SUSE-IU-2021:416-1: Security update of suse-sles-15-sp2-chost-byos-v20210304-hvm-ssd-x86_64
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Wed Mar 10 11:48:46 UTC 2021
SUSE Image Update Advisory: suse-sles-15-sp2-chost-byos-v20210304-hvm-ssd-x86_64
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2021:416-1
Image Tags : suse-sles-15-sp2-chost-byos-v20210304-hvm-ssd-x86_64:20210304
Image Release :
Severity : important
Type : security
References : 1065600 1149032 1152472 1152489 1153274 1154353 1155518 1163930
1165545 1167773 1170671 1172355 1174075 1175389 1175970 1176171
1176262 1176395 1176708 1176711 1176831 1176846 1177127 1177460
1177883 1178049 1178142 1178386 1178565 1178631 1178801 1178801
1178969 1179142 1179264 1179265 1179396 1179508 1179509 1179567
1179572 1179575 1179691 1179694 1179717 1179719 1179721 1179756
1179878 1180008 1180038 1180130 1180176 1180243 1180264 1180336
1180401 1180401 1180403 1180412 1180501 1180520 1180523 1180603
1180686 1180759 1180765 1180773 1180809 1180812 1180827 1180848
1180859 1180889 1180891 1180933 1180971 1181014 1181018 1181077
1181104 1181126 1181148 1181158 1181161 1181169 1181203 1181217
1181218 1181219 1181220 1181237 1181313 1181318 1181319 1181335
1181346 1181349 1181425 1181494 1181504 1181505 1181511 1181538
1181553 1181584 1181639 1181645 1181730 1181732 1181933 1181944
1182057 1182066 1182117 1182137 1182168 1182244 1182246 1182262
1182263 CVE-2019-20916 CVE-2019-25013 CVE-2019-8842 CVE-2020-10001
CVE-2020-11947 CVE-2020-14372 CVE-2020-15257 CVE-2020-25211 CVE-2020-25632
CVE-2020-25639 CVE-2020-25647 CVE-2020-27618 CVE-2020-27749 CVE-2020-27779
CVE-2020-27835 CVE-2020-28493 CVE-2020-29562 CVE-2020-29568 CVE-2020-29569
CVE-2020-29573 CVE-2020-36242 CVE-2020-8625 CVE-2021-0342 CVE-2021-20177
CVE-2021-20181 CVE-2021-20203 CVE-2021-20221 CVE-2021-20225 CVE-2021-20233
CVE-2021-21284 CVE-2021-21285 CVE-2021-26720 CVE-2021-3177 CVE-2021-3326
CVE-2021-3347 CVE-2021-3348
-----------------------------------------------------------------
The container suse-sles-15-sp2-chost-byos-v20210304-hvm-ssd-x86_64 was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:278-1
Released: Tue Feb 2 09:43:08 2021
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1181319
This update for lvm2 fixes the following issues:
- Backport 'lvmlockd' to adopt orphan locks feature. (bsc#1181319)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:285-1
Released: Tue Feb 2 13:08:54 2021
Summary: Security update for cups
Type: security
Severity: moderate
References: 1170671,1180520,CVE-2019-8842,CVE-2020-10001
This update for cups fixes the following issues:
- CVE-2020-10001: Fixed an out-of-bounds read in the ippReadIO function (bsc#1180520).
- CVE-2019-8842: Fixed an out-of-bounds read in an extension field (bsc#1170671).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:293-1
Released: Wed Feb 3 12:52:34 2021
Summary: Recommended update for gmp
Type: recommended
Severity: moderate
References: 1180603
This update for gmp fixes the following issues:
- correct license statements of packages (library itself is no GPL-3.0) (bsc#1180603)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:301-1
Released: Thu Feb 4 08:46:27 2021
Summary: Recommended update for timezone
Type: recommended
Severity: moderate
References: 1177460
This update for timezone fixes the following issues:
- timezone update 2021a (bsc#1177460)
* South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.
- timezone update 2021a (bsc#1177460)
* South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:302-1
Released: Thu Feb 4 13:18:35 2021
Summary: Recommended update for lvm2
Type: recommended
Severity: important
References: 1179691
This update for lvm2 fixes the following issues:
- lvm2 will no longer use external_device_info_source='udev' as default because it introduced a
regression (bsc#1179691).
If this behavior is still wanted, please change this manually in the lvm.conf
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2021:339-1
Released: Mon Feb 8 13:16:07 2021
Summary: Optional update for pam
Type: optional
Severity: low
References:
This update for pam fixes the following issues:
- Added rpm macros for this package, so that other packages can make use of it
This patch is optional to be installed - it doesn't fix any bugs.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:354-1
Released: Tue Feb 9 16:38:54 2021
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1065600,1149032,1152472,1152489,1153274,1154353,1155518,1163930,1165545,1167773,1172355,1175389,1176395,1176831,1176846,1178142,1178631,1179142,1179396,1179508,1179509,1179567,1179572,1179575,1179878,1180008,1180130,1180264,1180412,1180759,1180765,1180773,1180809,1180812,1180848,1180859,1180889,1180891,1180971,1181014,1181018,1181077,1181104,1181148,1181158,1181161,1181169,1181203,1181217,1181218,1181219,1181220,1181237,1181318,1181335,1181346,1181349,1181425,1181494,1181504,1181511,1181538,1181553,1181584,1181645,CVE-2020-25211,CVE-2020-25639,CVE-2020-27835,CVE-2020-29568,CVE-2020-29569,CVE-2021-0342,CVE-2021-20177,CVE-2021-3347,CVE-2021-3348
The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
- CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
- CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
- CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
- CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
- CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
- CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
- CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
- CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
The following non-security bugs were fixed:
- ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
- ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
- ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
- ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
- ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
- ALSA: doc: Fix reference to mixart.rst (git-fixes).
- ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
- ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
- ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
- ALSA: hda/conexant: add a new hda codec CX11970 (git-fixes).
- ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
- ALSA: hda/realtek: Add mute LED quirk for more HP laptops (git-fixes).
- ALSA: hda/realtek: Add two 'Intel Reference board' SSID in the ALC256 (git-fixes).
- ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
- ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 (git-fixes).
- ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
- ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (git-fixes).
- ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
- ALSA: hda/realtek - Modify Dell platform name (git-fixes).
- ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 (git-fixes).
- ALSA: hda/realtek - Supported Dell fixed type headset (git-fixes).
- ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
- ALSA: hda/via: Add minimum mute flag (git-fixes).
- ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
- ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
- ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
- ALSA: pcm: fix hw_rule deps kABI (bsc#1181014).
- ALSA: pcm: One more dependency for hw constraints (bsc#1181014).
- ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
- ALSA: usb-audio: Add quirk for BOSS AD-10 (git-fixes).
- ALSA: usb-audio: Add quirk for RC-505 (git-fixes).
- ALSA: usb-audio: Always apply the hw constraints for implicit fb sync (bsc#1181014).
- ALSA: usb-audio: Annotate the endpoint index in audioformat (git-fixes).
- ALSA: usb-audio: Avoid implicit feedback on Pioneer devices (bsc#1181014).
- ALSA: usb-audio: Avoid unnecessary interface re-setup (git-fixes).
- ALSA: usb-audio: Choose audioformat of a counter-part substream (git-fixes).
- ALSA: usb-audio: Fix hw constraints dependencies (bsc#1181014).
- ALSA: usb-audio: Fix implicit feedback sync setup for Pioneer devices (git-fixes).
- ALSA: usb-audio: Fix the missing endpoints creations for quirks (git-fixes).
- ALSA: usb-audio: Fix UAC1 rate setup for secondary endpoints (bsc#1181014).
- ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks (git-fixes).
- ALSA: usb-audio: Set sample rate for all sharing EPs on UAC1 (bsc#1181014).
- arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback (bsc#1152489).
- arm64: mm: Fix ARCH_LOW_ADDRESS_LIMIT when !CONFIG_ZONE_DMA (git-fixes).
- arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (bsc#1180130).
- arm64: pgtable: Fix pte_accessible() (bsc#1180130).
- ASoC: ak4458: correct reset polarity (git-fixes).
- ASoC: dapm: remove widget from dirty list on free (git-fixes).
- ASoC: Intel: fix error code cnl_set_dsp_D0() (git-fixes).
- ASoC: meson: axg-tdm-interface: fix loopback (git-fixes).
- bitmap: remove unused function declaration (git-fixes).
- Bluetooth: hci_h5: close serdev device and free hu in h5_close (git-fixes).
- Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close (git-fixes).
- bnxt_en: Fix AER recovery (jsc#SLE-8371 bsc#1153274).
- bpf: Do not leak memory in bpf getsockopt when optlen == 0 (bsc#1155518).
- bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback (bsc#1155518).
- btrfs: fix missing delalloc new bit for new delalloc ranges (bsc#1180773).
- btrfs: make btrfs_dirty_pages take btrfs_inode (bsc#1180773).
- btrfs: make btrfs_set_extent_delalloc take btrfs_inode (bsc#1180773).
- btrfs: send: fix invalid clone operations when cloning from the same file and root (bsc#1181511).
- btrfs: send: fix wrong file path when there is an inode with a pending rmdir (bsc#1181237).
- bus/fsl_mc: Do not rely on caller to provide non NULL mc_io (git-fixes).
- cachefiles: Drop superfluous readpages aops NULL check (git-fixes).
- can: dev: prevent potential information leak in can_fill_info() (git-fixes).
- can: vxcan: vxcan_xmit: fix use after free bug (git-fixes).
- CDC-NCM: remove 'connected' log message (git-fixes).
- clk: tegra30: Add hda clock default rates to clock driver (git-fixes).
- crypto: asym_tpm: correct zero out potential secrets (git-fixes).
- crypto: ecdh - avoid buffer overflow in ecdh_set_secret() (git-fixes).
- dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate() (git-fixes).
- dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate() (git-fixes).
- dmaengine: at_hdmac: Substitute kzalloc with kmalloc (git-fixes).
- dmaengine: dw-edma: Fix use after free in dw_edma_alloc_chunk() (git-fixes).
- dmaengine: mediatek: mtk-hsdma: Fix a resource leak in the error handling path of the probe function (git-fixes).
- dmaengine: xilinx_dma: check dma_async_device_register return value (git-fixes).
- dmaengine: xilinx_dma: fix incompatible param warning in _child_probe() (git-fixes).
- dmaengine: xilinx_dma: fix mixed_enum_type coverity warning (git-fixes).
- drivers/base/memory.c: indicate all memory blocks as removable (bsc#1180264).
- drivers/perf: Fix kernel panic when rmmod PMU modules during perf sampling (bsc#1180848).
- drivers/perf: hisi: Permit modular builds of HiSilicon uncore drivers (bsc#1180848). - Update config files. - supported.conf:
- drm: Added orientation quirk for ASUS tablet model T103HAF (git-fixes).
- drm/amd/display: Add missing pflip irq for dcn2.0 (git-fixes).
- drm/amd/display: Avoid MST manager resource leak (git-fixes).
- drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic (git-fixes).
- drm/amd/display: dchubbub p-state warning during surface planes switch (git-fixes).
- drm/amd/display: Do not double-buffer DTO adjustments (git-fixes).
- drm/amd/display: Do not invoke kgdb_breakpoint() unconditionally (git-fixes).
- drm/amd/display: Fix memleak in amdgpu_dm_mode_config_init (git-fixes).
- drm/amd/display: Free gamma after calculating legacy transfer function (git-fixes).
- drm/amd/display: HDMI remote sink need mode validation for Linux (git-fixes).
- drm/amd/display: Increase timeout for DP Disable (git-fixes).
- drm/amd/display: Reject overlay plane configurations in multi-display scenarios (git-fixes).
- drm/amd/display: remove useless if/else (git-fixes).
