SUSE-SU-2021:3206-1

SUSE-SU-2021:3206-1 · Security update for the Linux Kernel

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

На странице показана часть фактов из источников. Полное описание и список затронутых версий приведены в связанных бюллетенях.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488). - CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace applications (bnc#1129898). - CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx() (bnc#1133374). - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth stack (bsc#1188172). - CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable AVIC support for the L2 guest. (bsc#1189399). - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400). - CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057). - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706). - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025). - CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks (bsc#1190115). - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117) - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault (bnc#1189262). - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations (bnc#1189291). - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program that could have obtain sensitive information from kernel memory (bsc#1188983). - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of arbitrary kernel memory (bsc#1188985). - CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420). The following non-security bugs were fixed: - ACPI: NFIT: Fix support for virtual SPA ranges (git-fixes). - ALSA: seq: Fix racy deletion of subscriber (git-fixes). - ASoC: cs42l42: Do not allow SND_SOC_DAIFMT_LEFT_J (git-fixes). - ASoC: cs42l42: Fix inversion of ADC Notch Switch control (git-fixes). - ASoC: cs42l42: Remove duplicate control for WNF filter frequency (git-fixes). - Bluetooth: Move shutdown callback before flushing tx and rx queue (git-fixes). - Bluetooth: add timeout sanity check to hci_inquiry (git-fixes). - Bluetooth: fix repeated calls to sco_sock_kill (git-fixes). - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow (git-fixes). - Bluetooth: sco: prevent information leak in sco_conn_defer_accept() (git-fixes). - KVM: SVM: Call SEV Guest Decommission if ASID binding fails (12sp5). - NFSv4/pNFS: Do not call _nfs4_pnfs_v3_ds_connect multiple times (git-fixes). - NFSv4: Initialise connection to the server in nfs4_alloc_client() (bsc#1040364). - PCI/MSI: Correct misleading comments (git-fixes). - PCI/MSI: Do not set invalid bits in MSI mask (git-fixes). - PCI/MSI: Enable and mask MSI-X early (git-fixes). - PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() (git-fixes). - PCI: Add Intel VMD devices to pci ids (bsc#1183983). - PCI: PM: Enable PME if it can be signaled from D3cold (git-fixes). - PCI: hv: Use expected affinity when unmasking IRQ (bsc#1185973). - PCI: vmd: Add an additional VMD device id to driver device id table (bsc#1183983). - PCI: vmd: Add offset to bus numbers if necessary (bsc#1183983). - PCI: vmd: Assign membar addresses from shadow registers (bsc#1183983). - PCI: vmd: Filter resource type bits from shadow register (bsc#1183983). - PCI: vmd: Fix config addressing when using bus offsets (bsc#1183983). - PCI: vmd: Fix shadow offsets to reflect spec changes (bsc#1183983). - SUNRPC: Fix the batch tasks count wraparound (git-fixes). - SUNRPC: Should wake up the privileged task firstly (git-fixes). - SUNRPC: improve error response to over-size gss credential (bsc#1190022). - USB: serial: ch341: fix character loss at high transfer rates (git-fixes). - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 (git-fixes). - USB: serial: option: add Telit FD980 composition 0x1056 (git-fixes). - USB: usbtmc: Fix RCU stall warning (git-fixes). - USB:ehci:fix Kunpeng920 ehci hardware problem (git-fixes). - arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback (git-fixes). - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() (git-fixes). - ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 (git-fixes). - bcma: Fix memory leak for internally-handled cores (git-fixes). - bdi: Do not use freezable workqueue (bsc#1189573). - blk-mq-sched: Fix blk_mq_sched_alloc_tags() error handling (bsc#1189506). - block: fix trace completion for chained bio (bsc#1189505). - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters (git-fixes). - cifs: Remove unused inline function is_sysvol_or_netlogon() (bsc#1185902). - cifs: avoid starvation when refreshing dfs cache (bsc#1185902). - cifs: constify get_normalized_path() properly (bsc#1185902). - cifs: do not cargo-cult strndup() (bsc#1185902). - cifs: do not send tree disconnect to ipc shares (bsc#1185902). - cifs: do not share tcp servers with dfs mounts (bsc#1185902). - cifs: do not share tcp sessions of dfs connections (bsc#1185902). - cifs: fix check of dfs interlinks (bsc#1185902). - cifs: fix path comparison and hash calc (bsc#1185902). - cifs: get rid of @noreq param in __dfs_cache_find() (bsc#1185902). - cifs: handle different charsets in dfs cache (bsc#1185902). - cifs: keep referral server sessions alive (bsc#1185902). - cifs: missing null pointer check in cifs_mount (bsc#1185902). - cifs: prevent NULL deref in cifs_compose_mount_options() (bsc#1185902). - cifs: set a minimum of 2 minutes for refreshing dfs cache (bsc#1185902). - clk: stm32f4: fix post divisor setup for I2S/SAI PLLs (git-fixes). - crypto: ccp - Annotate SEV Firmware file names (bsc#1189268). - crypto: nx - Fix RCU warning in nx842_OF_upd_status (git-fixes). - crypto: nx - Fix memcpy() over-reading in nonce (git-fixes). - crypto: talitos - Do not modify req->cryptlen on decryption (git-fixes). - crypto: talitos - fix ECB algs ivsize (git-fixes). - crypto: ux500 - Fix error return code in hash_hw_final() (git-fixes). - dm btree remove: assign new_root only when removal succeeds (git fixes). - dm cache metadata: Avoid returning cmd->bm wild pointer on error (git fixes). - dm era: Fix bitset memory leaks (git fixes). - dm era: Recover committed writeset after crash (git fixes). - dm era: Reinitialize bitset cache before digesting a new writeset (git fixes). - dm era: Use correct value size in equality function of writeset tree (git fixes). - dm era: Verify the data block size hasn't changed (git fixes). - dm era: only resize metadata in preresume (git fixes). - dm ioctl: fix error return code in target_message (git fixes). - dm ioctl: fix out of bounds array access when no devices (git fixes). - dm persistent data: packed struct should have an aligned() attribute too (git fixes). - dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (git fixes). - dm snapshot: fix crash with transient storage and zero chunk size (git fixes). - dm snapshot: flush merged data before committing metadata (git fixes). - dm snapshot:

Есть исправление

Опубликовано

2021-09-23T14:17:20Z

Обновлено

2025-05-02T04:30:01.943991Z

Стек: system

Проверьте свой сервер →