-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.0589
                   Security update for the Linux Kernel
                             17 February 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Linux Kernel
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Root Compromise                 -- Existing Account      
                   Access Privileged Data          -- Existing Account      
                   Denial of Service               -- Existing Account      
                   Unauthorised Access             -- Existing Account      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2021-3347 CVE-2020-36158 CVE-2020-29661
                   CVE-2020-29660 CVE-2020-28974 CVE-2020-28915
                   CVE-2020-27786 CVE-2020-27777 CVE-2020-27068
                   CVE-2020-25669 CVE-2020-25668 CVE-2020-25656
                   CVE-2020-25643 CVE-2020-25285 CVE-2020-25284
                   CVE-2020-25211 CVE-2020-15437 CVE-2020-15436
                   CVE-2020-14390 CVE-2020-14381 CVE-2020-14353
                   CVE-2020-14331 CVE-2020-11668 CVE-2020-4788
                   CVE-2020-0465 CVE-2020-0431 CVE-2020-0404
                   CVE-2019-20934 CVE-2019-16746 CVE-2017-18270

Reference:         ESB-2021.0565
                   ESB-2021.0553
                   ESB-2021.0534

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2021/suse-su-202114630-1

- --------------------------BEGIN INCLUDED TEXT--------------------

SUSE Security Update: Security update for the Linux Kernel

______________________________________________________________________________

Announcement ID:   SUSE-SU-2021:14630-1
Rating:            important
References:        #1152107 #1168952 #1173659 #1173942 #1174205 #1174247
                   #1174993 #1175691 #1176011 #1176012 #1176235 #1176253
                   #1176278 #1176395 #1176423 #1176482 #1176485 #1176722
                   #1176896 #1177206 #1177226 #1177666 #1177766 #1177906
                   #1178123 #1178182 #1178589 #1178590 #1178622 #1178886
                   #1179107 #1179140 #1179141 #1179419 #1179601 #1179616
                   #1179745 #1179877 #1180029 #1180030 #1180052 #1180086
                   #1180559 #1180562 #1181158 #1181166 #1181349 #1181553
Cross-References:  CVE-2019-16746 CVE-2020-0404 CVE-2020-0431 CVE-2020-0465
                   CVE-2020-11668 CVE-2020-14331 CVE-2020-14353 CVE-2020-14381
                   CVE-2020-14390 CVE-2020-15436 CVE-2020-15437 CVE-2020-25211
                   CVE-2020-25284 CVE-2020-25285 CVE-2020-25643 CVE-2020-25656
                   CVE-2020-25668 CVE-2020-25669 CVE-2020-27068 CVE-2020-27777
                   CVE-2020-27786 CVE-2020-28915 CVE-2020-28974 CVE-2020-29660
                   CVE-2020-29661 CVE-2020-36158 CVE-2020-4788 CVE-2021-3347
Affected Products:
                   SUSE Linux Enterprise Server 11-SP4-LTSS
                   SUSE Linux Enterprise Server 11-EXTRA
                   SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

An update that solves 28 vulnerabilities and has 20 fixes is now available.

Description:

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security
and bugfixes.

The following security bugs were fixed:


