Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.5813
Security update for the Linux Kernel
11 November 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: kernel
Publisher: SUSE
Operating System: SUSE
Resolution: Patch/Upgrade
CVE Names: CVE-2022-43750 CVE-2022-28748 CVE-2022-3649
CVE-2022-3646 CVE-2022-3629 CVE-2022-3628
CVE-2022-3621 CVE-2022-3594 CVE-2022-3586
CVE-2022-3565 CVE-2022-3545 CVE-2022-3542
CVE-2022-3524 CVE-2022-3521 CVE-2022-2964
CVE-2022-2153 CVE-2021-4037
Original Bulletin:
https://www.suse.com/support/update/announcement/2022/suse-su-20223930-1
Comment: CVSS (Max): 7.8 CVE-2022-2964 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: SUSE
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:3930-1
Rating: important
References: #1065729 #1198702 #1200788 #1202686 #1202972 #1203387
#1204241 #1204354 #1204355 #1204402 #1204415 #1204431
#1204439 #1204479 #1204574 #1204635 #1204646 #1204647
#1204653 #1204755 #1204868
Cross-References: CVE-2021-4037 CVE-2022-2153 CVE-2022-2964 CVE-2022-3521
CVE-2022-3524 CVE-2022-3542 CVE-2022-3545 CVE-2022-3565
CVE-2022-3586 CVE-2022-3594 CVE-2022-3621 CVE-2022-3628
CVE-2022-3629 CVE-2022-3646 CVE-2022-3649 CVE-2022-43750
Affected Products:
SUSE Linux Enterprise Real Time Extension 12-SP5
______________________________________________________________________________
An update that solves 16 vulnerabilities and has 5 fixes is now available.
Description:
The SUSE Linux Enterprise 12 SP5 kernel RT was updated.
The following security bugs were fixed:
o CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker()
in wifi/brcmfmac (bsc#1204868).
o CVE-2021-4037: Fixed function logic vulnerability that allowed local users
to create files for the XFS file-system with an unintended group ownership
and with group execution and SGID permission bits set (bnc#1198702).
o CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged
local attacker on the host to cause DoS (bnc#1200788).
o CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in
ax88179_178a devices (bnc#1202686 bsc#1196018).
o CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c
(bnc#1204355).
o CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6
handler (bnc#1204354).
o CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/
ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
o CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/
ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
o CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/
l1oip_core.c (bnc#1204431).
o CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow
a local unprivileged user to cause a denial of service (bnc#1204439).
o CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/
net/usb/r8152.c (bnc#1204479).
o CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level
() in fs/nilfs2/inode.c (bnc#1204574).
o CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/
af_vsock.c (bnc#1204635).
o CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/
segment.c (bnc#1204646).
o CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/
inode.c (bnc#1204647).
o CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space
client to corrupt the monitor's internal memory (bnc#1204653).
The following non-security bugs were fixed:
o amd-xgbe: Update DMA coherency values (git-fixes).
o bnxt: do not lock the tx queue from napi poll (git-fixes).
o bnxt_en: Fix RX consumer index logic in the error path (git-fixes).
o bnxt_en: reverse order of TX disable and carrier off (git-fixes).
o ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read()
(git-fixes).
o ftrace: Fix char print issue in print_ip_ins() (git-fixes).
o i40e: Fix flow for IPv6 next header (extension header) (git-fixes).
o i40e: Fix overwriting flow control settings during driver loading
(git-fixes).
o i40e: improve locking of mac_filter_hash (git-fixes).
o input: gscps2 - check return value of ioremap() in gscps2_probe()
(git-fixes).
o input: xpad - add supported devices as contributed on github (git-fixes).
o ip6: fix skb leak in ip6frag_expire_frag_queue (bsc#1202972)
o kABI: Fix after adding trace_iterator.wait_index (git-fixes).
o memcg, kmem: do not fail __GFP_NOFAIL charges (bsc#1204755).
o net/mlx4: Fix EEPROM dump support (git-fixes).
o net/mlx4_core: Add missed mlx4_free_cmd_mailbox() (git-fixes).
o net/mlx5e: Remove dependency in IPsec initialization flows (git-fixes).
o net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning
(git-fixes).
o net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP
(git-fixes).
o net: amd-xgbe: Reset link when the link never comes back (git-fixes).
o net: dsa: mt7530: add the missing RxUnicast MIB counter (git-fixes).
o net: ethernet: ezchip: fix UAF in nps_enet_remove (git-fixes).
o net: lapbether: Prevent racing when checking whether the netif is running
(git-fixes).
o net: marvell: fix MVNETA_TX_IN_PRGRS bit number (git-fixes).
