Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.0629
Security update for the Linux Kernel
14 February 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Linux Kernel
Publisher: SUSE
Operating System: SUSE
Resolution: Patch/Upgrade
CVE Names: CVE-2022-22942 CVE-2022-0435 CVE-2022-0330
CVE-2022-0322 CVE-2021-44733 CVE-2021-39657
CVE-2021-39648 CVE-2021-4202 CVE-2021-4197
CVE-2021-4159 CVE-2021-4135 CVE-2021-4083
CVE-2021-3564 CVE-2020-28097
Reference: ASB-2021.0239
ASB-2021.0232
ESB-2022.0617
ESB-2022.0486
ESB-2021.3796
Original Bulletin:
https://www.suse.com/support/update/announcement/2022/suse-su-20220372-1
Comment: CVSS (Max): 8.1* CVE-2022-0435 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: SUSE
* Not all CVSS available when published
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:0372-1
Rating: critical
References: #1065729 #1071995 #1082555 #1163405 #1177599 #1183405
#1184209 #1186207 #1186222 #1187428 #1187723 #1188605
#1190973 #1192729 #1193096 #1193234 #1193235 #1193242
#1193507 #1193660 #1193727 #1193767 #1193861 #1193864
#1193927 #1194027 #1194227 #1194302 #1194410 #1194493
#1194516 #1194529 #1194814 #1194880 #1194888 #1194965
#1194985 #1195065 #1195073 #1195254 #1195272
Cross-References: CVE-2020-28097 CVE-2021-3564 CVE-2021-39648 CVE-2021-39657
CVE-2021-4083 CVE-2021-4135 CVE-2021-4197 CVE-2021-4202
CVE-2021-44733 CVE-2022-0322 CVE-2022-0330 CVE-2022-0435
CVE-2022-22942
Affected Products:
SUSE Linux Enterprise Server 12-SP5
______________________________________________________________________________
An update that solves 13 vulnerabilities and has 28 fixes is now available.
Description:
The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various
security and bugfixes.
The following security bugs were fixed:
o CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate
domain record count on input (bsc#1195254).
o CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI
device initialization subsystem that could have been used by attaching
malicious HCI TTY Bluetooth devices. A local user could use this flaw to
crash the system (bnc#1186207).
o CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that
mishandled software scrollback (bnc#1187723).
o CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in
the TEE subsystem, that could have occured because of a race condition in
tee_shm_get_from_id during an attempt to free a shared memory object (bnc#
1193767).
o CVE-2022-0322: Fixed SCTP issue with account stream padding length for
reconf chunk (bsc#1194985).
o CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's
value in function nsim_bpf_map_alloc (bsc#1193927).
o CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#
1195065).
o CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in
ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local
information disclosure with System execution privileges needed (bnc#
1193864).
o CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a
race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead
to local information disclosure with System execution privileges needed.
User interaction is not needed for exploitation (bnc#1193861).
o CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#
1194880).
o CVE-2021-4197: Use cgroup open-time credentials for process migraton perm
checks (bsc#1194302).
o CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#
1194529).
o CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage
collection for Unix domain socket file handlers when users call close() and
fget() simultaneouslyand can potentially trigger a race condition (bnc#
1193727).
o CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in
coerce_reg_to_size (bsc#1194227).
The following non-security bugs were fixed:
o KVM: remember position in kvm->vcpus array (bsc#1190973).
o KVM: s390: index kvm->arch.idle_mask by vcpu_idx (bsc#1190973).
o SUNRPC: Add basic load balancing to the transport switch - kabi fix. (bnc#
1192729).
o SUNRPC: Add basic load balancing to the transport switch. (bnc#1192729)
o SUNRPC: Fix initialisation of struct rpc_xprt_switch (bnc#1192729).
o SUNRPC: Optimise transport balancing code (bnc#1192729).
o SUNRPC: Replace division by multiplication in calculation of queue length
(bnc#1192729).
o SUNRPC: Skip zero-refcount transports (bnc#1192729).
o USB: serial: option: add Telit FN990 compositions (git-fixes).
o crypto: qat - fix undetected PFVF timeout in ACK loop (git-fixes).
o ext4: set csum seed in tmp inode while migrating to extents (bsc#1195272).
o fget: clarify and improve __fget_files() implementation (bsc#1193727).
o hv_netvsc: Set needed_headroom according to VF (bsc#1193507).
o ibmvnic: Allow extra failures before disabling (bsc#1195073 ltc#195713).
o ibmvnic: do not spin in tasklet (bsc#1195073 ltc#195713).
o ibmvnic: init ->running_cap_crqs early (bsc#1195073 ltc#195713).
o ibmvnic: remove unused ->wait_capability (bsc#1195073 ltc#195713).
o kABI fixup after adding vcpu_idx to struct kvm_cpu (bsc#1190973).
o kabi: mask new member "empty" of struct Qdisc (bsc#1183405).
o kabi: revert drop of Qdisc::atomic_qlen (bsc#1183405).
o livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
o memstick: rtsx_usb_ms: fix UAF (bsc#1194516).
o mm/hwpoison: do not lock page again when me_huge_page() successfully
recovers (bsc#1194814).