  o CVE-2021-3347: A use-after-free was discovered in the PI futexes during
    fault handling, allowing local users to execute code in the kernel (bnc#
    1181349).
  o CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c
    that could have led to local privilege escalation (bnc#1180029).
  o CVE-2020-25211: Fixed a flaw where a local attacker was able to inject
    conntrack netlink configuration that could cause a denial of service or
    trigger the use of incorrect protocol numbers in
    ctnetlink_parse_tuple_filter (bnc#1176395).
  o CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory
    corruption or a denial of service when changing screen size (bnc#1176235).
  o CVE-2020-25284: Fixed an incomplete permission checking for access to rbd
    devices, which could have been leveraged by local attackers to map or unmap
    rbd block devices (bsc#1176482).
  o CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c
    which could have allowed local users to gain privileges or cause a denial
    of service (bsc#1179141).
  o CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#
    1174205).
  o CVE-2020-14353: Fixed an issue where keys - for keyctl prevent creating a
    different user's keyrings (bsc#1174993).
  o CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping
    the references (bsc#1176011).
  o CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check
    in the nl80211_policy policy of nl80211.c (bnc#1180086).
  o CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction
    Services (RTAS) interface, affecting guests running on top of PowerVM or
    KVM hypervisors (bnc#1179107).
  o CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation
    (bnc#1179601).
  o CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may
    have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
  o CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a
    use-after-free attack against TIOCSPGRP (bsc#1179745).
  o CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have
    been used by local attackers to read privileged information or potentially
    crash the kernel (bsc#1178589).
  o CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have
    been used by local attackers to read kernel memory (bsc#1178886).
  o CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#
    1178182).
  o CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/
    hugetlb.c could be used by local attackers to corrupt memory, cause a NULL
    pointer dereference, or possibly have unspecified other impact (bnc#1176485
    ).
  o CVE-2020-15437: Fixed a null pointer dereference which could have allowed
    local users to cause a denial of service (bsc#1179140).
  o CVE-2020-36158: Fixed a potential remote code execution in the Marvell
    mwifiex driver (bsc#1180559).
  o CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink
    camera USB driver (bnc#1168952).
  o CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
  o CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed
    a local user to obtain sensitive information from the data in the L1 cache
    under extenuating circumstances (bsc#1177666).
  o CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check
    (bsc#1176722).
  o CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause
    (bsc#1176423).
  o CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA
    fault statistics were inappropriately freed (bsc#1179663).
  o CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl
    (bnc#1177766).
  o CVE-2020-25643: Fixed a memory corruption and a read overflow which could
    have caused by improper input validation in the ppp_cp_parse_cr function
    (bsc#1177206).
  o CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#
    1173659).


The following non-security bugs were fixed:

  o HID: Fix slab-out-of-bounds read in hid_field_extract (bsc#1180052).
  o cifs: bugfix for unreclaimed writeback pages in cifs_writev_requeue() (bsc#
    1177906).
  o mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#
    1175691).
  o net/x25: fix a race in x25_bind() (bsc#1178590).
  o net/x25: prevent a couple of overflows (bsc#1178590).
  o tty: fix memleak in alloc_pid (bsc#1179745).
  o xfs: mark all internal workqueues as freezable (bsc#1181166).

Special Instructions and Notes:

Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Server 11-SP4-LTSS:
    zypper in -t patch slessp4-kernel-source-14630=1
  o SUSE Linux Enterprise Server 11-EXTRA:
    zypper in -t patch slexsp3-kernel-source-14630=1
  o SUSE Linux Enterprise Debuginfo 11-SP4:
    zypper in -t patch dbgsp4-kernel-source-14630=1

Package List:

  o SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64):
       kernel-default-3.0.101-108.120.1
       kernel-default-base-3.0.101-108.120.1
       kernel-default-devel-3.0.101-108.120.1
       kernel-source-3.0.101-108.120.1
       kernel-syms-3.0.101-108.120.1
       kernel-trace-3.0.101-108.120.1
       kernel-trace-base-3.0.101-108.120.1
       kernel-trace-devel-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-SP4-LTSS (i586 x86_64):
       kernel-ec2-3.0.101-108.120.1
       kernel-ec2-base-3.0.101-108.120.1
       kernel-ec2-devel-3.0.101-108.120.1
       kernel-xen-3.0.101-108.120.1
       kernel-xen-base-3.0.101-108.120.1
       kernel-xen-devel-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-SP4-LTSS (ppc64):
       kernel-bigmem-3.0.101-108.120.1
       kernel-bigmem-base-3.0.101-108.120.1
       kernel-bigmem-devel-3.0.101-108.120.1
       kernel-ppc64-3.0.101-108.120.1
       kernel-ppc64-base-3.0.101-108.120.1
       kernel-ppc64-devel-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-SP4-LTSS (s390x):
       kernel-default-man-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-SP4-LTSS (i586):
       kernel-pae-3.0.101-108.120.1
       kernel-pae-base-3.0.101-108.120.1
       kernel-pae-devel-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64):
       kernel-default-extra-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64):
       kernel-xen-extra-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-EXTRA (x86_64):
       kernel-trace-extra-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-EXTRA (ppc64):
       kernel-ppc64-extra-3.0.101-108.120.1
  o SUSE Linux Enterprise Server 11-EXTRA (i586):
       kernel-pae-extra-3.0.101-108.120.1
  o SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):
       kernel-default-debuginfo-3.0.101-108.120.1
       kernel-default-debugsource-3.0.101-108.120.1
       kernel-trace-debuginfo-3.0.101-108.120.1
       kernel-trace-debugsource-3.0.101-108.120.1
  o SUSE Linux Enterprise Debuginfo 11-SP4 (i586 s390x x86_64):
       kernel-default-devel-debuginfo-3.0.101-108.120.1
       kernel-trace-devel-debuginfo-3.0.101-108.120.1
  o SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64):
       kernel-ec2-debuginfo-3.0.101-108.120.1
       kernel-ec2-debugsource-3.0.101-108.120.1
       kernel-xen-debuginfo-3.0.101-108.120.1
       kernel-xen-debugsource-3.0.101-108.120.1
       kernel-xen-devel-debuginfo-3.0.101-108.120.1
  o SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64):
       kernel-bigmem-debuginfo-3.0.101-108.120.1
       kernel-bigmem-debugsource-3.0.101-108.120.1
       kernel-ppc64-debuginfo-3.0.101-108.120.1
       kernel-ppc64-debugsource-3.0.101-108.120.1
  o SUSE Linux Enterprise Debuginfo 11-SP4 (i586):
       kernel-pae-debuginfo-3.0.101-108.120.1
       kernel-pae-debugsource-3.0.101-108.120.1
       kernel-pae-devel-debuginfo-3.0.101-108.120.1


References:

  o https://www.suse.com/security/cve/CVE-2019-16746.html
  o https://www.suse.com/security/cve/CVE-2020-0404.html
  o https://www.suse.com/security/cve/CVE-2020-0431.html
  o https://www.suse.com/security/cve/CVE-2020-0465.html
  o https://www.suse.com/security/cve/CVE-2020-11668.html
  o https://www.suse.com/security/cve/CVE-2020-14331.html
  o https://www.suse.com/security/cve/CVE-2020-14353.html
  o https://www.suse.com/security/cve/CVE-2020-14381.html
  o https://www.suse.com/security/cve/CVE-2020-14390.html
  o https://www.suse.com/security/cve/CVE-2020-15436.html
  o https://www.suse.com/security/cve/CVE-2020-15437.html
  o https://www.suse.com/security/cve/CVE-2020-25211.html
  o https://www.suse.com/security/cve/CVE-2020-25284.html
  o https://www.suse.com/security/cve/CVE-2020-25285.html
  o https://www.suse.com/security/cve/CVE-2020-25643.html
  o https://www.suse.com/security/cve/CVE-2020-25656.html
  o https://www.suse.com/security/cve/CVE-2020-25668.html
  o https://www.suse.com/security/cve/CVE-2020-25669.html
  o https://www.suse.com/security/cve/CVE-2020-27068.html
  o https://www.suse.com/security/cve/CVE-2020-27777.html
  o https://www.suse.com/security/cve/CVE-2020-27786.html
  o https://www.suse.com/security/cve/CVE-2020-28915.html
  o https://www.suse.com/security/cve/CVE-2020-28974.html
  o https://www.suse.com/security/cve/CVE-2020-29660.html
  o https://www.suse.com/security/cve/CVE-2020-29661.html
  o https://www.suse.com/security/cve/CVE-2020-36158.html
  o https://www.suse.com/security/cve/CVE-2020-4788.html
  o https://www.suse.com/security/cve/CVE-2021-3347.html
  o https://bugzilla.suse.com/1152107
  o https://bugzilla.suse.com/1168952
  o https://bugzilla.suse.com/1173659
  o https://bugzilla.suse.com/1173942
  o https://bugzilla.suse.com/1174205
  o https://bugzilla.suse.com/1174247
  o https://bugzilla.suse.com/1174993
  o https://bugzilla.suse.com/1175691
  o https://bugzilla.suse.com/1176011
  o https://bugzilla.suse.com/1176012
  o https://bugzilla.suse.com/1176235
  o https://bugzilla.suse.com/1176253
  o https://bugzilla.suse.com/1176278
  o https://bugzilla.suse.com/1176395
  o https://bugzilla.suse.com/1176423
  o https://bugzilla.suse.com/1176482
  o https://bugzilla.suse.com/1176485
  o https://bugzilla.suse.com/1176722
  o https://bugzilla.suse.com/1176896
  o https://bugzilla.suse.com/1177206
  o https://bugzilla.suse.com/1177226
  o https://bugzilla.suse.com/1177666
  o https://bugzilla.suse.com/1177766
  o https://bugzilla.suse.com/1177906
  o https://bugzilla.suse.com/1178123
  o https://bugzilla.suse.com/1178182
  o https://bugzilla.suse.com/1178589
  o https://bugzilla.suse.com/1178590
  o https://bugzilla.suse.com/1178622
  o https://bugzilla.suse.com/1178886
  o https://bugzilla.suse.com/1179107
  o https://bugzilla.suse.com/1179140
  o https://bugzilla.suse.com/1179141
  o https://bugzilla.suse.com/1179419
  o https://bugzilla.suse.com/1179601
  o https://bugzilla.suse.com/1179616
  o https://bugzilla.suse.com/1179745
  o https://bugzilla.suse.com/1179877
  o https://bugzilla.suse.com/1180029
  o https://bugzilla.suse.com/1180030
  o https://bugzilla.suse.com/1180052
  o https://bugzilla.suse.com/1180086
  o https://bugzilla.suse.com/1180559
  o https://bugzilla.suse.com/1180562
  o https://bugzilla.suse.com/1181158
  o https://bugzilla.suse.com/1181166
  o https://bugzilla.suse.com/1181349
  o https://bugzilla.suse.com/1181553

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYCy39ONLKJtyKPYoAQj6ww//XWZ9DjFN9ZST2CuBpCij+kbCuKuutssd
fw9Pl77isD9thZMOsK5pS+bc6G28MOHhlF0wOSNdem+cIBh1kjnMsVJzk6ga9Xaw
5eTCUbvk39UdbWw8UwwIa/vZ7bySvIhE7ezEqh9PbzkHO530IY4GCFgQBJoC3cs0
0C6qkK5hjXxHN5axPvR6FAyqzpUg+Id/WVc9TxVB/6DaTYbqqxHXF6BUSUgPt935
mlmPntEXILxx15DZkB3fZSRly6PN658Ja7MnPDrnoD7/fnp58oG2xKdeckxgj8d/
tPmtyyE+qbr8fHUQIULuxmFU2r7oje9jgEI+86D6muI8+wn/PslZ45FwlENnDtrD
PQsircMsTH9KBZDkKHgyI3ibK0CUAHTE2casEn2B5gHg/dNUmg1iyPpJM4NvEbEU
R+nJVyFqag/1GwBwYKIhz2kdbeoMqyHcgC4G4d/J+gbb+n7RhKa64zT5iqytdhXI
skyDVt/iiNaRm3QEV5kgXPXIJFFLqfXytAQ95/VKNYc8tousmj9gcqxttGSMmsBw
1v9jLo6IrZL1+aOmUiLIbu6gs227ZTu+6Cp/nXCmIj2DbxXZ8N/0DZJurjUxwFf7
FiLutLIqRTJ1ESLTd/sG/H2ya65qgmH3F5oszXTtJhdvQGetXtfWInPBxCiJMp7I
kbr655a7tf4=
=tPCy
-----END PGP SIGNATURE-----