o net: mvpp2: Put fwnode in error case during ->probe() (git-fixes).
o net: stmmac: fix watchdog timeout during suspend/resume stress test
(git-fixes).
o net: stmmac: stop each tx channel independently (git-fixes).
o net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 (git-fixes).
o net: vxge: fix use-after-free in vxge_device_unregister (git-fixes).
o nvmem: core: Check input parameter for NULL in nvmem_unregister() (bsc#
1204241).
o powerpc/mm/64s: Drop pgd_huge() (bsc#1065729).
o powerpc/mm: remove pmd_huge/pud_huge stubs and include hugetlb.h (bsc#
1065729).
o powerpc/pci_dn: Add missing of_node_put() (bsc#1065729).
o powerpc/powernv: add missing of_node_put() in opal_export_attrs() (bsc#
1065729).
o ppp: Fix generating ifname when empty IFLA_IFNAME is specified (git-fixes).
o ppp: Fix generating ppp unit id when ifname is not specified (git-fixes).
o quota: widen timestamps for the fs_disk_quota structure (bsc#1203387).
o r8169: fix jumbo packet handling on RTL8168e (git-fixes).
o revert "niu: fix missing checks of niu_pci_eeprom_read" (git-fixes).
o ring-buffer: Add ring_buffer_wake_waiters() (git-fixes).
o ring-buffer: Check pending waiters when doing wake ups as well (git-fixes).
o ring-buffer: Fix race between reset page and reading page (git-fixes).
o tracing: Add ioctl() to force ring buffer waiters to wake up (git-fixes).
o tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
(git-fixes).
o tracing: Do not free snapshot if tracer is on cmdline (git-fixes).
o tracing: Simplify conditional compilation code in tracing_set_tracer()
(git-fixes).
o tracing: Wake up ring buffer waiters on closing of the file (git-fixes).
o tracing: Wake up waiters when tracing is disabled (git-fixes).
o usb: core: Fix RST error in hub.c (git-fixes).
o usb: serial: ch341: add basis for quirk detection (git-fixes).
o usb: serial: ch341: fix lockup of devices with limited prescaler
(git-fixes).
o usb: serial: ch341: fix lost character on LCR updates (git-fixes).
o usb: serial: ch341: fix receiver regression (git-fixes).
o usb: serial: ch341: reimplement line-speed handling (git-fixes).
o usb: serial: cp210x: add Decagon UCA device id (git-fixes).
o usb: serial: ftdi_sio: add Omron CS1W-CIF31 device id (git-fixes).
o usb: serial: option: add Quectel EM060K modem (git-fixes).
o usb: serial: option: add support for OPPO R11 diag port (git-fixes).
o xfs: account finobt blocks properly in perag reservation (bsc#1203387).
o xfs: enable big timestamps (bsc#1203387).
o xfs: enable new inode btree counters feature (bsc#1203387).
o xfs: explicitly define inode timestamp range (bsc#1203387).
o xfs: preserve default grace interval during quotacheck (bsc#1203387).
o xfs: quota: move to time64_t interfaces (bsc#1203387).
o xfs: redefine xfs_ictimestamp_t (bsc#1203387).
o xfs: redefine xfs_timestamp_t (bsc#1203387).
o xfs: store inode btree block counts in AGI header (bsc#1203387).
o xfs: use a struct timespec64 for the in-core crtime (bsc#1203387).
o xfs: use the finobt block counts to speed up mount times (bsc#1203387).
o xfs: widen ondisk inode timestamps to deal with y2038+ (bsc#1203387).
o xfs: widen ondisk quota expiration timestamps to handle y2038+ (bsc#
1203387).
