Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.4791
Security update for the Linux Kernel
28 September 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: linux kernel
Publisher: SUSE
Operating System: SUSE
Resolution: Patch/Upgrade
CVE Names: CVE-2022-39188 CVE-2022-36879 CVE-2022-26373
CVE-2022-21385 CVE-2022-20369 CVE-2022-20368
CVE-2022-3028 CVE-2022-2977 CVE-2022-2663
CVE-2022-2588 CVE-2021-4203
Original Bulletin:
https://www.suse.com/support/update/announcement/2022/suse-su-20223422-1
Comment: CVSS (Max): 7.8 CVE-2022-2588 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: SUSE
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:3422-1
Rating: important
References: #1054914 #1065729 #1120716 #1179310 #1190397 #1191881
#1194535 #1197158 #1199617 #1201264 #1201420 #1201442
#1201610 #1201726 #1201948 #1202017 #1202096 #1202097
#1202346 #1202347 #1202393 #1202396 #1202528 #1202577
#1202672 #1202830 #1202897 #1202898 #1203013 #1203098
#1203107 #1203126
Cross-References: CVE-2021-4203 CVE-2022-20368 CVE-2022-20369 CVE-2022-21385
CVE-2022-2588 CVE-2022-26373 CVE-2022-2663 CVE-2022-2977
CVE-2022-3028 CVE-2022-36879 CVE-2022-39188
Affected Products:
SUSE Linux Enterprise Real Time Extension 12-SP5
______________________________________________________________________________
An update that solves 11 vulnerabilities and has 21 fixes is now available.
Description:
The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various
security and bugfixes.
The following security bugs were fixed:
o CVE-2021-4203: Fixed use-after-free read flaw that was found in
sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS
race with listen() (bnc#1194535).
o CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#
1202346).
o CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of
v4l2-mem2mem.c (bnc#1202347).
o CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed
unprivileged local users to crash the machine (bnc#1202897).
o CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
o CVE-2022-26373: Fixed non-transparent sharing of return predictor targets
between contexts in some Intel Processors (bnc#1201726).
o CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the
message handling could be confused and incorrectly matches the message (bnc
#1202097).
o CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
o CVE-2022-3028: Fixed race condition that was found in the IP framework for
transforming packets (XFRM subsystem) (bnc#1202898).
o CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/
xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
o CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a
device driver can free a page while it still has stale TLB entries (bnc#
1203107).
The following non-security bugs were fixed:
o 9p: migrate from sync_inode to filemap_fdatawrite_wbc (bsc#1202528).
o ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
o Fix releasing of old bundles in xfrm_bundle_lookup() (bsc#1201264 bsc#
1190397 bsc#1199617).
o KABI: cgroup: Restore KABI of css_set (bsc#1201610).
o KVM: PPC: Book3S HV: Context tracking exit guest context before enabling
irqs (bsc#1065729).
o KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#
1201442)
o KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP (bsc#1120716).
o KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
(git-fixes).
o KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
(git-fixes).
o PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors (git-fixes).
o Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST
quirk set" (git-fixes).
o Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
(git-fixes).
o SUNRPC: Fix the svc_deferred_event trace class (git-fixes).
o USB: new quirk for Dell Gen 2 devices (git-fixes).
o USB: serial: io_ti: add Agilent E5805A support (git-fixes).
o ata: libata: add qc->flags in ata_qc_complete_template tracepoint
(git-fixes).
o btrfs: Convert fs_info->free_chunk_space to atomic64_t (bsc#1202528).
o btrfs: add a trace class for dumping the current ENOSPC state (bsc#
1202528).
o btrfs: add a trace point for reserve tickets (bsc#1202528).
o btrfs: adjust the flush trace point to include the source (bsc#1202528).
o btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1202528).
o btrfs: check worker before need_preemptive_reclaim (bsc#1202528).
o btrfs: do not do preemptive flushing if the majority is global rsv (bsc#
1202528).
o btrfs: do not include the global rsv size in the preemptive used amount
(bsc#1202528).
o btrfs: enable a tracepoint when we fail tickets (bsc#1202528).
o btrfs: handle preemptive delalloc flushing slightly differently (bsc#
1202528).
o btrfs: implement space clamping for preemptive flushing (bsc#1202528).
o btrfs: improve preemptive background space flushing (bsc#1202528).
o btrfs: include delalloc related info in dump space info tracepoint (bsc#
1202528).
o btrfs: introduce a FORCE_COMMIT_TRANS flush operation (bsc#1202528).
