Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.4077
Security update for the Linux Kernel
2 December 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Linux Kernel
Publisher: SUSE
Operating System: SUSE
Impact/Access: Root Compromise -- Existing Account
Denial of Service -- Existing Account
Reduced Security -- Remote/Unauthenticated
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2021-37159 CVE-2021-34981 CVE-2021-31916
CVE-2021-20322 CVE-2021-3772 CVE-2021-0941
Reference: ESB-2021.4041
ESB-2021.4040
ESB-2021.3872
Original Bulletin:
https://www.suse.com/support/update/announcement/2021/suse-su-20213848-1
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2021:3848-1
Rating: important
References: #1094840 #1114648 #1141655 #1188601 #1190351 #1190397
#1190523 #1190795 #1191713 #1191790 #1191888 #1191961
#1192045 #1192267 #1192273 #1192379 #1192718 #1192750
#1192753 #1192781 #1192802 #1192906
Cross-References: CVE-2021-0941 CVE-2021-20322 CVE-2021-31916 CVE-2021-34981
CVE-2021-37159 CVE-2021-3772
Affected Products:
SUSE Linux Enterprise Server 12-SP5
______________________________________________________________________________
An update that solves 6 vulnerabilities, contains one feature and has 16 fixes
is now available.
Description:
The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various
security and bugfixes.
The following security bugs were fixed:
o Unprivileged BPF has been disabled by default to reduce attack surface as
too many security issues have happened in the past (jsc#SLE-22573)
You can reenable via systemctl setting /proc/sys/kernel/
unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)
o CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out
of bounds read due to a use after free. This could lead to local escalation
of privilege with System execution privileges needed. User interaction is
not needed for exploitation (bnc#1192045).
o CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in
list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in
the Linux kernel A bound check failure allowed an attacker with special
user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory
leading to a system crash or a leak of internal kernel information. The
highest threat from this vulnerability is to system availability (bnc#
1192781).
o CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less
predictive to avoid information leaks about UDP ports in use. (bsc#1191790)
o CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device
fails (bsc#1191961).
o CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux
kernel calls unregister_netdev without checking for the NETREG_REGISTERED
state, leading to a use-after-free and a double free (bnc#1188601).
o CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
The following non-security bugs were fixed:
o EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#
1114648).
o Revert "ibmvnic: check failover_pending in login response" (bsc#1190523 ltc
#194510).
o Revert "x86/kvm: fix vcpu-id indexed array sizes" (git-fixes).
o USB: iowarrior: fix control-message timeouts (git-fixes).
o USB: serial: keyspan: fix memleak on probe errors (git-fixes).
o arm64/sve: Use correct size when reinitialising SVE state (git-fixes).
o arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
(git-fixes).
o bpf: Fix potential race in tail call compatibility check (git-fixes).
o bpf: Move owner type, jited info into array auxiliary data (bsc#1141655).
o bpf: Use kvmalloc for map values in syscall (stable-5.14.16).
o btrfs: fix memory ordering between normal and ordered work functions
(git-fixes).
o ceph: take snap_empty_lock atomically with snaprealm refcount change (bsc#
1191888).
o config.sh: Build cve/linux-4.12 against SLE15-SP1. SLE15 is no longer
updated and we will need recent update to suse-module-tools to continue
building the kernel.
o crypto: qat - detect PFVF collision after ACK (git-fixes).
o crypto: qat - disregard spurious PFVF interrupts (git-fixes).
o crypto: s5p-sss - Add error handling in s5p_aes_probe() (git-fixes).
o drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()
(git-fixes).
o drm: fix spectre issue in vmw_execbuf_ioctl (bsc#1192802).
o ethernet: dwmac-stm32: Fix copyright (git-fixes).
o ftrace: Fix scripts/recordmcount.pl due to new binutils (bsc#1192267).
o fuse: fix page stealing (bsc#1192718).
o gigaset: fix spectre issue in do_data_b3_req (bsc#1192802).
o hisax: fix spectre issues (bsc#1192802).
o hrtimer: Move copyout of remaining time to do_nanosleep() (bsc#1191713).
o hrtimer_nanosleep(): Pass rmtp in restart_block (bsc#1191713).
o hysdn: fix spectre issue in hycapi_send_message (bsc#1192802).
o i2c: synquacer: fix deferred probing (git-fixes).
o ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
o ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510).
o ibmvnic: delay complete() (bsc#1094840 ltc#167098 git-fixes).
o ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
o infiniband: fix spectre issue in ib_uverbs_write (bsc#1192802).
o ipv4: fix race condition between route lookup and invalidation (bsc#
1190397).
o iwlwifi: fix spectre issue in iwl_dbgfs_update_pm (bsc#1192802).
o kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
(bsc#1191713).
o media: dvb_ca_en50221: prevent using slot_info for Spectre attacs (bsc#
1192802).
o media: dvb_ca_en50221: sanity check slot number from userspace (bsc#
1192802).
o media: wl128x: get rid of a potential spectre issue (bsc#1192802).
o mm/hugetlb: initialize hugetlb_usage in mm_init (bsc#1192906).
o mpt3sas: fix spectre issues (bsc#1192802).
o net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() (bsc#1192802).
o net: stmmac: Avoid VLA usage (git-fixes).
o net: stmmac: First Queue must always be in DCB mode (git-fixes).
o net: stmmac: Fix TX timestamp calculation (git-fixes).
o net: stmmac: Fix bad RX timestamp extraction (git-fixes).
o net: stmmac: Fix stmmac_get_rx_hwtstamp() (git-fixes).
o net: stmmac: Prevent infinite loop in get_rx_timestamp_status()
(git-fixes).
o net: stmmac: WARN if tx_skbuff entries are reused before cleared
(git-fixes).
o net: stmmac: add error handling in stmmac_mtl_setup() (git-fixes).
o net: stmmac: discard disabled flags in interrupt status register
(git-fixes).
o net: stmmac: do not clear tx_skbuff entries in stmmac_xmit()/
stmmac_tso_xmit() (git-fixes).
o net: stmmac: dwc-qos-eth: Fix typo in DT bindings parsing (git-fixes).
o net: stmmac: ensure that the MSS desc is the last desc to set the own bit
(git-fixes).
o net: stmmac: fix LPI transitioning for dwmac4 (git-fixes).
o net: stmmac: honor error code from stmmac_dt_phy() (git-fixes).
o net: stmmac: make dwmac4_release_tx_desc() clear all descriptor fields
(git-fixes).
o net: stmmac: remove redundant enable of PMT irq (git-fixes).
o net: stmmac: rename GMAC_INT_DEFAULT_MASK for dwmac4 (git-fixes).
o net: stmmac: use correct barrier between coherent memory and MMIO
(git-fixes).
o objtool-don-t-fail-on-missing-symbol-table.patch needed for vanilla flavor
as well.
o objtool: Do not fail on missing symbol table (bsc#1192379).
o ocfs2: Fix data corruption on truncate (bsc#1190795).
o ocfs2: do not zero pages beyond i_size (bsc#1190795).
o osst: fix spectre issue in osst_verify_frame (bsc#1192802).
o prctl: allow to setup brk for et_dyn executables (git-fixes).
o printk/console: Allow to disable console output by using console="" or
console=null (bsc#1192753).
o printk: handle blank console arguments passed in (bsc#1192753).
o scsi: BusLogic: Fix missing pr_cont() use (git-fixes).
o scsi: FlashPoint: Rename si_flags field (git-fixes).
o scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe()
(git-fixes).
o scsi: core: Fix error handling of scsi_host_alloc() (git-fixes).
o scsi: core: Fix spelling in a source code comment (git-fixes).
o scsi: core: Only put parent device if host state differs from SHOST_CREATED
(git-fixes).
o scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
(git-fixes).
o scsi: core: Retry I/O for Notify (Enable Spinup) Required error
(git-fixes).
o scsi: csiostor: Add module softdep on cxgb4 (git-fixes).
o scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() (git-fixes).
o scsi: dc395: Fix error case unwinding (git-fixes).
o scsi: iscsi: Fix iface sysfs attr detection (git-fixes).
o scsi: libsas: Use _safe() loop in sas_resume_port() (git-fixes).
o scsi: mpt3sas: Fix error return value in _scsih_expander_add() (git-fixes).
o scsi: qedf: Add pointer checks in qedf_update_link_speed() (git-fixes).
o scsi: qedf: Fix error codes in qedf_alloc_global_queues() (git-fixes).
o scsi: qedi: Fix error codes in qedi_alloc_global_queues() (git-fixes).
o scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()
(git-fixes).
o scsi: qla2xxx: Make sure that aborted commands are freed (git-fixes).
o scsi: snic: Fix an error message (git-fixes).
o scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer (git-fixes).
o sctp: check asoc peer.asconf_capable before processing asconf (bsc#
1190351).
o soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
(git-fixes).
o stmmac: copy unicast mac address to MAC registers (git-fixes).
o stmmac: use of_property_read_u32 instead of read_u8 (git-fixes).
o sysvipc/sem: mitigate semnum index against spectre v1 (bsc#1192802).
o tty: serial: fsl_lpuart: fix the wrong mapbase value (git-fixes).
o x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (git-fixes).
o xen-pciback: Fix return in pm_ctrl_init() (git-fixes).
o xen: Fix implicit type conversion (git-fixes).
