Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.0589 Security update for the Linux Kernel 17 February 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Linux Kernel Publisher: SUSE Operating System: SUSE Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Root Compromise -- Existing Account Access Privileged Data -- Existing Account Denial of Service -- Existing Account Unauthorised Access -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2021-3347 CVE-2020-36158 CVE-2020-29661 CVE-2020-29660 CVE-2020-28974 CVE-2020-28915 CVE-2020-27786 CVE-2020-27777 CVE-2020-27068 CVE-2020-25669 CVE-2020-25668 CVE-2020-25656 CVE-2020-25643 CVE-2020-25285 CVE-2020-25284 CVE-2020-25211 CVE-2020-15437 CVE-2020-15436 CVE-2020-14390 CVE-2020-14381 CVE-2020-14353 CVE-2020-14331 CVE-2020-11668 CVE-2020-4788 CVE-2020-0465 CVE-2020-0431 CVE-2020-0404 CVE-2019-20934 CVE-2019-16746 CVE-2017-18270 Reference: ESB-2021.0565 ESB-2021.0553 ESB-2021.0534 Original Bulletin: https://www.suse.com/support/update/announcement/2021/suse-su-202114630-1 - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:14630-1 Rating: important References: #1152107 #1168952 #1173659 #1173942 #1174205 #1174247 #1174993 #1175691 #1176011 #1176012 #1176235 #1176253 #1176278 #1176395 #1176423 #1176482 #1176485 #1176722 #1176896 #1177206 #1177226 #1177666 #1177766 #1177906 #1178123 #1178182 #1178589 #1178590 #1178622 #1178886 #1179107 #1179140 #1179141 #1179419 #1179601 #1179616 #1179745 #1179877 #1180029 #1180030 #1180052 #1180086 #1180559 #1180562 #1181158 #1181166 #1181349 #1181553 Cross-References: CVE-2019-16746 CVE-2020-0404 CVE-2020-0431 CVE-2020-0465 CVE-2020-11668 CVE-2020-14331 CVE-2020-14353 CVE-2020-14381 CVE-2020-14390 CVE-2020-15436 CVE-2020-15437 CVE-2020-25211 CVE-2020-25284 CVE-2020-25285 CVE-2020-25643 CVE-2020-25656 CVE-2020-25668 CVE-2020-25669 CVE-2020-27068 CVE-2020-27777 CVE-2020-27786 CVE-2020-28915 CVE-2020-28974 CVE-2020-29660 CVE-2020-29661 CVE-2020-36158 CVE-2020-4788 CVE-2021-3347 Affected Products: SUSE Linux Enterprise Server 11-SP4-LTSS SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 28 vulnerabilities and has 20 fixes is now available. Description: The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: o CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc# 1181349). o CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029). o CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395). o CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235). o CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482). o CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141). o CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc# 1174205). o CVE-2020-14353: Fixed an issue where keys - for keyctl prevent creating a different user's keyrings (bsc#1174993). o CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011). o CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086). o CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107). o CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601). o CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745). o CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745). o CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589). o CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886). o CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc# 1178182). o CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/ hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (bnc#1176485 ). o CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service (bsc#1179140). o CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559). o CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952). o CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123). o CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666). o CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722). o CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423). o CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663). o CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766). o CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206). o CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc# 1173659). The following non-security bugs were fixed: o HID: Fix slab-out-of-bounds read in hid_field_extract (bsc#1180052). o cifs: bugfix for unreclaimed writeback pages in cifs_writev_requeue() (bsc# 1177906). o mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc# 1175691). o net/x25: fix a race in x25_bind() (bsc#1178590). o net/x25: prevent a couple of overflows (bsc#1178590). o tty: fix memleak in alloc_pid (bsc#1179745). o xfs: mark all internal workqueues as freezable (bsc#1181166). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-kernel-source-14630=1 o SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-source-14630=1 o SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-kernel-source-14630=1 Package List: o SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64): kernel-default-3.0.101-108.120.1 kernel-default-base-3.0.101-108.120.1 kernel-default-devel-3.0.101-108.120.1 kernel-source-3.0.101-108.120.1 kernel-syms-3.0.101-108.120.1 kernel-trace-3.0.101-108.120.1 kernel-trace-base-3.0.101-108.120.1 kernel-trace-devel-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-SP4-LTSS (i586 x86_64): kernel-ec2-3.0.101-108.120.1 kernel-ec2-base-3.0.101-108.120.1 kernel-ec2-devel-3.0.101-108.120.1 kernel-xen-3.0.101-108.120.1 kernel-xen-base-3.0.101-108.120.1 kernel-xen-devel-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-SP4-LTSS (ppc64): kernel-bigmem-3.0.101-108.120.1 kernel-bigmem-base-3.0.101-108.120.1 kernel-bigmem-devel-3.0.101-108.120.1 kernel-ppc64-3.0.101-108.120.1 kernel-ppc64-base-3.0.101-108.120.1 kernel-ppc64-devel-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-SP4-LTSS (s390x): kernel-default-man-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-SP4-LTSS (i586): kernel-pae-3.0.101-108.120.1 kernel-pae-base-3.0.101-108.120.1 kernel-pae-devel-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-trace-extra-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-108.120.1 o SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-108.120.1 o SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64): kernel-default-debuginfo-3.0.101-108.120.1 kernel-default-debugsource-3.0.101-108.120.1 kernel-trace-debuginfo-3.0.101-108.120.1 kernel-trace-debugsource-3.0.101-108.120.1 o SUSE Linux Enterprise Debuginfo 11-SP4 (i586 s390x x86_64): kernel-default-devel-debuginfo-3.0.101-108.120.1 kernel-trace-devel-debuginfo-3.0.101-108.120.1 o SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-108.120.1 kernel-ec2-debugsource-3.0.101-108.120.1 kernel-xen-debuginfo-3.0.101-108.120.1 kernel-xen-debugsource-3.0.101-108.120.1 kernel-xen-devel-debuginfo-3.0.101-108.120.1 o SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64): kernel-bigmem-debuginfo-3.0.101-108.120.1 kernel-bigmem-debugsource-3.0.101-108.120.1 kernel-ppc64-debuginfo-3.0.101-108.120.1 kernel-ppc64-debugsource-3.0.101-108.120.1 o SUSE Linux Enterprise Debuginfo 11-SP4 (i586): kernel-pae-debuginfo-3.0.101-108.120.1 kernel-pae-debugsource-3.0.101-108.120.1 kernel-pae-devel-debuginfo-3.0.101-108.120.1 References: o https://www.suse.com/security/cve/CVE-2019-16746.html o https://www.suse.com/security/cve/CVE-2020-0404.html o https://www.suse.com/security/cve/CVE-2020-0431.html o https://www.suse.com/security/cve/CVE-2020-0465.html o https://www.suse.com/security/cve/CVE-2020-11668.html o https://www.suse.com/security/cve/CVE-2020-14331.html