o moxart: fix potential use-after-free on remove path (bsc#1194516).
o net, xdp: Introduce xdp_init_buff utility routine (bsc#1193507).
o net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193507).
o net/sched: annotate lockless accesses to qdisc->empty (bsc#1183405).
o net/sched: fix race between deactivation and dequeue for NOLOCK qdisc (bsc#
1183405).
o net/sched: pfifo_fast: fix wrong dereference in pfifo_fast_enqueue (bsc#
1183405).
o net/sched: pfifo_fast: fix wrong dereference when qdisc is reset (bsc#
1183405).
o net: Using proper atomic helper (bsc#1186222).
o net: allow retransmitting a TCP packet if original is still in queue (bsc#
1188605 bsc#1187428).
o net: caif: avoid using qdisc_qlen() (bsc#1183405).
o net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero (git-fixes).
o net: dev: introduce support for sch BYPASS for lockless qdisc (bsc#
1183405).
o net: mana: Add RX fencing (bsc#1193507).
o net: mana: Add XDP support (bsc#1193507).
o net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc
(bsc#1183405).
o net: sched: Avoid using yield() in a busy waiting loop (bsc#1183405).
o net: sched: add barrier to ensure correct ordering for lockless qdisc (bsc#
1183405).
o net: sched: add empty status flag for NOLOCK qdisc (bsc#1183405).
o net: sched: always do stats accounting according to TCQ_F_CPUSTATS (bsc#
1183405).
o net: sched: avoid unnecessary seqcount operation for lockless qdisc (bsc#
1183405).
o net: sched: fix packet stuck problem for lockless qdisc (bsc#1183405).
o net: sched: fix tx action reschedule issue with stopped queue (bsc#
1183405).
o net: sched: fix tx action rescheduling issue during deactivation (bsc#
1183405).
o net: sched: prefer qdisc_is_empty() over direct qlen access (bsc#1183405).
o net: sched: replaced invalid qdisc tree flush helper in qdisc_replace (bsc#
1183405).
o net: sched: when clearing NOLOCK, clear TCQ_F_CPUSTATS, too (bsc#1183405).
o net: tipc: validate domain record count on input (bsc#1195254).
o net: usb: lan78xx: add Allied Telesis AT29M2-AF (git-fixes).
o net_sched: avoid resetting active qdisc for multiple times (bsc#1183405).
o net_sched: get rid of unnecessary dev_qdisc_reset() (bsc#1183405).
o net_sched: use qdisc_reset() in qdisc_destroy() (bsc#1183405).
o nfs: do not dirty kernel pages read by direct-io (bsc#1194410).
o nvme: add 'iopolicy' module parameter (bsc#1177599 bsc#1193096).
o nvme: return BLK_STS_TRANSPORT unless DNR for NVME_SC_NS_NOT_READY (bsc#
1163405).
o of: Add cpu node iterator for_each_of_cpu_node() (bsc#1065729).
o of: Add device_type access helper functions (bsc#1065729).
o of: Fix cpu node iterator to not ignore disabled cpu nodes (bsc#1065729).
o of: Fix property name in of_node_get_device_type (bsc#1065729).
o of: add node name compare helper functions (bsc#1065729).
o powerpc/perf: Fix data source encodings for L2.1 and L3.1 accesses (bsc#
1065729).
o powerpc/prom_init: Fix improper check of prom_getprop() (bsc#1065729).
o powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
o powerpc/pseries/cpuhp: delete add/remove_by_count code (bsc#1065729).
o powerpc/pseries/mobility: ignore ibm, platform-facilities updates (bsc#
1065729).
o powerpc/traps: do not enable irqs in _exception (bsc#1065729).
o powerpc: add interrupt_cond_local_irq_enable helper (bsc#1065729).
o s390/cio: make ccw_device_dma_* more robust (bsc#1193242).
o s390/pci: add s390_iommu_aperture kernel parameter (bsc#1193234).
o s390/pci: move pseudo-MMIO to prevent MIO overlap (bsc#1194965).
o select: Fix indefinitely sleeping task in poll_schedule_timeout() (bsc#
1194027).
o tpm: Check for integer overflow in tpm2_map_response_body() (bsc#1082555).
o tpm: add request_locality before write TPM_INT_ENABLE (bsc#1082555).
o tpm: fix potential NULL pointer access in tpm_del_char_device (bsc#1184209
ltc#190917 git-fixes bsc#1193660 ltc#195634).
o tracing/kprobes: 'nmissed' not showed correctly for kretprobe (git-fixes).
o tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
(git-fixes).
o ucsi_ccg: Check DEV_INT bit only when starting CCG4 (git-fixes).
o usb: core: config: fix validation of wMaxPacketValue entries (git-fixes).
o usbnet: fix error return code in usbnet_probe() (git-fixes).
o usbnet: sanity check for maxpacket (git-fixes).
o vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
o virtio: write back F_VERSION_1 before validate (bsc#1193235).
o x86/platform/uv: Add more to secondary CPU kdump info (bsc#1194493).