o btrfs: make flush_space take a enum btrfs_flush_state instead of int (bsc#
1202528).
o btrfs: only clamp the first time we have to start flushing (bsc#1202528).
o btrfs: only ignore delalloc if delalloc is much smaller than ordered (bsc#
1202528).
o btrfs: reduce the preemptive flushing threshold to 90% (bsc#1202528).
o btrfs: remove FLUSH_DELAYED_REFS from data ENOSPC flushing (bsc#1202528).
o btrfs: rename need_do_async_reclaim (bsc#1202528).
o btrfs: rework btrfs_calc_reclaim_metadata_size (bsc#1202528).
o btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1202528).
o btrfs: rip out may_commit_transaction (bsc#1202528).
o btrfs: rip the first_ticket_bytes logic from fail_all_tickets (bsc#
1202528).
o btrfs: simplify the logic in need_preemptive_flushing (bsc#1202528).
o btrfs: take into account global rsv in need_preemptive_reclaim (bsc#
1202528).
o btrfs: use delalloc_bytes to determine flush amount for shrink_delalloc
(bsc#1202528).
o btrfs: use percpu_read_positive instead of sum_positive for need_preempt
(bsc#1202528).
o btrfs: use the filemap_fdatawrite_wbc helper for delalloc shrinking (bsc#
1202528).
o btrfs: use the global rsv size in the preemptive thresh calculation (bsc#
1202528).
o btrfs: wait on async extents when flushing delalloc (bsc#1202528).
o btrfs: wake up async_delalloc_pages waiters after submit (bsc#1202528).
o ceph: do not truncate file in atomic_open (bsc#1202830).
o cgroup: Use separate src/dst nodes when preloading css_sets for migration
(bsc#1201610).
o check sk_peer_cred pointer before put_cred() call
o crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE (git-fixes).
o crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of (git-fixes).
o cxgb4: fix endian conversions for L4 ports in filters (git-fixes).
o cxgb4: move handling L2T ARP failures to caller (git-fixes).
o cxgb4: parse TC-U32 key values and masks natively (git-fixes).
o drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX (git-fixes).
o fs: add a filemap_fdatawrite_wbc helper (bsc#1202528).
o fuse: limit nsec (bsc#1203126).
o iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
(git-fixes).
o ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback (git-fixes).
o kabi/severities: add mlx5 internal symbols
o lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420
ZDI-CAN-17325).
o md/bitmap: do not set sb values if can't pass sanity check (bsc#1197158).
o mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc#
1203098).
o mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes,
bsc#1203098).
o mvpp2: fix panic on module removal (git-fixes).
o mvpp2: refactor the HW checksum setup (git-fixes).
o net/mlx5: Clear LAG notifier pointer after unregister (git-fixes).
o net/mlx5: Fix auto group size calculation (git-fixes).
o net/mlx5: Imply MLXFW in mlx5_core (git-fixes).
o net/mlx5e: Use the inner headers to determine tc/pedit offload limitation
on decap flows (git-fixes).
o net: dsa: mt7530: Change the LINK bit to reflect the link status
(git-fixes).
o net: emaclite: Simplify if-else statements (git-fixes).
o net: ll_temac: Add more error handling of dma_map_single() calls
(git-fixes).
o net: ll_temac: Enable DMA when ready, not before (git-fixes).
o net: ll_temac: Fix RX buffer descriptor handling on GFP_ATOMIC pressure
(git-fixes).
o net: ll_temac: Fix iommu/swiotlb leak (git-fixes).
o net: ll_temac: Fix support for 64-bit platforms (git-fixes).
o net: ll_temac: Fix support for little-endian platforms (git-fixes).
o net: ll_temac: Fix typo bug for 32-bit (git-fixes).
o net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale
pointer (git-fixes).
o net: stmmac: gmac4: bitrev32 returns u32 (git-fixes).
o net: usb: lan78xx: Connect PHY before registering MAC (git-fixes).
o net: xilinx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop
profiles (git-fixes).
o net_sched: cls_route: disallow handle of 0 (bsc#1202393).
o objtool: Add --backtrace support (bsc#1202396).
o objtool: Add support for intra-function calls (bsc#1202396).
o objtool: Allow no-op CFI ops in alternatives (bsc#1202396).
o objtool: Convert insn type to enum (bsc#1202396).
o objtool: Do not use ignore flag for fake jumps (bsc#1202396).
o objtool: Fix !CFI insn_state propagation (bsc#1202396).
o objtool: Fix ORC vs alternatives (bsc#1202396).
