Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.0999
Security update for the Linux Kernel
10 March 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Linux Kernel
Publisher: SUSE
Operating System: SUSE
Resolution: Patch/Upgrade
CVE Names: CVE-2022-24959 CVE-2022-24448 CVE-2022-0644
CVE-2022-0617 CVE-2022-0492 CVE-2022-0487
CVE-2022-0002 CVE-2022-0001 CVE-2021-45095
CVE-2021-44879
Original Bulletin:
https://www.suse.com/support/update/announcement/2022/suse-su-20220765-1
Comment: CVSS (Max): 7.0 CVE-2022-0492 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: SUSE
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:0765-1
Rating: important
References: #1046306 #1050244 #1089644 #1094978 #1097583 #1097584
#1097585 #1097586 #1097587 #1097588 #1101674 #1101816
#1103991 #1109837 #1111981 #1112374 #1114648 #1114685
#1114893 #1117495 #1118661 #1119113 #1136460 #1136461
#1157038 #1157923 #1158533 #1174852 #1185377 #1185973
#1187716 #1189126 #1191271 #1191580 #1191655 #1193857
#1193867 #1194048 #1194516 #1195080 #1195377 #1195536
#1195543 #1195612 #1195638 #1195795 #1195823 #1195840
#1195897 #1195908 #1195934 #1195949 #1195987 #1195995
#1196079 #1196155 #1196400 #1196516 #1196584 #1196612
Cross-References: CVE-2021-44879 CVE-2021-45095 CVE-2022-0001 CVE-2022-0002
CVE-2022-0487 CVE-2022-0492 CVE-2022-0617 CVE-2022-0644
CVE-2022-24448 CVE-2022-24959
Affected Products:
SUSE Linux Enterprise Server 12-SP5
______________________________________________________________________________
An update that solves 10 vulnerabilities, contains one feature and has 50 fixes
is now available.
Description:
The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various
security and bugfixes.
Transient execution side-channel attacks attacking the Branch History Buffer
(BHB), named "Branch Target Injection" and "Intra-Mode Branch History
Injection" are now mitigated.
The following security bugs were fixed:
o CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
o CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#
1191580).
o CVE-2022-0617: Fixed a null pointer dereference in UDF file system
functionality. A local user could crash the system by triggering
udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
o CVE-2022-0644: Fixed a denial of service by a local user. A assertion
failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
o CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were
not considered, which lead to a move_data_page NULL pointer dereference
(bsc#1195987).
o CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/
hamradio/yam.c (bsc#1195897).
o CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c
(bsc#1193867).
o CVE-2022-0487: A use-after-free vulnerability was found in
rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#
1194516).
o CVE-2022-0492: Fixed a privilege escalation related to cgroups v1
release_agent feature, which allowed bypassing namespace isolation
unexpectedly (bsc#1195543).
o CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the
O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open()
performs a regular lookup. If a regular file is found, ENOTDIR should have
occured, but the server instead returned uninitialized data in the file
descriptor (bsc#1195612).
The following non-security bugs were fixed:
o Bluetooth: bfusb: fix division by zero in send path (git-fixes).
o Bluetooth: fix the erroneous flush_work() order (git-fixes).
o EDAC/xgene: Fix deferred probing (bsc#1114648).
o IB/rdmavt: Validate remote_addr during loopback atomic tests (bsc#1114685).
o NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#
1195934). Make this work-around optional
o NFSv42: Do not fail clone() unless the OP_CLONE operation failed
(git-fixes).
o NFSv42: Fix pagecache invalidation after COPY/CLONE (git-fixes).
o NFSv4: Handle case where the lookup of a directory fails (git-fixes).
o NFSv4: nfs_atomic_open() can race when looking up a non-regular file
(git-fixes).
o PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
(git-fixes).
o RDMA/bnxt_re: Fix query SRQ failure (bsc#1050244).
o RDMA/mlx5: Set user priority for DCT (bsc#1103991).
o RDMA/netlink: Add __maybe_unused to static inline in C file (bsc#1046306).