- drm/amd/display: Retry AUX write when fail occurs (git-fixes).
- drm/amd/display: Stop if retimer is not available (git-fixes).
- drm/amd/display: update nv1x stutter latencies (git-fixes).
- drm/amdgpu: add DID for navi10 blockchain SKU (git-fixes).
- drm/amdgpu: correct the gpu reset handling for job != NULL case (git-fixes).
- drm/amdgpu/dc: Require primary plane to be enabled whenever the CRTC is (git-fixes).
- drm/amdgpu: do not map BO in reserved region (git-fixes).
- drm/amdgpu: fix a GPU hang issue when remove device (git-fixes).
- drm/amdgpu: Fix bug in reporting voltage for CIK (git-fixes).
- drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume (git-fixes).
- drm/amdgpu: fix build_coefficients() argument (git-fixes).
- drm/amdgpu: fix calltrace during kmd unload(v3) (git-fixes).
- drm/amdgpu: increase atombios cmd timeout (git-fixes).
- drm/amdgpu: increase the reserved VM size to 2MB (git-fixes).
- drm/amdgpu: perform srbm soft reset always on SDMA resume (git-fixes).
- drm/amdgpu/powerplay: fix AVFS handling with custom powerplay table (git-fixes).
- drm/amdgpu/powerplay/smu7: fix AVFS handling with custom powerplay table (git-fixes).
- drm/amdgpu: prevent double kfree ttm->sg (git-fixes).
- drm/amdgpu/psp: fix psp gfx ctrl cmds (git-fixes).
- drm/amdgpu/sriov add amdgpu_amdkfd_pre_reset in gpu reset (git-fixes).
- drm/amdkfd: fix a memory leak issue (git-fixes).
- drm/amdkfd: Fix leak in dmabuf import (git-fixes).
- drm/amdkfd: fix restore worker race condition (git-fixes).
- drm/amdkfd: Use same SQ prefetch setting as amdgpu (git-fixes).
- drm/amd/pm: avoid false alarm due to confusing softwareshutdowntemp setting (git-fixes).
- drm/aspeed: Fix Kconfig warning & subsequent build errors (bsc#1152472)
- drm/aspeed: Fix Kconfig warning & subsequent build errors (git-fixes).
- drm/atomic: put state on error path (git-fixes).
- drm: bridge: dw-hdmi: Avoid resetting force in the detect function (bsc#1152472)
- drm/bridge/synopsys: dsi: add support for non-continuous HS clock (git-fixes).
- drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working correctly (git-fixes).
- drm/dp_aux_dev: check aux_dev before use in (bsc#1152472)
- drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() (git-fixes).
- drm/etnaviv: always start/stop scheduler in timeout processing (git-fixes).
- drm/exynos: dsi: Remove bridge node reference in error handling path in probe function (git-fixes).
- drm/gma500: fix double free of gma_connector (bsc#1152472) Backporting notes: * context changes
- drm/gma500: fix double free of gma_connector (git-fixes).
- drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] (git-fixes).
- drm/i915: Avoid memory leak with more than 16 workarounds on a list (git-fixes).
- drm/i915: Break up error capture compression loops with cond_resched() (git-fixes).
- drm/i915: Check for all subplatform bits (git-fixes).
- drm/i915: clear the gpu reloc batch (git-fixes).
- drm/i915: Correctly set SFC capability for video engines (bsc#1152489) Backporting notes: * context changes
- drm/i915/display/dp: Compute the correct slice count for VDSC on DP (git-fixes).
- drm/i915: Drop runtime-pm assert from vgpu io accessors (git-fixes).
- drm/i915/dsi: Use unconditional msleep for the panel_on_delay when there is no reset-deassert MIPI-sequence (git-fixes).
- drm/i915: Filter wake_flags passed to default_wake_function (git-fixes).
- drm/i915: Fix mismatch between misplaced vma check and vma insert (git-fixes).
- drm/i915: Force VT'd workarounds when running as a guest OS (git-fixes).
- drm/i915/gt: Declare gen9 has 64 mocs entries! (git-fixes).
- drm/i915/gt: Delay execlist processing for tgl (git-fixes).
- drm/i915/gt: Free stale request on destroying the virtual engine (git-fixes).
- drm/i915/gt: Prevent use of engine->wa_ctx after error (git-fixes).
- drm/i915/gt: Program mocs:63 for cache eviction on gen9 (git-fixes).
- drm/i915/gvt: return error when failing to take the module reference (git-fixes).
- drm/i915/gvt: Set ENHANCED_FRAME_CAP bit (git-fixes).
- drm/i915: Handle max_bpc==16 (git-fixes).
- drm/i915/selftests: Avoid passing a random 0 into ilog2 (git-fixes).
- drm/mcde: Fix handling of platform_get_irq() error (bsc#1152472)
- drm/mcde: Fix handling of platform_get_irq() error (git-fixes).
- drm/meson: dw-hdmi: Register a callback to disable the regulator (git-fixes).
- drm/msm/a5xx: Always set an OPP supported hardware value (git-fixes).
- drm/msm/a6xx: fix a potential overflow issue (git-fixes).
- drm/msm/a6xx: fix gmu start on newer firmware (git-fixes).
- drm/msm: add shutdown support for display platform_driver (git-fixes).
- drm/msm: Disable preemption on all 5xx targets (git-fixes).
- drm/msm/dpu: Add newline to printks (git-fixes).
- drm/msm/dpu: Fix scale params in plane validation (git-fixes).
- drm/msm/dsi_phy_10nm: implement PHY disabling (git-fixes).
- drm/msm/dsi_pll_10nm: restore VCO rate during restore_state (git-fixes).
- drm/msm: fix leaks if initialization fails (git-fixes).
- drm/nouveau/bios: fix issue shadowing expansion ROMs (git-fixes).
- drm/nouveau/debugfs: fix runtime pm imbalance on error (git-fixes).
- drm/nouveau/dispnv50: fix runtime pm imbalance on error (git-fixes).