o https://www.suse.com/security/cve/CVE-2020-14353.html o https://www.suse.com/security/cve/CVE-2020-14381.html o https://www.suse.com/security/cve/CVE-2020-14390.html o https://www.suse.com/security/cve/CVE-2020-15436.html o https://www.suse.com/security/cve/CVE-2020-15437.html o https://www.suse.com/security/cve/CVE-2020-25211.html o https://www.suse.com/security/cve/CVE-2020-25284.html o https://www.suse.com/security/cve/CVE-2020-25285.html o https://www.suse.com/security/cve/CVE-2020-25643.html o https://www.suse.com/security/cve/CVE-2020-25656.html o https://www.suse.com/security/cve/CVE-2020-25668.html o https://www.suse.com/security/cve/CVE-2020-25669.html o https://www.suse.com/security/cve/CVE-2020-27068.html o https://www.suse.com/security/cve/CVE-2020-27777.html o https://www.suse.com/security/cve/CVE-2020-27786.html o https://www.suse.com/security/cve/CVE-2020-28915.html o https://www.suse.com/security/cve/CVE-2020-28974.html o https://www.suse.com/security/cve/CVE-2020-29660.html o https://www.suse.com/security/cve/CVE-2020-29661.html o https://www.suse.com/security/cve/CVE-2020-36158.html o https://www.suse.com/security/cve/CVE-2020-4788.html o https://www.suse.com/security/cve/CVE-2021-3347.html o https://bugzilla.suse.com/1152107 o https://bugzilla.suse.com/1168952 o https://bugzilla.suse.com/1173659 o https://bugzilla.suse.com/1173942 o https://bugzilla.suse.com/1174205 o https://bugzilla.suse.com/1174247 o https://bugzilla.suse.com/1174993 o https://bugzilla.suse.com/1175691 o https://bugzilla.suse.com/1176011 o https://bugzilla.suse.com/1176012 o https://bugzilla.suse.com/1176235 o https://bugzilla.suse.com/1176253 o https://bugzilla.suse.com/1176278 o https://bugzilla.suse.com/1176395 o https://bugzilla.suse.com/1176423 o https://bugzilla.suse.com/1176482 o https://bugzilla.suse.com/1176485 o https://bugzilla.suse.com/1176722 o https://bugzilla.suse.com/1176896 o https://bugzilla.suse.com/1177206 o https://bugzilla.suse.com/1177226 o https://bugzilla.suse.com/1177666 o https://bugzilla.suse.com/1177766 o https://bugzilla.suse.com/1177906 o https://bugzilla.suse.com/1178123 o https://bugzilla.suse.com/1178182 o https://bugzilla.suse.com/1178589 o https://bugzilla.suse.com/1178590 o https://bugzilla.suse.com/1178622 o https://bugzilla.suse.com/1178886 o https://bugzilla.suse.com/1179107 o https://bugzilla.suse.com/1179140 o https://bugzilla.suse.com/1179141 o https://bugzilla.suse.com/1179419 o https://bugzilla.suse.com/1179601 o https://bugzilla.suse.com/1179616 o https://bugzilla.suse.com/1179745 o https://bugzilla.suse.com/1179877 o https://bugzilla.suse.com/1180029 o https://bugzilla.suse.com/1180030 o https://bugzilla.suse.com/1180052 o https://bugzilla.suse.com/1180086 o https://bugzilla.suse.com/1180559 o https://bugzilla.suse.com/1180562 o https://bugzilla.suse.com/1181158 o https://bugzilla.suse.com/1181166 o https://bugzilla.suse.com/1181349 o https://bugzilla.suse.com/1181553 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYCy39ONLKJtyKPYoAQj6ww//XWZ9DjFN9ZST2CuBpCij+kbCuKuutssd fw9Pl77isD9thZMOsK5pS+bc6G28MOHhlF0wOSNdem+cIBh1kjnMsVJzk6ga9Xaw 5eTCUbvk39UdbWw8UwwIa/vZ7bySvIhE7ezEqh9PbzkHO530IY4GCFgQBJoC3cs0 0C6qkK5hjXxHN5axPvR6FAyqzpUg+Id/WVc9TxVB/6DaTYbqqxHXF6BUSUgPt935 mlmPntEXILxx15DZkB3fZSRly6PN658Ja7MnPDrnoD7/fnp58oG2xKdeckxgj8d/ tPmtyyE+qbr8fHUQIULuxmFU2r7oje9jgEI+86D6muI8+wn/PslZ45FwlENnDtrD PQsircMsTH9KBZDkKHgyI3ibK0CUAHTE2casEn2B5gHg/dNUmg1iyPpJM4NvEbEU R+nJVyFqag/1GwBwYKIhz2kdbeoMqyHcgC4G4d/J+gbb+n7RhKa64zT5iqytdhXI skyDVt/iiNaRm3QEV5kgXPXIJFFLqfXytAQ95/VKNYc8tousmj9gcqxttGSMmsBw 1v9jLo6IrZL1+aOmUiLIbu6gs227ZTu+6Cp/nXCmIj2DbxXZ8N/0DZJurjUxwFf7 FiLutLIqRTJ1ESLTd/sG/H2ya65qgmH3F5oszXTtJhdvQGetXtfWInPBxCiJMp7I kbr655a7tf4= =tPCy -----END PGP SIGNATURE-----