o Replace with an alternative fix for bsc#1185377
o crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
o cxgb4: fix eeprom len when diagnostics not implemented (bsc#1097585 bsc#
1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584).
o e1000e: Fix packet loss on Tiger Lake and later (bsc#1158533).
o ext4: avoid trim error on fs with small groups (bsc#1191271).
o fuse: annotate lock in fuse_reverse_inval_entry() (bsc#1195795).
o gve: Add RX context (bsc#1191655).
o gve: Add a jumbo-frame device option (bsc#1191655).
o gve: Add consumed counts to ethtool stats (bsc#1191655).
o gve: Add netif_set_xps_queue call (bsc#1191655).
o gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655).
o gve: Add rx buffer pagecnt bias (bsc#1191655).
o gve: Allow pageflips on larger pages (bsc#1191655).
o gve: Avoid freeing NULL pointer (bsc#1191655).
o gve: Correct available tx qpl check (bsc#1191655).
o gve: Correct order of processing device options (bsc#1191655).
o gve: DQO: avoid unused variable warnings (bsc#1191655).
o gve: Do lazy cleanup in TX path (bsc#1191655).
o gve: Fix GFP flags when allocing pages (bsc#1191655).
o gve: Implement packet continuation for RX (bsc#1191655).
o gve: Implement suspend/resume/shutdown (bsc#1191655).
o gve: Move the irq db indexes out of the ntfy block struct (bsc#1191655).
o gve: Properly handle errors in gve_assign_qpl (bsc#1191655).
o gve: Recording rx queue before sending to napi (bsc#1191655).
o gve: Switch to use napi_complete_done (bsc#1191655).
o gve: Track RX buffer allocation failures (bsc#1191655).
o gve: Update gve_free_queue_page_list signature (bsc#1191655).
o gve: Use kvcalloc() instead of kvzalloc() (bsc#1191655).
o gve: fix for null pointer dereference (bsc#1191655).
o gve: fix gve_get_stats() (bsc#1191655).
o gve: fix the wrong AdminQ buffer queue index check (bsc#1191655).
o gve: fix unmatched u64_stats_update_end() (bsc#1191655).
o gve: remove memory barrier around seqno (bsc#1191655).
o gve: report 64bit tx_bytes counter from gve_handle_report_stats() (bsc#
1191655).
o i40e: Fix changing previously set num_queue_pairs for PFs (bsc#1094978).
o i40e: Fix correct max_pkt_size on VF RX queue (bsc#1101816 ).
o i40e: Fix creation of first queue by omitting it if is not power of two
(bsc#1101816).
o i40e: Fix display error code in dmesg (bsc#1109837 bsc#1111981 ).
o i40e: Fix for displaying message regarding NVM version (jsc#SLE-4797).
o i40e: Fix freeing of uninitialized misc IRQ vector (bsc#1101816 ).
o i40e: Fix ping is lost after configuring ADq on VF (bsc#1094978).
o i40e: Fix pre-set max number of queues for VF (bsc#1111981 ).
o i40e: Increase delay to 1 s after global EMP reset (bsc#1101816 ).
o iavf: Fix limit of total number of queues to active queues of VF (bsc#
1111981).
o iavf: prevent accidental free of filter structure (bsc#1111981 ).
o ibmvnic: Allow queueing resets during probe (bsc#1196516 ltc#196391).
o ibmvnic: Update driver return codes (bsc#1196516 ltc#196391).
o ibmvnic: clear fop when retrying probe (bsc#1196516 ltc#196391).
o ibmvnic: complete init_done on transport events (bsc#1196516 ltc#196391).
o ibmvnic: define flush_reset_queue helper (bsc#1196516 ltc#196391).
o ibmvnic: free reset-work-item when flushing (bsc#1196516 ltc#196391).
o ibmvnic: init init_done_rc earlier (bsc#1196516 ltc#196391).
o ibmvnic: initialize rc before completing wait (bsc#1196516 ltc#196391).