o objtool: Fix sibling call detection (bsc#1202396).
o objtool: Make handle_insn_ops() unconditional (bsc#1202396).
o objtool: Remove INSN_STACK (bsc#1202396).
o objtool: Remove check preventing branches within alternative (bsc#1202396).
o objtool: Rename elf_open() to prevent conflict with libelf from
elftoolchain (bsc#1202396).
o objtool: Rename struct cfi_state (bsc#1202396).
o objtool: Rework allocating stack_ops on decode (bsc#1202396).
o objtool: Rewrite alt->skip_orig (bsc#1202396).
o objtool: Set insn->func for alternatives (bsc#1202396).
o objtool: Support conditional retpolines (bsc#1202396).
o objtool: Support multiple stack_op per instruction (bsc#1202396).
o objtool: Track original function across branches (bsc#1202396).
o objtool: Uniquely identify alternative instruction groups (bsc#1202396).
o objtool: Use Elf_Scn typedef instead of assuming struct name (bsc#1202396).
o phy: tegra: fix device-tree node lookups (git-fixes).
o powerpc/perf: Add privileged access check for thread_imc (bsc#1054914,
git-fixes).
o powerpc/perf: Fix loop exit condition in nest_imc_event_init (bsc#1054914,
git-fixes).
o powerpc/perf: Return accordingly on invalid chip-id in (bsc#1054914,
git-fixes).
o powerpc/xive: Fix refcount leak in xive_get_max_prio (git-fixess).
o powerpc: Enable execve syscall exit tracepoint (bsc#1065729).
o powerpc: Use sizeof(*foo) rather than sizeof(struct foo) (bsc#1054914,
git-fixes).
o powerpc: define get_cycles macro for arch-override (bsc#1065729).
o qed: Add EDPM mode type for user-fw compatibility (git-fixes).
o qed: fix kABI in qed_rdma_create_qp_in_params (git-fixes).
o scsi: smartpqi: set force_blk_mq=1.(bsc#1179310)
o spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
(git-fixes).
o squashfs: add more sanity checks in id lookup (git-fixes).
o squashfs: add more sanity checks in inode lookup (git-fixes).
o squashfs: add more sanity checks in xattr id lookup (git-fixes).
o squashfs: fix divide error in calculate_skip() (git-fixes).
o squashfs: fix inode lookup sanity checks (bsc#1203013).
o squashfs: fix xattr id and id lookup sanity checks (bsc#1203013).
o tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
(git-fixes).
o tracing/perf: Use strndup_user() instead of buggy open-coded version
(git-fixes).
o tracing/uprobes: Check the return value of kstrdup() for tu->filename
(git-fixes).
o tracing: Fix race in perf_trace_buf initialization (git-fixes).
o usb: misc: fix improper handling of refcount in uss720_probe() (git-fixes).
o usbnet: Fix linkwatch use-after-free on disconnect (git-fixes).
o usbnet: smsc95xx: Fix deadlock on runtime resume (git-fixes).
o xen/xenbus: fix return type in xenbus_file_read() (git-fixes).
o xfs: always free inline data before resetting inode fork during ifree (bsc#
1202017).
o xfs: check sb_meta_uuid for dabuf buffer recovery (bsc#1202577).
o xprtrdma: Fix trace point use-after-free race (git-fixes).