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Server 12-SP5:
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-3848=1
Package List:
o SUSE Linux Enterprise Server 12-SP5 (x86_64):
kernel-azure-4.12.14-16.80.1
kernel-azure-base-4.12.14-16.80.1
kernel-azure-base-debuginfo-4.12.14-16.80.1
kernel-azure-debuginfo-4.12.14-16.80.1
kernel-azure-debugsource-4.12.14-16.80.1
kernel-azure-devel-4.12.14-16.80.1
kernel-syms-azure-4.12.14-16.80.1
o SUSE Linux Enterprise Server 12-SP5 (noarch):
kernel-devel-azure-4.12.14-16.80.1
kernel-source-azure-4.12.14-16.80.1
References:
o https://www.suse.com/security/cve/CVE-2021-0941.html
o https://www.suse.com/security/cve/CVE-2021-20322.html
o https://www.suse.com/security/cve/CVE-2021-31916.html
o https://www.suse.com/security/cve/CVE-2021-34981.html
o https://www.suse.com/security/cve/CVE-2021-37159.html
o https://www.suse.com/security/cve/CVE-2021-3772.html
o https://bugzilla.suse.com/1094840
o https://bugzilla.suse.com/1114648
o https://bugzilla.suse.com/1141655
o https://bugzilla.suse.com/1188601
o https://bugzilla.suse.com/1190351
o https://bugzilla.suse.com/1190397
o https://bugzilla.suse.com/1190523
o https://bugzilla.suse.com/1190795
o https://bugzilla.suse.com/1191713
o https://bugzilla.suse.com/1191790
o https://bugzilla.suse.com/1191888
o https://bugzilla.suse.com/1191961
o https://bugzilla.suse.com/1192045
o https://bugzilla.suse.com/1192267
o https://bugzilla.suse.com/1192273
o https://bugzilla.suse.com/1192379
o https://bugzilla.suse.com/1192718
o https://bugzilla.suse.com/1192750
o https://bugzilla.suse.com/1192753
o https://bugzilla.suse.com/1192781
o https://bugzilla.suse.com/1192802
o https://bugzilla.suse.com/1192906
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYahENONLKJtyKPYoAQh4vA/+J/DZqoBPHqs6cszt0aEkH0R4Nvth4bHS
QjqfVBVkVq9fVS5I1vqI7lq/vGj94vqEUKKA49aatusOY/ZPcPI6P06+GZ8Md4jo
urCdTtywZ8CTYS3a7oCe4iK3xFlbop6wMX8cLdBjiWu/dOuIddhAngt0Zcr5YjqZ
p79xAbXMA6wTPmUEm+AZPqOe0+v6FW0Us0IclFeUqZbxFqkUZQnRT7/8hjAAICrh
Z7x7GzlfthRr+/EE4WrETlR9CPztWtV8pxbcXMnganjEUN16FiZ87hV5SMdG2sY6
ogMqB+hfdetIWALfcCnlxaJQ6CRJTbrT0g6Uw4yA1P5mT1M9wAoDTZmpepooQ38l
FEecWIiDPOJSH3GPuXyuYya00Zcb0AJDTBJjYvnagv8MQN6sCHqaeWNtDAmKspUu
ryOKU3Tzx/F76CLaRh5kApKxdJeK1NaTqTgvYBNExeBMRsZK4+zibadv1L0ggX0R
GIu249yX9EoF+vQv2PS0Gy8N0QuYUxvW1fMo+gcJDIvwlJKRFHVdJGc4ZYbe+b/X
SQhb0YJduPfgo080Sd4pCCb2rtj6yaHbgwqsWCunnA+qpsdm3+Xpzg0OEzC3AwPo
alBwExmuIiH3USkA+e86IKm0EJmVmpgjTJQOtYGwf2w+kJ1DzUcGpKNXisi+nTPi
uvFgB4vEsfU=
=agjk
-----END PGP SIGNATURE-----