- drm/nouveau: fix runtime pm imbalance on error (git-fixes).
- drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields (git-fixes).
- drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0 (git-fixes).
- drm/nouveau/mem: guard against NULL pointer access in mem_del (git-fixes).
- drm/nouveau/mmu: fix vram heap sizing (git-fixes).
- drm/nouveau/nouveau: fix the start/end range for migration (git-fixes).
- drm/nouveau/privring: ack interrupts the same way as RM (git-fixes).
- drm/nouveau/svm: fail NOUVEAU_SVM_INIT ioctl on unsupported devices (git-fixes).
- drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() (git-fixes).
- drm/omap: dss: Cleanup DSS ports on initialisation failure (git-fixes).
- drm/omap: fix incorrect lock state (git-fixes).
- drm/omap: fix possible object reference leak (git-fixes).
- drm/panfrost: add amlogic reset quirk callback (git-fixes).
- drm: rcar-du: Set primary plane zpos immutably at initializing (git-fixes).
- drm/rockchip: Avoid uninitialized use of endpoint id in LVDS (bsc#1152472)
- drm/rockchip: Avoid uninitialized use of endpoint id in LVDS (git-fixes).
- drm/scheduler: Avoid accessing freed bad job (git-fixes).
- drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() (bsc#1152472)
- drm/sun4i: frontend: Fix the scaler phase on A33 (git-fixes).
- drm/sun4i: frontend: Reuse the ch0 phase for RGB formats (git-fixes).
- drm/sun4i: frontend: Rework a bit the phase data (git-fixes).
- drm/sun4i: mixer: Extend regmap max_register (git-fixes).
- drm/syncobj: Fix use-after-free (git-fixes).
- drm/tegra: replace idr_init() by idr_init_base() (git-fixes).
- drm/tegra: sor: Disable clocks on error in tegra_sor_init() (git-fixes).
- drm/ttm: fix eviction valuable range check (git-fixes).
- drm/tve200: Fix handling of platform_get_irq() error (bsc#1152472)
- drm/tve200: Fix handling of platform_get_irq() error (git-fixes).
- drm/tve200: Stabilize enable/disable (git-fixes).
- drm/vc4: drv: Add error handding for bind (git-fixes).
- e1000e: bump up timeout to wait when ME un-configures ULP mode (jsc#SLE-8100).
- EDAC/amd64: Fix PCI component registration (bsc#1152489).
- ehci: fix EHCI host controller initialization sequence (git-fixes).
- ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() (git-fixes).
- Exclude Symbols.list again. Removing the exclude builds vanilla/linux-next builds. Fixes: 55877625c800 ('kernel-binary.spec.in: Package the obj_install_dir as explicit filelist.')
- firmware: imx: select SOC_BUS to fix firmware build (git-fixes).
- floppy: reintroduce O_NDELAY fix (boo#1181018).
- futex: Ensure the correct return value from futex_lock_pi() (bsc#1181349 bsc#1149032).
- futex: Handle faults correctly for PI futexes (bsc#1181349 bsc#1149032).
- futex: Provide and use pi_state_update_owner() (bsc#1181349 bsc#1149032).
- futex: Remove needless goto's (bsc#1149032).
- futex: Remove unused empty compat_exit_robust_list() (bsc#1149032).
- futex: Replace pointless printk in fixup_owner() (bsc#1181349 bsc#1149032).
- futex: Simplify fixup_pi_state_owner() (bsc#1181349 bsc#1149032).
- futex: Use pi_state_update_owner() in put_pi_state() (bsc#1181349 bsc#1149032).
- HID: Ignore battery for Elan touchscreen on ASUS UX550 (git-fixes).
- HID: logitech-dj: add the G602 receiver (git-fixes).
- HID: multitouch: Apply MT_QUIRK_CONFIDENCE quirk for multi-input devices (git-fixes).
- HID: multitouch: do not filter mice nodes (git-fixes).
- HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device (git-fixes).
- HID: multitouch: Remove MT_CLS_WIN_8_DUAL (git-fixes).
- HID: wacom: Constify attribute_groups (git-fixes).
- HID: wacom: Correct NULL dereference on AES pen proximity (git-fixes).
- HID: wacom: do not call hid_set_drvdata(hdev, NULL) (git-fixes).
- HID: wacom: Fix memory leakage caused by kfifo_alloc (git-fixes).
- hwmon: (pwm-fan) Ensure that calculation does not discard big period values (git-fixes).
- i2c: bpmp-tegra: Ignore unknown I2C_M flags (git-fixes).
- i2c: i801: Fix the i2c-mux gpiod_lookup_table not being properly terminated (git-fixes).
- i2c: octeon: check correct size of maximum RECV_LEN packet (git-fixes).
- i2c: sprd: use a specific timeout to avoid system hang up issue (git-fixes).
- i3c master: fix missing destroy_workqueue() on error in i3c_master_register (git-fixes).
- IB/hfi1: Remove kobj from hfi1_devdata (bsc#1179878).
- IB/hfi1: Remove module parameter for KDETH qpns (bsc#1179878).
- ice: avoid premature Rx buffer reuse (jsc#SLE-7926).
- ice, xsk: clear the status bits for the next_to_use descriptor (jsc#SLE-7926).
- iio: ad5504: Fix setting power-down state (git-fixes).
- iomap: fix WARN_ON_ONCE() from unprivileged users (bsc#1181494).
- iommu/vt-d: Fix a bug for PDP check in prq_event_thread (bsc#1181217).
- ionic: account for vlan tag len in rx buffer len (bsc#1167773).
- kABI fixup for dwc3 introduction of DWC_usb32 (git-fixes).
- kdb: Fix pager search for multi-line strings (git-fixes).
- kgdb: Drop malformed kernel doc comment (git-fixes).
- kprobes: tracing/kprobes: Fix to kill kprobes on initmem after boot (git fixes (kernel/kprobe)).
- KVM: nVMX: Reload vmcs01 if getting vmcs12's pages fails (bsc#1181218).
