Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.0800
Security update for the Linux RT Kernel
24 February 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Linux RT Kernel
Publisher: SUSE
Operating System: SUSE
Resolution: Patch/Upgrade
CVE Names: CVE-2022-24448 CVE-2022-22942 CVE-2022-0435
CVE-2022-0330 CVE-2022-0322 CVE-2021-45095
CVE-2021-44733 CVE-2021-39657 CVE-2021-39648
CVE-2021-4202 CVE-2021-4197 CVE-2021-4149
CVE-2021-4135 CVE-2021-4083 CVE-2021-3564
CVE-2020-28097
Original Bulletin:
https://www.suse.com/support/update/announcement/2022/suse-su-20220555-1
Comment: CVSS (Max): 8.1 CVE-2022-0435 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: SUSE
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for the Linux RT Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:0555-1
Rating: critical
References: #1065729 #1071995 #1082555 #1163405 #1177599 #1183405
#1184209 #1185377 #1186207 #1186222 #1187428 #1187723
#1188605 #1190973 #1192729 #1193096 #1193234 #1193235
#1193242 #1193507 #1193660 #1193669 #1193727 #1193767
#1193861 #1193864 #1193867 #1193927 #1194001 #1194027
#1194048 #1194227 #1194302 #1194410 #1194493 #1194516
#1194529 #1194814 #1194880 #1194888 #1194965 #1194985
#1195065 #1195073 #1195254 #1195272 #1195612
Cross-References: CVE-2020-28097 CVE-2021-3564 CVE-2021-39648 CVE-2021-39657
CVE-2021-4083 CVE-2021-4135 CVE-2021-4149 CVE-2021-4197
CVE-2021-4202 CVE-2021-44733 CVE-2021-45095 CVE-2022-0322
CVE-2022-0330 CVE-2022-0435 CVE-2022-22942 CVE-2022-24448
Affected Products:
SUSE Linux Enterprise Real Time Extension 12-SP5
______________________________________________________________________________
An update that solves 16 vulnerabilities and has 31 fixes is now available.
Description:
The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various
security and bugfixes.
The following security bugs were fixed:
o CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate
domain record count on input (bsc#1195254).
o CVE-2022-24448: Fixed an issue inside fs/nfs/dir.c if an application sets
the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open()
performs a regular lookup (bnc#1195612).
o CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI
device initialization subsystem that could have been used by attaching
malicious HCI TTY Bluetooth devices. A local user could use this flaw to
crash the system (bnc#1186207).
o CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that
mishandled software scrollback (bnc#1187723).
o CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c
(bnc#1193867).
o CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#
1195065).
o CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in
ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local
information disclosure with System execution privileges needed (bnc#
1193864).
o CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a
race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead
to local information disclosure with System execution privileges needed.
User interaction is not needed for exploitation (bnc#1193861).
o CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in
the TEE subsystem, that could have occured because of a race condition in
tee_shm_get_from_id during an attempt to free a shared memory object (bnc#
1193767).
o CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#
1194880).
o CVE-2022-0322: Fixed SCTP issue with account stream padding length for
reconf chunk (bsc#1194985).
o CVE-2021-4197: Use cgroup open-time credentials for process migraton perm
checks (bsc#1194302).
o CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#
1194529).
o CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage
collection for Unix domain socket file handlers when users call close() and
fget() simultaneouslyand can potentially trigger a race condition (bnc#
1193727).
o CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error
(bsc#1194001).
o CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's
value in function nsim_bpf_map_alloc (bsc#1193927).
The following non-security bugs were fixed:
o KVM: remember position in kvm->vcpus array (bsc#1190973).
o KVM: s390: index kvm->arch.idle_mask by vcpu_idx (bsc#1190973).
o SUNRPC: Add basic load balancing to the transport switch - kabi fix. (bnc#
1192729).
o SUNRPC: Add basic load balancing to the transport switch. (bnc#1192729)
o SUNRPC: Fix initialisation of struct rpc_xprt_switch (bnc#1192729).
o SUNRPC: Optimise transport balancing code (bnc#1192729).
o SUNRPC: Replace division by multiplication in calculation of queue length
(bnc#1192729).
o SUNRPC: Skip zero-refcount transports (bnc#1192729).
o USB: serial: option: add Telit FN990 compositions (git-fixes).
o bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()
(bsc#1194227).
o crypto: qat - fix undetected PFVF timeout in ACK loop (git-fixes).
o ext4: set csum seed in tmp inode while migrating to extents (bsc#1195272).
o fget: clarify and improve __fget_files() implementation (bsc#1193727).
o hv_netvsc: Set needed_headroom according to VF (bsc#1193507).
o ibmvnic: Allow extra failures before disabling (bsc#1195073 ltc#195713).
o ibmvnic: do not spin in tasklet (bsc#1195073 ltc#195713).
o ibmvnic: init ->running_cap_crqs early (bsc#1195073 ltc#195713).
o ibmvnic: remove unused ->wait_capability (bsc#1195073 ltc#195713).
o kABI fixup after adding vcpu_idx to struct kvm_cpu (bsc#1190973).
o kabi: mask new member "empty" of struct Qdisc (bsc#1183405).
o kabi: revert drop of Qdisc::atomic_qlen (bsc#1183405).
o kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).
o livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
o memstick: rtsx_usb_ms: fix UAF (bsc#1194516).
o mm/hwpoison: do not lock page again when me_huge_page() successfully
recovers (bsc#1194814).
o mm/slab: Using proper atomic helper (bsc#1186222).
o moxart: fix potential use-after-free on remove path (bsc#1194516).
o net, xdp: Introduce xdp_init_buff utility routine (bsc#1193507).
o net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193507).
o net/sched: annotate lockless accesses to qdisc->empty (bsc#1183405).
o net/sched: fix race between deactivation and dequeue for NOLOCK qdisc (bsc#
1183405).
o net/sched: pfifo_fast: fix wrong dereference in pfifo_fast_enqueue (bsc#
1183405).
o net/sched: pfifo_fast: fix wrong dereference when qdisc is reset (bsc#
1183405).
o net: allow retransmitting a TCP packet if original is still in queue (bsc#
1188605 bsc#1187428).
o net: caif: avoid using qdisc_qlen() (bsc#1183405).
o net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero (git-fixes).
o net: dev: introduce support for sch BYPASS for lockless qdisc (bsc#
1183405).
o net: mana: Add RX fencing (bsc#1193507).
o net: mana: Add XDP support (bsc#1193507).
o net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc
(bsc#1183405).
o net: sched: Avoid using yield() in a busy waiting loop (bsc#1183405).
o net: sched: add barrier to ensure correct ordering for lockless qdisc (bsc#
1183405).
o net: sched: add empty status flag for NOLOCK qdisc (bsc#1183405).
o net: sched: always do stats accounting according to TCQ_F_CPUSTATS (bsc#
1183405).
o net: sched: avoid unnecessary seqcount operation for lockless qdisc (bsc#
1183405).
o net: sched: fix packet stuck problem for lockless qdisc (bsc#1183405).
o net: sched: fix tx action reschedule issue with stopped queue (bsc#
1183405).
o net: sched: fix tx action rescheduling issue during deactivation (bsc#
1183405).
o net: sched: prefer qdisc_is_empty() over direct qlen access (bsc#1183405).
o net: sched: replaced invalid qdisc tree flush helper in qdisc_replace (bsc#
1183405).
o net: sched: when clearing NOLOCK, clear TCQ_F_CPUSTATS, too (bsc#1183405).
o net: usb: lan78xx: add Allied Telesis AT29M2-AF (git-fixes).
o net_sched: avoid resetting active qdisc for multiple times (bsc#1183405).
o net_sched: get rid of unnecessary dev_qdisc_reset() (bsc#1183405).
o net_sched: use qdisc_reset() in qdisc_destroy() (bsc#1183405).
o nfs: do not dirty kernel pages read by direct-io (bsc#1194410).
o nvme: add 'iopolicy' module parameter (bsc#1177599 bsc#1193096).
o nvme: return BLK_STS_TRANSPORT unless DNR for NVME_SC_NS_NOT_READY (bsc#
1163405).
o of: Add cpu node iterator for_each_of_cpu_node() (bsc#1065729).
o of: Add device_type access helper functions (bsc#1065729).
o of: Fix cpu node iterator to not ignore disabled cpu nodes (bsc#1065729).
o of: Fix property name in of_node_get_device_type (bsc#1065729).
o of: add node name compare helper functions (bsc#1065729).
