SUSE-SU-2024:2893-1: important: Security update for the Linux Kernel
SLE-UPDATES
null at suse.de
Tue Aug 13 16:40:32 UTC 2024
# Security update for the Linux Kernel
Announcement ID: SUSE-SU-2024:2893-1
Rating: important
References:
* bsc#1216834
* bsc#1218820
* bsc#1220185
* bsc#1220186
* bsc#1221539
* bsc#1222728
* bsc#1222824
* bsc#1223863
* bsc#1224918
* bsc#1225431
* bsc#1226519
* bsc#1226550
* bsc#1226574
* bsc#1226662
* bsc#1226666
* bsc#1227213
* bsc#1227362
* bsc#1227487
* bsc#1227716
* bsc#1227750
* bsc#1227810
* bsc#1227836
* bsc#1227976
* bsc#1228013
* bsc#1228040
* bsc#1228114
* bsc#1228328
* bsc#1228561
* bsc#1228644
* bsc#1228743
Cross-References:
* CVE-2021-47126
* CVE-2021-47219
* CVE-2021-47291
* CVE-2021-47520
* CVE-2021-47580
* CVE-2021-47598
* CVE-2022-48792
* CVE-2022-48821
* CVE-2022-48822
* CVE-2023-52885
* CVE-2024-26583
* CVE-2024-26584
* CVE-2024-26800
* CVE-2024-36974
* CVE-2024-39494
* CVE-2024-40937
* CVE-2024-40956
* CVE-2024-41011
* CVE-2024-41059
* CVE-2024-41069
* CVE-2024-41090
* CVE-2024-42145
CVSS scores:
* CVE-2021-47126 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2021-47219 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2021-47291 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2021-47520 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2021-47520 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2021-47580 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
* CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2022-48792 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2022-48792 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2022-48821 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2022-48822 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2022-48822 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-52885 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-26583 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2024-26583 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2024-26584 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2024-26584 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2024-26800 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2024-36974 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-39494 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-39494 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-40937 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-40956 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-41011 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-41059 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2024-41059 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-41069 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2024-41069 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-41090 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
* CVE-2024-42145 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2024-42145 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* SUSE Linux Enterprise Micro 5.1
* SUSE Linux Enterprise Micro 5.2
* SUSE Linux Enterprise Micro for Rancher 5.2
An update that solves 22 vulnerabilities and has eight security fixes can now be
installed.
## Description:
The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various
security bugfixes.
The following security bugs were fixed:
* CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name
(bsc#1227716).
* CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
* CVE-2024-42145: IB/core: Implement a limit on UMAD receive List
(bsc#1228743).
* CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
* CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in
irq_process_work_list (bsc#1227810).
* CVE-2023-52885: SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
(bsc#1227750).
* CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP
sas_task (bsc#1228013).
* CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
* CVE-2021-47291: ipv6: fix another slab-out-of-bounds in
fib6_nh_flush_exceptions (bsc#1224918).
* CVE-2021-47126: ipv6: Fix KASAN: slab-out-of-bounds Read in
fib6_nh_flush_exceptions (bsc#1221539).
* CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with
large pages (bsc#1228114).
* CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init()
(bsc#1226574).
* CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB
(bsc#1226550).
* CVE-2021-47219: scsi: scsi_debug: Fix out-of-bound read in
resp_report_tgtpgs() (bsc#1222824).
* CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any()
(bsc#1227836).
* CVE-2022-48821: misc: fastrpc: avoid double fput() on failed usercopy
(bsc#1227976).
* CVE-2021-47520: can: pch_can: pch_can_rx_normal: fix use after free
(bsc#1225431).
* CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
(bsc#1226519).
The following non-security bugs were fixed:
* Fix spurious WARNING caused by a qxl driver patch (bsc#1227213)
* NFS: Clean up directory array handling (bsc#1226662).
* NFS: Clean up nfs_readdir_page_filler() (bsc#1226662).
* NFS: Clean up readdir struct nfs_cache_array (bsc#1226662).
* NFS: Do not discard readdir results (bsc#1226662).
* NFS: Do not overfill uncached readdir pages (bsc#1226662).
* NFS: Do not re-read the entire page cache to find the next cookie
(bsc#1226662).
* NFS: Ensure contents of struct nfs_open_dir_context are consistent
(bsc#1226662).
* NFS: Fix up directory verifier races (bsc#1226662).
* NFS: Further optimisations for 'ls -l' (bsc#1226662).
* NFS: More readdir cleanups (bsc#1226662).
* NFS: Reduce number of RPC calls when doing uncached readdir (bsc#1226662).
* NFS: Reduce use of uncached readdir (bsc#1226662).
* NFS: Support larger readdir buffers (bsc#1226662).
* NFS: Use the 64-bit server readdir cookies when possible (bsc#1226662).
* NFSv4.x: by default serialize open/close operations (bsc#1223863
bsc#1227362)
* X.509: Fix the parser of extended key usage for length (bsc#1218820
bsc#1226666).
* nfs: optimise readdir cache page invalidation (bsc#1226662).
* ocfs2: fix DIO failure due to insufficient transaction credits
(bsc#1216834).
* powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
(bsc#1227487).
* powerpc/rtas: clean up includes (bsc#1227487).