- KVM: s390: pv: Mark mm as protected after the set secure parameters and improve cleanup (jsc#SLE-7512 bsc#1165545).
- KVM: SVM: Initialize prev_ga_tag before use (bsc#1180809).
- leds: trigger: fix potential deadlock with libata (git-fixes).
- lib/genalloc: fix the overflow when size is too big (git-fixes).
- lib/string: remove unnecessary #undefs (git-fixes).
- lockd: do not use interval-based rebinding over TCP (for-next).
- mac80211: check if atf has been disabled in __ieee80211_schedule_txq (git-fixes).
- mac80211: do not drop tx nulldata packets on encrypted links (git-fixes).
- md: fix a warning caused by a race between concurrent md_ioctl()s (for-next).
- media: dvb-usb: Fix memory leak at error in dvb_usb_device_init() (bsc#1181104).
- media: dvb-usb: Fix use-after-free access (bsc#1181104).
- media: gp8psk: initialize stats at power control logic (git-fixes).
- media: rc: ensure that uevent can be read directly after rc device register (git-fixes).
- misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() (git-fixes).
- misdn: dsp: select CONFIG_BITREVERSE (git-fixes).
- mmc: core: do not initialize block size from ext_csd if not present (git-fixes).
- mmc: sdhci-xenon: fix 1.8v regulator stabilization (git-fixes).
- mm: memcontrol: fix missing wakeup polling thread (bsc#1181584).
- mm/vmalloc: Fix unlock order in s_stop() (git fixes (mm/vmalloc)).
- module: delay kobject uevent until after module init call (bsc#1178631).
- mt7601u: fix kernel crash unplugging the device (git-fixes).
- mt7601u: fix rx buffer refcounting (git-fixes).
- net/af_iucv: fix null pointer dereference on shutdown (bsc#1179567 LTC#190111).
- net/af_iucv: set correct sk_protocol for child sockets (git-fixes).
- net: fix proc_fs init handling in af_packet and tls (bsc#1154353).
- net: hns3: fix a phy loopback fail issue (bsc#1154353).
- net: hns3: remove a misused pragma packed (bsc#1154353).
- net/mlx5e: ethtool, Fix restriction of autoneg with 56G (jsc#SLE-8464).
- net: mscc: ocelot: allow offloading of bridge on top of LAG (git-fixes).
- net/smc: cancel event worker during device removal (git-fixes).
- net/smc: check for valid ib_client_data (git-fixes).
- net/smc: fix cleanup for linkgroup setup failures (git-fixes).
- net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid() (git-fixes).
- net/smc: fix dmb buffer shortage (git-fixes).
- net/smc: fix sleep bug in smc_pnet_find_roce_resource() (git-fixes).
- net/smc: fix sock refcounting in case of termination (git-fixes).
- net/smc: fix valid DMBE buffer sizes (git-fixes).
- net/smc: no peer ID in CLC decline for SMCD (git-fixes).
- net/smc: remove freed buffer from list (git-fixes).
- net/smc: reset sndbuf_desc if freed (git-fixes).
- net/smc: set rx_off for SMCR explicitly (git-fixes).
- net/smc: switch smcd_dev_list spinlock to mutex (git-fixes).
- net/smc: transfer fasync_list in case of fallback (git-fixes).
- net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs' (for-next).
- net: sunrpc: interpret the return value of kstrtou32 correctly (for-next).
- net: usb: qmi_wwan: add Quectel EM160R-GL (git-fixes).
- net: vlan: avoid leaks on register_vlan_dev() failures (bsc#1154353).
- NFC: fix possible resource leak (git-fixes).
- NFC: fix resource leak when target index is invalid (git-fixes).
- NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock (for-next).
- nfs_common: need lock during iterate through the list (for-next).
- nfsd4: readdirplus shouldn't return parent of export (git-fixes).
- nfsd: Fix message level for normal termination (for-next).
- NFS: nfs_delegation_find_inode_server must first reference the superblock (for-next).
- NFS: nfs_igrab_and_active must first reference the superblock (for-next).
- NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter (for-next).
- NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read() (for-next).
- NFS: switch nfsiod to be an UNBOUND workqueue (for-next).
- NFSv4.2: condition READDIR's mask for security label based on LSM state (for-next).
- NFSv4: Fix the alignment of page data in the getdeviceinfo reply (for-next).
- nvme-multipath: fix bogus request queue reference put (bsc#1175389).
- nvme-rdma: avoid request double completion for concurrent nvme_rdma_timeout (bsc#1181161).
- nvme-tcp: avoid request double completion for concurrent nvme_tcp_timeout (bsc#1181161).
- platform/x86: i2c-multi-instantiate: Do not create platform device for INT3515 ACPI nodes (git-fixes).
- platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634 (git-fixes).
- platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list (git-fixes).
- platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on some HP x360 models (git-fixes).
- PM: hibernate: flush swap writer after marking (git-fixes).
- pNFS: Mark layout for return if return-on-close was not sent (git-fixes).
- powerpc: Fix build error in paravirt.h (bsc#1181148 ltc#190702).
- powerpc/paravirt: Use is_kvm_guest() in vcpu_is_preempted() (bsc#1181148 ltc#190702).
- powerpc: Refactor is_kvm_guest() declaration to new header (bsc#1181148 ltc#190702).
- powerpc: Reintroduce is_kvm_guest() as a fast-path check (bsc#1181148 ltc#190702).
- powerpc: Rename is_kvm_guest() to check_kvm_guest() (bsc#1181148 ltc#190702).
- power: vexpress: add suppress_bind_attrs to true (git-fixes).
- prom_init: enable verbose prints (bsc#1178142 bsc#1180759).
- ptrace: reintroduce usage of subjective credentials in ptrace_has_cap() (bsc#1163930).
- ptrace: Set PF_SUPERPRIV when checking capability (bsc#1163930).
- r8152: Add Lenovo Powered USB-C Travel Hub (git-fixes).