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Real Time Extension 12-SP5:
zypper in -t patch SUSE-SLE-RT-12-SP5-2022-3930=1
Package List:
o SUSE Linux Enterprise Real Time Extension 12-SP5 (noarch):
kernel-devel-rt-4.12.14-10.106.1
kernel-source-rt-4.12.14-10.106.1
o SUSE Linux Enterprise Real Time Extension 12-SP5 (x86_64):
cluster-md-kmp-rt-4.12.14-10.106.1
cluster-md-kmp-rt-debuginfo-4.12.14-10.106.1
dlm-kmp-rt-4.12.14-10.106.1
dlm-kmp-rt-debuginfo-4.12.14-10.106.1
gfs2-kmp-rt-4.12.14-10.106.1
gfs2-kmp-rt-debuginfo-4.12.14-10.106.1
kernel-rt-4.12.14-10.106.1
kernel-rt-base-4.12.14-10.106.1
kernel-rt-base-debuginfo-4.12.14-10.106.1
kernel-rt-debuginfo-4.12.14-10.106.1
kernel-rt-debugsource-4.12.14-10.106.1
kernel-rt-devel-4.12.14-10.106.1
kernel-rt-devel-debuginfo-4.12.14-10.106.1
kernel-rt_debug-4.12.14-10.106.1
kernel-rt_debug-debuginfo-4.12.14-10.106.1
kernel-rt_debug-debugsource-4.12.14-10.106.1
kernel-rt_debug-devel-4.12.14-10.106.1
kernel-rt_debug-devel-debuginfo-4.12.14-10.106.1
kernel-syms-rt-4.12.14-10.106.1
ocfs2-kmp-rt-4.12.14-10.106.1
ocfs2-kmp-rt-debuginfo-4.12.14-10.106.1
References:
o https://www.suse.com/security/cve/CVE-2021-4037.html
o https://www.suse.com/security/cve/CVE-2022-2153.html
o https://www.suse.com/security/cve/CVE-2022-2964.html
o https://www.suse.com/security/cve/CVE-2022-3521.html
o https://www.suse.com/security/cve/CVE-2022-3524.html
o https://www.suse.com/security/cve/CVE-2022-3542.html
o https://www.suse.com/security/cve/CVE-2022-3545.html
o https://www.suse.com/security/cve/CVE-2022-3565.html
o https://www.suse.com/security/cve/CVE-2022-3586.html
o https://www.suse.com/security/cve/CVE-2022-3594.html
o https://www.suse.com/security/cve/CVE-2022-3621.html
o https://www.suse.com/security/cve/CVE-2022-3628.html
o https://www.suse.com/security/cve/CVE-2022-3629.html
o https://www.suse.com/security/cve/CVE-2022-3646.html
o https://www.suse.com/security/cve/CVE-2022-3649.html
o https://www.suse.com/security/cve/CVE-2022-43750.html
o https://bugzilla.suse.com/1065729
o https://bugzilla.suse.com/1198702
o https://bugzilla.suse.com/1200788
o https://bugzilla.suse.com/1202686
o https://bugzilla.suse.com/1202972
o https://bugzilla.suse.com/1203387
o https://bugzilla.suse.com/1204241
o https://bugzilla.suse.com/1204354
o https://bugzilla.suse.com/1204355
o https://bugzilla.suse.com/1204402
o https://bugzilla.suse.com/1204415
o https://bugzilla.suse.com/1204431
o https://bugzilla.suse.com/1204439
o https://bugzilla.suse.com/1204479
o https://bugzilla.suse.com/1204574
o https://bugzilla.suse.com/1204635
o https://bugzilla.suse.com/1204646
o https://bugzilla.suse.com/1204647
o https://bugzilla.suse.com/1204653
o https://bugzilla.suse.com/1204755
o https://bugzilla.suse.com/1204868
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY23S8MkNZI30y1K9AQgFEQ//XTiKt7CzIC64kYK9vv7CL0+pnBHzw6s8
hJkMsqp1WO1uhOGyMB1VKtNdn+n6RU1nbGg54pP+uyRZx11W3UIvMSOlLYeS+HDT
5B7DHshsBh4YvBJXkr+3SUsToWoZA9Utqm3WgEfhy8wdizazj2ktseFHXZ3X2qCs
qGrH404sSzgU7n7DC+jrS8jo9pix9miLP0LUdpWZ3Ha+yrVAebquPQcZnA2Oq3Vj
YrcvXvAdrEh/9oAlqKcJ2YwmzT3PnxrFIwK8A1pJbitt6Ro091JHJoLOcZCHNwRm
J/p2PuWoSF3L8tNlbQP6SEBYLEkqJ6+ZW73L/9vcJif1K9ah0Q3iMYQfecUo9xk2
cIQ7W5Rr3tT92GhHOHHbJWgNvB9hJvrldQ0ko187l+dPrCF+i6EOiZ9FUtE6J96C
Gc+G0ZZ6P3xvLQlPAr3DyhFqQUOcQEXU2HqxodL6MoSFDRudOyrF7fKBu6YaKjJJ
FFGSDzBPEKUqw4FleyCw3nbTBTmkaXU92vvnORI6e6UIpsUZl9RyC1aLtl6tZhic
CMu3QuVTA6tj19Miy2Aj9Oq58IrzFqhrMcq9c/NSm4nv/hMBx+5jaqL1YTVJV/Ws
vAMzR8rbOrFLddxDNgGZ5CTzKM/MlkPSkoYcKm/D2RLssWA/i7TnAAzZALCqKXBj
TCUvM+arsug=
=9afY
-----END PGP SIGNATURE-----