o ibmvnic: register netdev after init of adapter (bsc#1196516 ltc#196391).
o ibmvnic: schedule failover only if vioctl fails (bsc#1196400 ltc#195815).
o ice: Delete always true check of PF pointer (bsc#1118661 ).
o ice: ignore dropped packets during init (bsc#1118661 ).
o igb: Fix removal of unicast MAC filters of VFs (bsc#1117495).
o ixgbevf: Require large buffers for build_skb on 82599VF (bsc#1101674).
o kabi: Hide changes to s390/AP structures (jsc#SLE-20809).
o lib/iov_iter: initialize "flags" in new pipe_buffer (bsc#1196584).
o mqprio: Correct stats in mqprio_dump_class_stats() (bsc#1109837).
o net/ibmvnic: Cleanup workaround doing an EOI after partition migration (bsc
#1089644 ltc#166495 ltc#165544 git-fixes).
o net: Prevent infinite while loop in skb_tx_hash() (bsc#1109837).
o net: ena: Fix error handling when calculating max IO queues number (bsc#
1174852).
o net: ena: Fix undefined state when tx request id is out of bounds (bsc#
1174852).
o net: marvell: mvpp2: Fix the computation of shared CPUs (bsc#1119113).
o net: phylink: avoid mvneta warning when setting pause parameters (bsc#
1119113).
o net: usb: pegasus: Do not drop long Ethernet frames (git-fixes).
o nfsd: fix use-after-free due to delegation race (git-fixes).
o phylib: fix potential use-after-free (bsc#1119113).
o platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call (bsc#
1112374).
o powerpc/64s: Fix debugfs_simple_attr.cocci warnings (bsc#1157038 bsc#
1157923 ltc#182612 git-fixes).
o powerpc/pseries/ddw: Revert "Extend upper limit for huge DMA window for
persistent memory" (bsc#1195995 ltc#196394).
o powerpc/pseries: read the lpar name from the firmware (bsc#1187716 ltc#
193451).
o powerpc: add link stack flush mitigation status in debugfs (bsc#1157038 bsc
#1157923 ltc#182612 git-fixes).
o qed: Handle management FW error (git-fixes).
o qed: rdma - do not wait for resources under hw error recovery flow (bsc#
1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692).
o rndis_host: support Hytera digital radios (git-fixes).
o s390/AP: support new dynamic AP bus size limit (jsc#SLE-20809).
o s390/ap: rework crypto config info and default domain code (jsc#SLE-20809).
o s390/cpumf: Support for CPU Measurement Facility CSVN 7 (bsc#1195080 LTC#
196090).
o s390/cpumf: Support for CPU Measurement Sampling Facility LS bit (bsc#
1195080 LTC#196090).
o s390/hypfs: include z/VM guests with access control group set (bsc#1195638
LTC#196354).
o scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put
() (git-fixes).
o scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop (bsc#1189126).
o scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
(git-fixes).
o scsi: nsp_cs: Check of ioremap return value (git-fixes).
o scsi: qedf: Fix potential dereference of NULL pointer (git-fixes).
o scsi: qla2xxx: Add devids and conditionals for 28xx (bsc#1195823).
o scsi: qla2xxx: Add ql2xnvme_queues module param to configure number of NVMe
queues (bsc#1195823).
o scsi: qla2xxx: Add qla2x00_async_done() for async routines (bsc#1195823).
o scsi: qla2xxx: Add retry for exec firmware (bsc#1195823).
o scsi: qla2xxx: Check for firmware dump already collected (bsc#1195823).
o scsi: qla2xxx: Fix T10 PI tag escape and IP guard options for 28XX adapters
(bsc#1195823).
o scsi: qla2xxx: Fix device reconnect in loop topology (bsc#1195823).
o scsi: qla2xxx: Fix premature hw access after PCI error (bsc#1195823).
o scsi: qla2xxx: Fix scheduling while atomic (bsc#1195823).
o scsi: qla2xxx: Fix stuck session in gpdb (bsc#1195823).