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Server 12-SP5:
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-372=1
Package List:
o SUSE Linux Enterprise Server 12-SP5 (x86_64):
kernel-azure-4.12.14-16.88.1
kernel-azure-base-4.12.14-16.88.1
kernel-azure-base-debuginfo-4.12.14-16.88.1
kernel-azure-debuginfo-4.12.14-16.88.1
kernel-azure-debugsource-4.12.14-16.88.1
kernel-azure-devel-4.12.14-16.88.1
kernel-syms-azure-4.12.14-16.88.1
o SUSE Linux Enterprise Server 12-SP5 (noarch):
kernel-devel-azure-4.12.14-16.88.1
kernel-source-azure-4.12.14-16.88.1
References:
o https://www.suse.com/security/cve/CVE-2020-28097.html
o https://www.suse.com/security/cve/CVE-2021-3564.html
o https://www.suse.com/security/cve/CVE-2021-39648.html
o https://www.suse.com/security/cve/CVE-2021-39657.html
o https://www.suse.com/security/cve/CVE-2021-4083.html
o https://www.suse.com/security/cve/CVE-2021-4135.html
o https://www.suse.com/security/cve/CVE-2021-4197.html
o https://www.suse.com/security/cve/CVE-2021-4202.html
o https://www.suse.com/security/cve/CVE-2021-44733.html
o https://www.suse.com/security/cve/CVE-2022-0322.html
o https://www.suse.com/security/cve/CVE-2022-0330.html
o https://www.suse.com/security/cve/CVE-2022-0435.html
o https://www.suse.com/security/cve/CVE-2022-22942.html
o https://bugzilla.suse.com/1065729
o https://bugzilla.suse.com/1071995
o https://bugzilla.suse.com/1082555
o https://bugzilla.suse.com/1163405
o https://bugzilla.suse.com/1177599
o https://bugzilla.suse.com/1183405
o https://bugzilla.suse.com/1184209
o https://bugzilla.suse.com/1186207
o https://bugzilla.suse.com/1186222
o https://bugzilla.suse.com/1187428
o https://bugzilla.suse.com/1187723
o https://bugzilla.suse.com/1188605
o https://bugzilla.suse.com/1190973
o https://bugzilla.suse.com/1192729
o https://bugzilla.suse.com/1193096
o https://bugzilla.suse.com/1193234
o https://bugzilla.suse.com/1193235
o https://bugzilla.suse.com/1193242
o https://bugzilla.suse.com/1193507
o https://bugzilla.suse.com/1193660
o https://bugzilla.suse.com/1193727
o https://bugzilla.suse.com/1193767
o https://bugzilla.suse.com/1193861
o https://bugzilla.suse.com/1193864
o https://bugzilla.suse.com/1193927
o https://bugzilla.suse.com/1194027
o https://bugzilla.suse.com/1194227
o https://bugzilla.suse.com/1194302
o https://bugzilla.suse.com/1194410
o https://bugzilla.suse.com/1194493
o https://bugzilla.suse.com/1194516
o https://bugzilla.suse.com/1194529
o https://bugzilla.suse.com/1194814
o https://bugzilla.suse.com/1194880
o https://bugzilla.suse.com/1194888
o https://bugzilla.suse.com/1194965
o https://bugzilla.suse.com/1194985
o https://bugzilla.suse.com/1195065
o https://bugzilla.suse.com/1195073
o https://bugzilla.suse.com/1195254
o https://bugzilla.suse.com/1195272
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYgnXJeNLKJtyKPYoAQjFCg//dUnvjirR8zp+rVcvEWmFPpNbwF1wMkDg
UaZYe4Ae6o+7gw5onjMo+hEN76d105lkIC8gv9ynI4wZjEbBwyzDEZiDbdBaiqyT
PJewlVuu9NOvBOKK7pMtHk4x5hffvTjxuW1ZZY+QgEZpdoVqOyAdVb5B/q6kehoQ
8dE6n0Hf1irEoaYKQj8SFD0K63v/BMqOiMON3c2BByu3hY0VpcShA1UYwnAkyo9Q
J7ufOq1Ha2BArSDNiBJxS5rH3niX1TwPPzmXP6nRU5mZ3RxU0JixHEM3f1hhC1VG
WHvE/boFZBtpAhBauVDglAsiw+QKE82mNWpn357aySX1X0Wd2IxxLIiDHBPOsAKy
/1iRl1gkzrKzAfHQ+oaQqNBEpVM/nEJryF1TGaz/VNl08F47O/MJgzJERJoBwjzn
l3b693GzYIBv6OOfDZBA29b+UPu8qbn5ewI3voj6TX47JKFvWlHB/vJtg94PR0Lm
iDxOHF4HLuwIrL9D1QTEad8vVsvoNpyiDShkeQ1ZyvjocpkSaE06ig0C0RRXGS3p
1PZJ+4TDvfZJZiy5HOzH84H5v5y42KLoMyTTSDeO42KwFy4x3394fz0MlYQXmGTj
8GjADpbCbEVRasBnT0fa3pF/5cYFnho8k/KBHVcQzCt03ik0VMfWOWVBpXyTQREf
mzTy40To3dk=
=LK6Y
-----END PGP SIGNATURE-----