- r8169: work around power-saving bug on some chip versions (git-fixes).
- regmap: debugfs: Fix a memory leak when calling regmap_attach_dev (git-fixes).
- regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init() (git-fixes).
- Revive usb-audio Keep Interface mixer (bsc#1181014).
- rtc: pl031: fix resource leak in pl031_probe (git-fixes).
- rtc: sun6i: Fix memleak in sun6i_rtc_clk_init (git-fixes).
- rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (bsc#1181349 bsc#1149032).
- s390/cio: fix use-after-free in ccw_device_destroy_console (git-fixes).
- s390/dasd: fix hanging device offline processing (bsc#1181169 LTC#190914).
- s390/dasd: fix list corruption of lcu list (git-fixes).
- s390/dasd: fix list corruption of pavgroup group list (git-fixes).
- s390/dasd: prevent inconsistent LCU device data (git-fixes).
- s390/kexec_file: fix diag308 subcode when loading crash kernel (git-fixes).
- s390/qeth: consolidate online/offline code (git-fixes).
- s390/qeth: do not raise NETDEV_REBOOT event from L3 offline path (git-fixes).
- s390/qeth: fix deadlock during recovery (git-fixes).
- s390/qeth: fix L2 header access in qeth_l3_osa_features_check() (git-fixes).
- s390/qeth: fix locking for discipline setup / removal (git-fixes).
- s390/smp: perform initial CPU reset also for SMT siblings (git-fixes).
- sched/fair: Check for idle core in wake_affine (git fixes (sched)).
- scsi: ibmvfc: Set default timeout to avoid crash during migration (bsc#1181425 ltc#188252).
- scsi: lpfc: Enhancements to LOG_TRACE_EVENT for better readability (bsc#1180891).
- scsi: lpfc: Fix auto sli_mode and its effect on CONFIG_PORT for SLI3 (bsc#1180891).
- scsi: lpfc: Fix crash when a fabric node is released prematurely (bsc#1180891).
- scsi: lpfc: Fix crash when nvmet transport calls host_release (bsc#1180891).
- scsi: lpfc: Fix error log messages being logged following SCSI task mgnt (bsc#1180891).
- scsi: lpfc: Fix FW reset action if I/Os are outstanding (bsc#1180891).
- scsi: lpfc: Fix NVMe recovery after mailbox timeout (bsc#1180891).
- scsi: lpfc: Fix PLOGI S_ID of 0 on pt2pt config (bsc#1180891).
- scsi: lpfc: Fix target reset failing (bsc#1180891).
- scsi: lpfc: Fix vport create logging (bsc#1180891).
- scsi: lpfc: Implement health checking when aborting I/O (bsc#1180891).
- scsi: lpfc: Prevent duplicate requests to unregister with cpuhp framework (bsc#1180891).
- scsi: lpfc: Refresh ndlp when a new PRLI is received in the PRLI issue state (bsc#1180891).
- scsi: lpfc: Simplify bool comparison (bsc#1180891).
- scsi: lpfc: Update lpfc version to 12.8.0.7 (bsc#1180891).
- scsi: lpfc: Use the nvme-fc transport supplied timeout for LS requests (bsc#1180891).
- scsi: qla2xxx: Fix description for parameter ql2xenforce_iocb_limit (bsc#1179142).
- scsi: scsi_transport_srp: Do not block target in failfast state (bsc#1172355).
- selftests/ftrace: Select an existing function in kprobe_eventname test (bsc#1179396 ltc#185738).
- selftests: net: fib_tests: remove duplicate log test (git-fixes).
- selftests/powerpc: Add a test of bad (out-of-range) accesses (bsc#1181158 ltc#190851).
- selftests/powerpc: Add a test of spectre_v2 mitigations (bsc#1181158 ltc#190851).
- selftests/powerpc: Ignore generated files (bsc#1181158 ltc#190851).
- selftests/powerpc: Move Hash MMU check to utilities (bsc#1181158 ltc#190851).
- selftests/powerpc: Move set_dscr() into rfi_flush.c (bsc#1181158 ltc#190851).
- selftests/powerpc: Only test lwm/stmw on big endian (bsc#1180412 ltc#190579).
- selftests/powerpc: spectre_v2 test must be built 64-bit (bsc#1181158 ltc#190851).
- serial: mvebu-uart: fix tx lost characters at power off (git-fixes).
- spi: cadence: cache reference clock rate during probe (git-fixes).
- spi: stm32: FIFO threshold level - fix align packet size (git-fixes).
- staging: mt7621-dma: Fix a resource leak in an error handling path (git-fixes).
- staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb() (git-fixes).
- SUNRPC: Clean up the handling of page padding in rpc_prepare_reply_pages() (for-next).
- sunrpc: fix xs_read_xdr_buf for partial pages receive (for-next).
- SUNRPC: rpc_wake_up() should wake up tasks in the correct order (for-next).
- swiotlb: fix 'x86: Do not panic if can not alloc buffer for swiotlb' (git-fixes).
- swiotlb: using SIZE_MAX needs limits.h included (git-fixes).
- timers: Preserve higher bits of expiration on index calculation (bsc#1181318).
- timers: Use only bucket expiry for base->next_expiry value (bsc#1181318).
- udp: Prevent reuseport_select_sock from reading uninitialized socks (git-fixes).
- USB: cdc-acm: blacklist another IR Droid device (git-fixes).
- USB: cdc-wdm: Fix use after free in service_outstanding_interrupt() (git-fixes).
- usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() (git-fixes).
- USB: dummy-hcd: Fix uninitialized array use in init() (git-fixes).
- usb: dwc3: Add support for DWC_usb32 IP (git-fixes).
- usb: dwc3: core: Properly default unspecified speed (git-fixes).
- usb: dwc3: ulpi: Use VStsDone to detect PHY regs access completion (git-fixes).
- usb: dwc3: Update soft-reset wait polling rate (git-fixes).
- USB: ehci: fix an interrupt calltrace error (git-fixes).