o scsi: qla2xxx: Fix unmap of already freed sgl (bsc#1195823).
o scsi: qla2xxx: Fix warning for missing error code (bsc#1195823).
o scsi: qla2xxx: Fix warning message due to adisc being flushed (bsc#
1195823).
o scsi: qla2xxx: Fix wrong FDMI data for 64G adapter (bsc#1195823).
o scsi: qla2xxx: Implement ref count for SRB (bsc#1195823).
o scsi: qla2xxx: Refactor asynchronous command initialization (bsc#1195823).
o scsi: qla2xxx: Remove a declaration (bsc#1195823).
o scsi: qla2xxx: Remove unused qla_sess_op_cmd_list from scsi_qla_host_t (bsc
#1195823).
o scsi: qla2xxx: Return -ENOMEM if kzalloc() fails (bsc#1195823).
o scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() (bsc#
1195823).
o scsi: qla2xxx: Update version to 10.02.07.200-k (bsc#1195823).
o scsi: qla2xxx: Update version to 10.02.07.300-k (bsc#1195823).
o scsi: qla2xxx: edif: Fix clang warning (bsc#1195823).
o scsi: qla2xxx: edif: Fix inconsistent check of db_flags (bsc#1195823).
o scsi: qla2xxx: edif: Reduce connection thrash (bsc#1195823).
o scsi: qla2xxx: edif: Replace list_for_each_safe with
list_for_each_entry_safe (bsc#1195823).
o scsi: qla2xxx: edif: Tweak trace message (bsc#1195823).
o scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select
() (git-fixes).
o scsi: ufs: Fix race conditions related to driver data (git-fixes).
o scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP
devices (bsc#1195377 LTC#196245).
o sunrpc/auth_gss: support timeout on gss upcalls (bsc#1193857).
o tracing: Dump stacktrace trigger to the corresponding instance (git-fixes).
o tracing: Have traceon and traceoff trigger honor the instance (git-fixes).
o usb: common: ulpi: Fix crash in ulpi_match() (git-fixes).
o usb: typec: tcpm: Do not disconnect while receiving VBUS off (git-fixes).
o xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Server 12-SP5:
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-765=1
Package List:
o SUSE Linux Enterprise Server 12-SP5 (x86_64):
kernel-azure-4.12.14-16.91.1
kernel-azure-base-4.12.14-16.91.1
kernel-azure-base-debuginfo-4.12.14-16.91.1
kernel-azure-debuginfo-4.12.14-16.91.1
kernel-azure-debugsource-4.12.14-16.91.1
kernel-azure-devel-4.12.14-16.91.1
kernel-syms-azure-4.12.14-16.91.1
o SUSE Linux Enterprise Server 12-SP5 (noarch):
kernel-devel-azure-4.12.14-16.91.1
kernel-source-azure-4.12.14-16.91.1
References:
o https://www.suse.com/security/cve/CVE-2021-44879.html
o https://www.suse.com/security/cve/CVE-2021-45095.html
o https://www.suse.com/security/cve/CVE-2022-0001.html
o https://www.suse.com/security/cve/CVE-2022-0002.html
o https://www.suse.com/security/cve/CVE-2022-0487.html
o https://www.suse.com/security/cve/CVE-2022-0492.html
o https://www.suse.com/security/cve/CVE-2022-0617.html
o https://www.suse.com/security/cve/CVE-2022-0644.html
o https://www.suse.com/security/cve/CVE-2022-24448.html
o https://www.suse.com/security/cve/CVE-2022-24959.html
o https://bugzilla.suse.com/1046306