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Real Time Extension 12-SP5:
zypper in -t patch SUSE-SLE-RT-12-SP5-2022-3422=1
Package List:
o SUSE Linux Enterprise Real Time Extension 12-SP5 (x86_64):
cluster-md-kmp-rt-4.12.14-10.100.1
cluster-md-kmp-rt-debuginfo-4.12.14-10.100.1
dlm-kmp-rt-4.12.14-10.100.1
dlm-kmp-rt-debuginfo-4.12.14-10.100.1
gfs2-kmp-rt-4.12.14-10.100.1
gfs2-kmp-rt-debuginfo-4.12.14-10.100.1
kernel-rt-4.12.14-10.100.1
kernel-rt-base-4.12.14-10.100.1
kernel-rt-base-debuginfo-4.12.14-10.100.1
kernel-rt-debuginfo-4.12.14-10.100.1
kernel-rt-debugsource-4.12.14-10.100.1
kernel-rt-devel-4.12.14-10.100.1
kernel-rt-devel-debuginfo-4.12.14-10.100.1
kernel-rt_debug-4.12.14-10.100.1
kernel-rt_debug-debuginfo-4.12.14-10.100.1
kernel-rt_debug-debugsource-4.12.14-10.100.1
kernel-rt_debug-devel-4.12.14-10.100.1
kernel-rt_debug-devel-debuginfo-4.12.14-10.100.1
kernel-syms-rt-4.12.14-10.100.1
ocfs2-kmp-rt-4.12.14-10.100.1
ocfs2-kmp-rt-debuginfo-4.12.14-10.100.1
o SUSE Linux Enterprise Real Time Extension 12-SP5 (noarch):
kernel-devel-rt-4.12.14-10.100.1
kernel-source-rt-4.12.14-10.100.1
References:
o https://www.suse.com/security/cve/CVE-2021-4203.html
o https://www.suse.com/security/cve/CVE-2022-20368.html
o https://www.suse.com/security/cve/CVE-2022-20369.html
o https://www.suse.com/security/cve/CVE-2022-21385.html
o https://www.suse.com/security/cve/CVE-2022-2588.html
o https://www.suse.com/security/cve/CVE-2022-26373.html
o https://www.suse.com/security/cve/CVE-2022-2663.html
o https://www.suse.com/security/cve/CVE-2022-2977.html
o https://www.suse.com/security/cve/CVE-2022-3028.html
o https://www.suse.com/security/cve/CVE-2022-36879.html
o https://www.suse.com/security/cve/CVE-2022-39188.html
o https://bugzilla.suse.com/1054914
o https://bugzilla.suse.com/1065729
o https://bugzilla.suse.com/1120716
o https://bugzilla.suse.com/1179310
o https://bugzilla.suse.com/1190397
o https://bugzilla.suse.com/1191881
o https://bugzilla.suse.com/1194535
o https://bugzilla.suse.com/1197158
o https://bugzilla.suse.com/1199617
o https://bugzilla.suse.com/1201264
o https://bugzilla.suse.com/1201420
o https://bugzilla.suse.com/1201442
o https://bugzilla.suse.com/1201610
o https://bugzilla.suse.com/1201726
o https://bugzilla.suse.com/1201948
o https://bugzilla.suse.com/1202017
o https://bugzilla.suse.com/1202096
o https://bugzilla.suse.com/1202097
o https://bugzilla.suse.com/1202346
o https://bugzilla.suse.com/1202347
o https://bugzilla.suse.com/1202393
o https://bugzilla.suse.com/1202396
o https://bugzilla.suse.com/1202528
o https://bugzilla.suse.com/1202577
o https://bugzilla.suse.com/1202672
o https://bugzilla.suse.com/1202830
o https://bugzilla.suse.com/1202897
o https://bugzilla.suse.com/1202898
o https://bugzilla.suse.com/1203013
o https://bugzilla.suse.com/1203098
o https://bugzilla.suse.com/1203107
o https://bugzilla.suse.com/1203126
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBYzOwsskNZI30y1K9AQjSQw//eoMtMRwCerS+QhQUw5d7sVuWzbFeNhD2
n+vbUHurN5g5AZhNxH2ew7jDUwCx88ykpVm+Xtf4E4PSP4ZJ4nupcT1221Tlty9G
EPSgWjuZKNhov+3uCoq2tb+zvIRCkM++K0EeiF7oY8mLNMgZBfJg29Y9PKiAJGqy
QKUWnIRNvhM+FmLvRe6q8iTeoHKssqpJKgxt7lF9vOCgbzzF1br4H8MLsyobt1C1
cpjfl+GyWCWBY/UtuDvxOQadpg9jzrjVXOeu8yvLUV/A/CKq/xVGmav5GCsoWVcv
cLLxPOuZ7/XruT+g+9s3hk/yFbg5rqT0kF3AE6UL5nx3K2uFkh1rCVyzMH8deWAr
GtguztDzBrZC+EQgaZ/D3Xuzp5uttSfRgTxzKx87ZEdIoKMyCnrGX95dG4sx+OgP
5V7j6nUvklJz1DRg7GQXauqoMd7y0e3kInOAGwX8RdUQY3+qTLlHKpZx2uh6U/4T
TGO9BBdjwNrjluPIUeBlMVlRNmKrmfVXnWe/1Z52/vS9JiYIxcOT8hxROk1F3Clw
U+D9Sgwulr8uihUtNPxZFUl5XsF66yhNjKo9D5qlpXGf9TpWA3wtQx8VjWrjuEIG
SCBoNzyaXqEN9IrWi21IjHmkbpzYju0IM1wlWopU5/nhgQR+LqkHRcs6Y86zMuTN
2TnI/UMjaLM=
=UZtP
-----END PGP SIGNATURE-----