- usb: gadget: aspeed: fix stop dma register setting (git-fixes).
- usb: gadget: configfs: Fix use-after-free issue with udc_name (git-fixes).
- usb: gadget: configfs: Preserve function ordering after bind failure (git-fixes).
- usb: gadget: enable super speed plus (git-fixes).
- usb: gadget: Fix spinlock lockup on usb_function_deactivate (git-fixes).
- usb: gadget: f_uac2: reset wMaxPacketSize (git-fixes).
- usb: gadget: function: printer: Fix a memory leak for interface descriptor (git-fixes).
- USB: gadget: legacy: fix return error code in acm_ms_bind() (git-fixes).
- usb: gadget: select CONFIG_CRC32 (git-fixes).
- usb: gadget: u_ether: Fix MTU size mismatch with RX packet size (git-fixes).
- USB: serial: iuu_phoenix: fix DMA from stack (git-fixes).
- USB: serial: option: add LongSung M5710 module support (git-fixes).
- USB: serial: option: add Quectel EM160R-GL (git-fixes).
- usb: typec: Fix copy paste error for NVIDIA alt-mode description (git-fixes).
- usb: uas: Add PNY USB Portable SSD to unusual_uas (git-fixes).
- usb: udc: core: Use lock when write to soft_connect (git-fixes).
- usb: usbip: vhci_hcd: protect shift size (git-fixes).
- USB: usblp: fix DMA to stack (git-fixes).
- USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set (git-fixes).
- USB: yurex: fix control-URB timeout handling (git-fixes).
- vfio iommu: Add dma available capability (bsc#1179572 LTC#190110).
- vfio/pci: Implement ioeventfd thread handler for contended memory lock (bsc#1181219).
- vfio-pci: Use io_remap_pfn_range() for PCI IO memory (bsc#1181220).
- video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() (git-fixes).
- video: fbdev: fix OOB read in vga_8planes_imageblit() (git-fixes).
- video: fbdev: pvr2fb: initialize variables (git-fixes).
- video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error (git-fixes).
- wan: ds26522: select CONFIG_BITREVERSE (git-fixes).
- wil6210: select CONFIG_CRC32 (git-fixes).
- x86/apic: Fix x2apic enablement without interrupt remapping (bsc#1152489).
- x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (bsc#1181077).
- x86/cpu/amd: Set __max_die_per_package on AMD (bsc#1152489).
- x86/hyperv: Fix kexec panic/hang issues (bsc#1176831).
- x86/kprobes: Restore BTF if the single-stepping is cancelled (bsc#1152489).
- x86/mm: Fix leak of pmd ptlock (bsc#1152489).
- x86/mm/numa: Remove uninitialized_var() usage (bsc#1152489).
- x86/mtrr: Correct the range check before performing MTRR type lookups (bsc#1152489).
- x86/resctrl: Do not move a task to the same resource group (bsc#1152489).
- x86/resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC MSR (bsc#1152489).
- x86/topology: Make __max_die_per_package available unconditionally (bsc#1152489).
- x86/xen: avoid warning in Xen pv guest with CONFIG_AMD_MEM_ENCRYPT enabled (bsc#1181335).
- xen-blkfront: allow discard-* nodes to be optional (bsc#1181346).
- xen/privcmd: allow fetching resource sizes (bsc#1065600).
- xfs: show the proper user quota options (bsc#1181538).
- xhci: Give USB2 ports time to enter U3 in bus suspend (git-fixes).
- xhci: make sure TRB is fully written before giving it to the controller (git-fixes).
- xhci: tegra: Delay for disabling LFPS detector (git-fixes).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:419-1
Released: Wed Feb 10 12:03:33 2021
Summary: Recommended update for open-iscsi
Type: recommended
Severity: moderate
References: 1181313
This update for open-iscsi fixes the following issues:
- Fixes a segfault when exiting from iscsiadm (bsc#1181313)
- Fix for several memory leaks in iscsiadm
- Fix for a crash when function iscsi_rec_update_param() is invoked
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:435-1
Released: Thu Feb 11 14:47:25 2021
Summary: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
Type: security
Severity: important
References: 1174075,1176708,1178801,1178969,1180243,1180401,1181730,1181732,CVE-2020-15257,CVE-2021-21284,CVE-2021-21285
This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:
Security issues fixed:
- CVE-2020-15257: Fixed a privilege escalation in containerd (bsc#1178969).
- CVE-2021-21284: potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732)
- CVE-2021-21285: pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730)
Non-security issues fixed:
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
It appears that SLES doesn't like the patch. (bsc#1180401)
- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
fixes CVE-2020-15257. bsc#1180243
- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
bsc#1176708
- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
https://github.com/docker/docker-ce/releases/tag/v19.03.14
- Enable fish-completion
- Add a patch which makes Docker compatible with firewalld with
nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
(bsc#1178801, SLE-16460)
- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708
- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)
- Emergency fix: %requires_eq does not work with provide symbols,
only effective package names. Convert back to regular Requires.
- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
/usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
spurrious errors due to Go returning -EINTR from I/O syscalls much more often
(due to Go 1.14's pre-emptive goroutine support).
- Add BuildRequires for all -git dependencies so that we catch missing
dependencies much more quickly.