## Special Instructions and Notes:
* Please reboot the system after installing this update.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Micro 5.1
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-2893=1
* SUSE Linux Enterprise Micro 5.2
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-2893=1
* SUSE Linux Enterprise Micro for Rancher 5.2
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-2893=1
## Package List:
* SUSE Linux Enterprise Micro 5.1 (nosrc x86_64)
* kernel-rt-5.3.18-150300.178.1
* SUSE Linux Enterprise Micro 5.1 (x86_64)
* kernel-rt-debugsource-5.3.18-150300.178.1
* kernel-rt-debuginfo-5.3.18-150300.178.1
* SUSE Linux Enterprise Micro 5.1 (noarch)
* kernel-source-rt-5.3.18-150300.178.1
* SUSE Linux Enterprise Micro 5.2 (nosrc x86_64)
* kernel-rt-5.3.18-150300.178.1
* SUSE Linux Enterprise Micro 5.2 (x86_64)
* kernel-rt-debugsource-5.3.18-150300.178.1
* kernel-rt-debuginfo-5.3.18-150300.178.1
* SUSE Linux Enterprise Micro 5.2 (noarch)
* kernel-source-rt-5.3.18-150300.178.1
* SUSE Linux Enterprise Micro for Rancher 5.2 (nosrc x86_64)
* kernel-rt-5.3.18-150300.178.1
* SUSE Linux Enterprise Micro for Rancher 5.2 (x86_64)
* kernel-rt-debugsource-5.3.18-150300.178.1
* kernel-rt-debuginfo-5.3.18-150300.178.1
* SUSE Linux Enterprise Micro for Rancher 5.2 (noarch)
* kernel-source-rt-5.3.18-150300.178.1
## References:
* https://www.suse.com/security/cve/CVE-2021-47126.html
* https://www.suse.com/security/cve/CVE-2021-47219.html
* https://www.suse.com/security/cve/CVE-2021-47291.html
* https://www.suse.com/security/cve/CVE-2021-47520.html
* https://www.suse.com/security/cve/CVE-2021-47580.html
* https://www.suse.com/security/cve/CVE-2021-47598.html
* https://www.suse.com/security/cve/CVE-2022-48792.html
* https://www.suse.com/security/cve/CVE-2022-48821.html
* https://www.suse.com/security/cve/CVE-2022-48822.html
* https://www.suse.com/security/cve/CVE-2023-52885.html
* https://www.suse.com/security/cve/CVE-2024-26583.html
* https://www.suse.com/security/cve/CVE-2024-26584.html
* https://www.suse.com/security/cve/CVE-2024-26800.html
* https://www.suse.com/security/cve/CVE-2024-36974.html
* https://www.suse.com/security/cve/CVE-2024-39494.html
* https://www.suse.com/security/cve/CVE-2024-40937.html
* https://www.suse.com/security/cve/CVE-2024-40956.html
* https://www.suse.com/security/cve/CVE-2024-41011.html
* https://www.suse.com/security/cve/CVE-2024-41059.html
* https://www.suse.com/security/cve/CVE-2024-41069.html
* https://www.suse.com/security/cve/CVE-2024-41090.html
* https://www.suse.com/security/cve/CVE-2024-42145.html
* https://bugzilla.suse.com/show_bug.cgi?id=1216834
* https://bugzilla.suse.com/show_bug.cgi?id=1218820
* https://bugzilla.suse.com/show_bug.cgi?id=1220185
* https://bugzilla.suse.com/show_bug.cgi?id=1220186
* https://bugzilla.suse.com/show_bug.cgi?id=1221539
* https://bugzilla.suse.com/show_bug.cgi?id=1222728
* https://bugzilla.suse.com/show_bug.cgi?id=1222824
* https://bugzilla.suse.com/show_bug.cgi?id=1223863
* https://bugzilla.suse.com/show_bug.cgi?id=1224918
* https://bugzilla.suse.com/show_bug.cgi?id=1225431
* https://bugzilla.suse.com/show_bug.cgi?id=1226519
* https://bugzilla.suse.com/show_bug.cgi?id=1226550
* https://bugzilla.suse.com/show_bug.cgi?id=1226574
* https://bugzilla.suse.com/show_bug.cgi?id=1226662
* https://bugzilla.suse.com/show_bug.cgi?id=1226666
* https://bugzilla.suse.com/show_bug.cgi?id=1227213
* https://bugzilla.suse.com/show_bug.cgi?id=1227362
* https://bugzilla.suse.com/show_bug.cgi?id=1227487
* https://bugzilla.suse.com/show_bug.cgi?id=1227716
* https://bugzilla.suse.com/show_bug.cgi?id=1227750
* https://bugzilla.suse.com/show_bug.cgi?id=1227810
* https://bugzilla.suse.com/show_bug.cgi?id=1227836
* https://bugzilla.suse.com/show_bug.cgi?id=1227976
* https://bugzilla.suse.com/show_bug.cgi?id=1228013
* https://bugzilla.suse.com/show_bug.cgi?id=1228040
* https://bugzilla.suse.com/show_bug.cgi?id=1228114
* https://bugzilla.suse.com/show_bug.cgi?id=1228328
* https://bugzilla.suse.com/show_bug.cgi?id=1228561
* https://bugzilla.suse.com/show_bug.cgi?id=1228644
* https://bugzilla.suse.com/show_bug.cgi?id=1228743
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20240813/6af27767/attachment.htm>
More information about the sle-updates
mailing list