o powerpc/perf: Fix data source encodings for L2.1 and L3.1 accesses (bsc#
1065729).
o powerpc/prom_init: Fix improper check of prom_getprop() (bsc#1065729).
o powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
o powerpc/pseries/cpuhp: delete add/remove_by_count code (bsc#1065729).
o powerpc/pseries/mobility: ignore ibm, platform-facilities updates (bsc#
1065729).
o powerpc/traps: do not enable irqs in _exception (bsc#1065729).
o powerpc: add interrupt_cond_local_irq_enable helper (bsc#1065729).
o s390/cio: make ccw_device_dma_* more robust (bsc#1193242).
o s390/pci: add s390_iommu_aperture kernel parameter (bsc#1193234).
o s390/pci: move pseudo-MMIO to prevent MIO overlap (bsc#1194965).
o select: Fix indefinitely sleeping task in poll_schedule_timeout() (bsc#
1194027).
o tpm: Check for integer overflow in tpm2_map_response_body() (bsc#1082555).
o tpm: add request_locality before write TPM_INT_ENABLE (bsc#1082555).
o tpm: fix potential NULL pointer access in tpm_del_char_device (bsc#1184209
ltc#190917 git-fixes bsc#1193660 ltc#195634).
o tracing/kprobes: 'nmissed' not showed correctly for kretprobe (git-fixes).
o tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
(git-fixes).
o ucsi_ccg: Check DEV_INT bit only when starting CCG4 (git-fixes).
o usb: core: config: fix validation of wMaxPacketValue entries (git-fixes).
o usbnet: fix error return code in usbnet_probe() (git-fixes).
o usbnet: sanity check for maxpacket (git-fixes).
o vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
o virtio: write back F_VERSION_1 before validate (bsc#1193235).
o x86/platform/uv: Add more to secondary CPU kdump info (bsc#1194493).
o xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Real Time Extension 12-SP5:
zypper in -t patch SUSE-SLE-RT-12-SP5-2022-555=1
Package List:
o SUSE Linux Enterprise Real Time Extension 12-SP5 (x86_64):
cluster-md-kmp-rt-4.12.14-10.78.1
cluster-md-kmp-rt-debuginfo-4.12.14-10.78.1
dlm-kmp-rt-4.12.14-10.78.1
dlm-kmp-rt-debuginfo-4.12.14-10.78.1
gfs2-kmp-rt-4.12.14-10.78.1
gfs2-kmp-rt-debuginfo-4.12.14-10.78.1
kernel-rt-4.12.14-10.78.1
kernel-rt-base-4.12.14-10.78.1
kernel-rt-base-debuginfo-4.12.14-10.78.1
kernel-rt-debuginfo-4.12.14-10.78.1
kernel-rt-debugsource-4.12.14-10.78.1
kernel-rt-devel-4.12.14-10.78.1
kernel-rt-devel-debuginfo-4.12.14-10.78.1
kernel-rt_debug-4.12.14-10.78.1
kernel-rt_debug-debuginfo-4.12.14-10.78.1
kernel-rt_debug-debugsource-4.12.14-10.78.1
kernel-rt_debug-devel-4.12.14-10.78.1
kernel-rt_debug-devel-debuginfo-4.12.14-10.78.1
kernel-syms-rt-4.12.14-10.78.1
ocfs2-kmp-rt-4.12.14-10.78.1
ocfs2-kmp-rt-debuginfo-4.12.14-10.78.1
o SUSE Linux Enterprise Real Time Extension 12-SP5 (noarch):
kernel-devel-rt-4.12.14-10.78.1
kernel-source-rt-4.12.14-10.78.1
References:
o https://www.suse.com/security/cve/CVE-2020-28097.html
o https://www.suse.com/security/cve/CVE-2021-3564.html
o https://www.suse.com/security/cve/CVE-2021-39648.html
o https://www.suse.com/security/cve/CVE-2021-39657.html
o https://www.suse.com/security/cve/CVE-2021-4083.html
o https://www.suse.com/security/cve/CVE-2021-4135.html