- Update to libnetwork 55e924b8a842, which is required for Docker 19.03.14-ce.
bsc#1180243
- Add patch which makes libnetwork compatible with firewalld with
nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
(bsc#1178801, SLE-16460)
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2021:441-1
Released: Thu Feb 11 16:35:04 2021
Summary: Optional update for python3-jsonschema
Type: optional
Severity: low
References: 1180403
This update provides the python3 variant of the jsonschema module to the
SUSE Linux Enterprise 15 SP2 Basesystem module.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:507-1
Released: Thu Feb 18 09:34:49 2021
Summary: Security update for bind
Type: security
Severity: important
References: 1182246,CVE-2020-8625
This update for bind fixes the following issues:
- CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy
negotiation can be targeted by a buffer overflow attack [bsc#1182246]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:516-1
Released: Thu Feb 18 14:42:51 2021
Summary: Recommended update for docker, golang-github-docker-libnetwork
Type: recommended
Severity: moderate
References: 1178801,1180401,1182168
This update for docker, golang-github-docker-libnetwork fixes the following issues:
- A libnetwork firewalld integration enhancement was broken, disable it (bsc#1178801,bsc#1180401,bsc#1182168)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:519-1
Released: Fri Feb 19 09:44:53 2021
Summary: Recommended update for openssh
Type: recommended
Severity: moderate
References: 1180501
This update for openssh fixes the following issues:
- Fixed a crash which sometimes occured on connection termination, caused
by accessing freed memory (bsc#1180501)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:521-1
Released: Fri Feb 19 11:00:33 2021
Summary: Security update for qemu
Type: security
Severity: important
References: 1178049,1178565,1179717,1179719,1180523,1181639,1181933,1182137,CVE-2020-11947,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221
This update for qemu fixes the following issues:
- Fixed potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)
- Fixed out-of-bound access in iscsi (CVE-2020-11947 bsc#1180523)
- Fixed out-of-bound access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)
- Fixed out-of-bound access in ARM interrupt handling (CVE-2021-20221 bsc#1181933)
- Fixed vfio-pci device on s390 enters error state (bsc#1179717 bsc#1179719)
- Fixed 'Failed to try-restart qemu-ga at .service' error while updating the
qemu-guest-agent. (bsc#1178565)
- Apply fixes to qemu scsi passthrough with respect to timeout and
error conditions, including using more correct status codes. Add
more qemu tracing which helped track down these issues
(bsc#1178049)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:529-1
Released: Fri Feb 19 14:53:47 2021
Summary: Security update for python3
Type: security
Severity: moderate
References: 1176262,1179756,1180686,1181126,CVE-2019-20916,CVE-2021-3177
This update for python3 fixes the following issues:
- CVE-2021-3177: Fixed buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126).
- Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:551-1
Released: Tue Feb 23 09:31:53 2021
Summary: Security update for avahi
Type: security
Severity: moderate
References: 1180827,CVE-2021-26720
This update for avahi fixes the following issues:
- CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)
- Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.
- Add sudo to requires: used to drop privileges.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:571-1
Released: Tue Feb 23 16:11:33 2021
Summary: Recommended update for cloud-init
Type: recommended
Severity: moderate
References: 1180176
This update for cloud-init contains the following fixes:
- Update cloud-init-write-routes.patch (bsc#1180176)
+ Follow up to previous changes. Fix order of operations
error to make gateway comparison between subnet configuration and
route configuration valuable rather than self-comparing.
- Add cloud-init-sle12-compat.patch (jsc#PM-2335)
- Python 3.4 compatibility in setup.py
- Disable some test for mock version compatibility
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:573-1
Released: Wed Feb 24 09:58:38 2021
Summary: Recommended update for dracut
Type: recommended
Severity: moderate
References: 1176171,1180336
This update for dracut fixes the following issues:
- arm/arm64: Add reset controllers (bsc#1180336)
- Prevent creating unexpected files on the host when running dracut (bsc#1176171)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:594-1
Released: Thu Feb 25 09:29:35 2021
Summary: Security update for python-cryptography
Type: security
Severity: important
References: 1182066,CVE-2020-36242
This update for python-cryptography fixes the following issues:
- CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte
values could result in an integer overflow and buffer overflow (bsc#1182066).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:653-1
Released: Fri Feb 26 19:53:43 2021
Summary: Security update for glibc
Type: security
Severity: important
References: 1178386,1179694,1179721,1180038,1181505,1182117,CVE-2019-25013,CVE-2020-27618,CVE-2020-29562,CVE-2020-29573,CVE-2021-3326
This update for glibc fixes the following issues:
- Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)
- x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)
- iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:654-1
Released: Fri Feb 26 20:01:10 2021
Summary: Security update for python-Jinja2
Type: security
Severity: important
References: 1181944,1182244,CVE-2020-28493
This update for python-Jinja2 fixes the following issues:
- CVE-2020-28493: Fixed a ReDOS vulnerability where urlize could have
been called with untrusted user data (bsc#1181944).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:656-1
Released: Mon Mar 1 09:34:21 2021
Summary: Recommended update for protobuf
Type: recommended
Severity: moderate
References: 1177127
This update for protobuf fixes the following issues:
- Add missing dependency of python subpackages on python-six. (bsc#1177127)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:683-1
Released: Tue Mar 2 19:04:43 2021
Summary: Security update for grub2
Type: security
Severity: important
References: 1175970,1176711,1177883,1179264,1179265,1182057,1182262,1182263,CVE-2020-14372,CVE-2020-25632,CVE-2020-25647,CVE-2020-27749,CVE-2020-27779,CVE-2021-20225,CVE-2021-20233
This update for grub2 fixes the following issues:
grub2 implements the new 'SBAT' method for SHIM based secure boot revocation. (bsc#1182057)
- CVE-2020-25632: Fixed a use-after-free in rmmod command (bsc#1176711)
- CVE-2020-25647: Fixed an out-of-bound write in grub_usb_device_initialize() (bsc#1177883)
- CVE-2020-27749: Fixed a stack buffer overflow in grub_parser_split_cmdline (bsc#1179264)
- CVE-2020-27779, CVE-2020-14372: Disallow cutmem and acpi commands in secure boot mode (bsc#1179265 bsc#1175970)
- CVE-2021-20225: Fixed a heap out-of-bounds write in short form option parser (bsc#1182262)
- CVE-2021-20233: Fixed a heap out-of-bound write due to mis-calculation of space required for quoting (bsc#1182263)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:689-1
Released: Tue Mar 2 19:08:40 2021
Summary: Security update for bind
Type: security
Severity: important
References: 1180933
This update for bind fixes the following issues:
- dnssec-keygen can no longer generate HMAC keys. Use tsig-keygen instead. [bsc#1180933]
More information about the sle-security-updates
mailing list