o https://bugzilla.suse.com/1050244
o https://bugzilla.suse.com/1089644
o https://bugzilla.suse.com/1094978
o https://bugzilla.suse.com/1097583
o https://bugzilla.suse.com/1097584
o https://bugzilla.suse.com/1097585
o https://bugzilla.suse.com/1097586
o https://bugzilla.suse.com/1097587
o https://bugzilla.suse.com/1097588
o https://bugzilla.suse.com/1101674
o https://bugzilla.suse.com/1101816
o https://bugzilla.suse.com/1103991
o https://bugzilla.suse.com/1109837
o https://bugzilla.suse.com/1111981
o https://bugzilla.suse.com/1112374
o https://bugzilla.suse.com/1114648
o https://bugzilla.suse.com/1114685
o https://bugzilla.suse.com/1114893
o https://bugzilla.suse.com/1117495
o https://bugzilla.suse.com/1118661
o https://bugzilla.suse.com/1119113
o https://bugzilla.suse.com/1136460
o https://bugzilla.suse.com/1136461
o https://bugzilla.suse.com/1157038
o https://bugzilla.suse.com/1157923
o https://bugzilla.suse.com/1158533
o https://bugzilla.suse.com/1174852
o https://bugzilla.suse.com/1185377
o https://bugzilla.suse.com/1185973
o https://bugzilla.suse.com/1187716
o https://bugzilla.suse.com/1189126
o https://bugzilla.suse.com/1191271
o https://bugzilla.suse.com/1191580
o https://bugzilla.suse.com/1191655
o https://bugzilla.suse.com/1193857
o https://bugzilla.suse.com/1193867
o https://bugzilla.suse.com/1194048
o https://bugzilla.suse.com/1194516
o https://bugzilla.suse.com/1195080
o https://bugzilla.suse.com/1195377
o https://bugzilla.suse.com/1195536
o https://bugzilla.suse.com/1195543
o https://bugzilla.suse.com/1195612
o https://bugzilla.suse.com/1195638
o https://bugzilla.suse.com/1195795
o https://bugzilla.suse.com/1195823
o https://bugzilla.suse.com/1195840
o https://bugzilla.suse.com/1195897
o https://bugzilla.suse.com/1195908
o https://bugzilla.suse.com/1195934
o https://bugzilla.suse.com/1195949
o https://bugzilla.suse.com/1195987
o https://bugzilla.suse.com/1195995
o https://bugzilla.suse.com/1196079
o https://bugzilla.suse.com/1196155
o https://bugzilla.suse.com/1196400
o https://bugzilla.suse.com/1196516
o https://bugzilla.suse.com/1196584
o https://bugzilla.suse.com/1196612
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYilb1eNLKJtyKPYoAQgesQ//QdrHqtlYQsyxhQE88RRoXnPcekqzBxv2
Rj12hrqD00A7LZM+1A1ZFxAmfmvKm8Vg8E5ykRYFwjJtqyCVK3F2uhImKvvgLXIA
81T94biRWDJjigMOz9nWBIGHZt1uLBpyIzVmZhrqVGUQfn6WkuCcmA9O9+MJ1/tI
wuU6Wp/Xye+vSnBCnlDMdeIZK/H4Z1WLl5syk4/t2HLKCx+rLRqlRdPP16Oj+tLV
Nt2Ljmg9wxoyGF7W4UDLgGJ2Y+k4vTzKRe/oLLDKZj/Fm22bS3tSc7xthVaJfyA7
rHea9E55R98MN1iL2JjKrltoprqcg+wTPFIzaNS09eoESha15Mpg59TSgxcHMVm3
4uG/e95xMtwPUYcmgci9xM2JL0EE7O6GvAEEjxOe+bQTKLb1KM+0lHMFEXHl3P6n
Cy56UCzkFg0BgDXmmxGqxAYF6qoocGNyAaVvvNJgqP5qO+QxYst1NOmdFovd359T
tmXYBAZ3K6rrcBsXxJBavXtHZOcq88HYLabnVtHXUTz+VkLyk8h3MI+KX0vzeTff
ecAZM8v97GxZMIkof/WDjbxps6BFuRKe2l86UQldoht4LMIMTqgt5MH8FGfRdAWF
r/tgOD776md1/1uTOt82/XRjDoap+XWY3OXQzM6J9BVydrb27NeDnpie1TQbOMs8
jf925Z+pJcY=
=HeLU
-----END PGP SIGNATURE-----