o https://www.suse.com/security/cve/CVE-2021-4149.html
o https://www.suse.com/security/cve/CVE-2021-4197.html
o https://www.suse.com/security/cve/CVE-2021-4202.html
o https://www.suse.com/security/cve/CVE-2021-44733.html
o https://www.suse.com/security/cve/CVE-2021-45095.html
o https://www.suse.com/security/cve/CVE-2022-0322.html
o https://www.suse.com/security/cve/CVE-2022-0330.html
o https://www.suse.com/security/cve/CVE-2022-0435.html
o https://www.suse.com/security/cve/CVE-2022-22942.html
o https://www.suse.com/security/cve/CVE-2022-24448.html
o https://bugzilla.suse.com/1065729
o https://bugzilla.suse.com/1071995
o https://bugzilla.suse.com/1082555
o https://bugzilla.suse.com/1163405
o https://bugzilla.suse.com/1177599
o https://bugzilla.suse.com/1183405
o https://bugzilla.suse.com/1184209
o https://bugzilla.suse.com/1185377
o https://bugzilla.suse.com/1186207
o https://bugzilla.suse.com/1186222
o https://bugzilla.suse.com/1187428
o https://bugzilla.suse.com/1187723
o https://bugzilla.suse.com/1188605
o https://bugzilla.suse.com/1190973
o https://bugzilla.suse.com/1192729
o https://bugzilla.suse.com/1193096
o https://bugzilla.suse.com/1193234
o https://bugzilla.suse.com/1193235
o https://bugzilla.suse.com/1193242
o https://bugzilla.suse.com/1193507
o https://bugzilla.suse.com/1193660
o https://bugzilla.suse.com/1193669
o https://bugzilla.suse.com/1193727
o https://bugzilla.suse.com/1193767
o https://bugzilla.suse.com/1193861
o https://bugzilla.suse.com/1193864
o https://bugzilla.suse.com/1193867
o https://bugzilla.suse.com/1193927
o https://bugzilla.suse.com/1194001
o https://bugzilla.suse.com/1194027
o https://bugzilla.suse.com/1194048
o https://bugzilla.suse.com/1194227
o https://bugzilla.suse.com/1194302
o https://bugzilla.suse.com/1194410
o https://bugzilla.suse.com/1194493
o https://bugzilla.suse.com/1194516
o https://bugzilla.suse.com/1194529
o https://bugzilla.suse.com/1194814
o https://bugzilla.suse.com/1194880
o https://bugzilla.suse.com/1194888
o https://bugzilla.suse.com/1194965
o https://bugzilla.suse.com/1194985
o https://bugzilla.suse.com/1195065
o https://bugzilla.suse.com/1195073
o https://bugzilla.suse.com/1195254
o https://bugzilla.suse.com/1195272
o https://bugzilla.suse.com/1195612
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYhb35eNLKJtyKPYoAQjg7hAAmKZr8plrk0ByxagslFXmcvmoUEyrz0bG
B7JgoKixeuAfXyZC6vhLoh4dwJ5uDmErNJXSrL+INrI4buZJ36UVq5osYVpnMqMW
3EZ8Wx46NEUEv4Hfld0++25gt+Yn7TLtBXfy1OZsZLSBRg7YY486aKSvZT2w6YJE
9c4cPxri+TsDsad+YvP6GyKuXGosER/uj6ygAQ4wy4RyY2/veXO72tlfgLDTkyet
LMrCeEctNg2dHHjMAcg/ibs5W4LpYHZefBbTiyiHPM59ITzWuNXy2piAvzUOeGXo
ofISXMhLAC07HVt35SLdPgNicZclOR7njztAHdATz0UOL0glEE5PAPbTlTe+aeAS
YmYpj4ClQl+/GtsvJjOQX8NNGGsuV00zJseHdJBMZIHAo4NmQlCh0vQBXGVOEDuV
YBk/36Sm+rn9b3i8b8e+8SwxLR3VhXpUZrntYA7Hm1Jbj5yWkPQdsaCP7wg9F4fs
u6gHB5sTck02FLb8GwOUHbNI1k/RAR2i8+XaI11oyETofRBfgsrZ5yd0c+f67USi
NA30uzvaUCaJ/PN9q0h2dhVwort7szwkQzbcNfl+QlWp+MVm9i5NeqsTdSOFjtWI
SdiailfE1vLem8WuUR4dnBhigSBEiz6f0k6btaLKdZ3GgXJBgjUh+TUhAUPzZHvC
J10VGqeOnrk=
=RaUU
-----END PGP SIGNATURE-----