes).
   - scsi: snic: Fix an error message (git-fixes).
   - scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer (git-fixes).
   - sctp: check asoc peer.asconf_capable before processing asconf
   - soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
   - stmmac: copy unicast mac address to MAC registers (git-fixes).
   - stmmac: use of_property_read_u32 instead of read_u8 (git-fixes).
   - sysvipc/sem: mitigate semnum index against spectre v1 (bsc#1192802).
   - tty: serial: fsl_lpuart: fix the wrong mapbase value (git-fixes).
   - x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (git-fixes).
   - xen-pciback: Fix return in pm_ctrl_init() (git-fixes).
   - xen: Fix implicit type conversion (git-fixes).

Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-SP5:

      zypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-3848=1

Package List:

   - SUSE Linux Enterprise Server 12-SP5 (x86_64):


   - SUSE Linux Enterprise Server 12-SP5 (noarch):



More information about the sle-security-updates mailing list