Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.4580 Security update for the Linux Kernel 15 September 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Linux Kernel Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2022-36946 CVE-2022-36879 CVE-2022-26373 CVE-2022-21385 CVE-2022-20369 CVE-2022-20368 CVE-2022-20166 CVE-2022-3028 CVE-2022-2977 CVE-2022-2639 CVE-2022-2588 CVE-2021-4203 CVE-2020-36558 CVE-2020-36557 CVE-2020-36516 Original Bulletin: https://www.suse.com/support/update/announcement/2022/suse-su-20223274-1 Comment: CVSS (Max): 8.1 CVE-2020-36516 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3274-1 Rating: important References: #1172145 #1177440 #1188944 #1191881 #1194535 #1196616 #1200598 #1200770 #1200910 #1201019 #1201420 #1201429 #1201705 #1201726 #1201940 #1201948 #1202096 #1202154 #1202346 #1202347 #1202393 #1202396 #1202672 #1202897 #1202898 #1203098 Cross-References: CVE-2020-36516 CVE-2020-36557 CVE-2020-36558 CVE-2021-4203 CVE-2022-20166 CVE-2022-20368 CVE-2022-20369 CVE-2022-21385 CVE-2022-2588 CVE-2022-26373 CVE-2022-2639 CVE-2022-2977 CVE-2022-3028 CVE-2022-36879 CVE-2022-36946 Affected Products: SUSE Linux Enterprise High Availability 12-SP4 SUSE Linux Enterprise High Performance Computing 12-SP4 SUSE Linux Enterprise Live Patching 12-SP4 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP4-LTSS SUSE Linux Enterprise Server for SAP 12-SP4 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 ______________________________________________________________________________ An update that solves 15 vulnerabilities and has 11 fixes is now available. Description: The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: o CVE-2022-36946: Fixed a denial of service (panic) inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c (bnc#1201940). o CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/ xfrm_policy.c where a refcount could be dropped twice (bnc#1201948). o CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898). o CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672). o CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154). o CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726). o CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096). o CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897). o CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347). o CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc# 1202346). o CVE-2022-20166: Fixed possible out of bounds write due to a heap buffer overflow in various methods of kernel base drivers (bnc#1200598). o CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535). o CVE-2020-36558: Fixed a race condition involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault (bnc#1200910). o CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could have led to a use-after-free (bnc# 1201429). o CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616). The following non-security bugs were fixed: o cifs: fix error paths in cifs_tree_connect() (bsc#1177440). o cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944). o cifs: report error instead of invalid when revalidating a dentry fails (bsc #1177440). o cifs: skip trailing separators of prefix paths (bsc#1188944). o kernel-obs-build: include qemu_fw_cfg (boo#1201705) o lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325). o mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc# 1203098). o mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes, bsc#1203098). o net_sched: cls_route: disallow handle of 0 (bsc#1202393). o objtool: Add --backtrace support (bsc#1202396). o objtool: Add support for intra-function calls (bsc#1202396). o objtool: Allow no-op CFI ops in alternatives (bsc#1202396). o objtool: Convert insn type to enum (bsc#1202396). o objtool: Do not use ignore flag for fake jumps (bsc#1202396). o objtool: Fix !CFI insn_state propagation (bsc#1202396). o objtool: Fix ORC vs alternatives (bsc#1202396). o objtool: Fix sibling call detection (bsc#1202396). o objtool: Make handle_insn_ops() unconditional (bsc#1202396). o objtool: Remove INSN_STACK (bsc#1202396). o objtool: Remove check preventing branches within alternative (bsc#1202396). o objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain (bsc#1202396). o objtool: Rename struct cfi_state (bsc#1202396). o objtool: Rework allocating stack_ops on decode (bsc#1202396). o objtool: Rewrite alt->skip_orig (bsc#1202396). o objtool: Set insn->func for alternatives (bsc#1202396). o objtool: Support conditional retpolines (bsc#1202396). o objtool: Support multiple stack_op per instruction (bsc#1202396). o objtool: Track original function across branches (bsc#1202396). o objtool: Uniquely identify alternative instruction groups (bsc#1202396). o objtool: Use Elf_Scn typedef instead of assuming struct name (bsc#1202396). o powerpc/pci: Fix broken INTx configuration via OF (bsc#1172145 ltc#184630 bsc#1200770 ltc#198666). o powerpc/pci: Remove LSI mappings on device teardown (bsc#1172145 ltc#184630 bsc#1200770 ltc#198666). o powerpc/pci: Use of_irq_parse_and_map_pci() helper (bsc#1172145 ltc#184630 bsc#1200770 ltc#198666). o rpm: Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE OpenStack Cloud Crowbar 9: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-3274=1 o SUSE OpenStack Cloud 9: zypper in -t patch SUSE-OpenStack-Cloud-9-2022-3274=1 o SUSE Linux Enterprise Server for SAP 12-SP4: zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-3274=1 o SUSE Linux Enterprise Server 12-SP4-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-3274=1 o SUSE Linux Enterprise Live Patching 12-SP4: zypper in -t patch SUSE-SLE-Live-Patching-12-SP4-2022-3274=1 Please note that this is the initial kernel livepatch without fixes itself, this package is later updated by seperate standalone kernel livepatch updates. o SUSE Linux Enterprise High Availability 12-SP4: zypper in -t patch SUSE-SLE-HA-12-SP4-2022-3274=1 Package List: o SUSE OpenStack Cloud Crowbar 9 (x86_64): kernel-default-4.12.14-95.108.1 kernel-default-base-4.12.14-95.108.1 kernel-default-base-debuginfo-4.12.14-95.108.1 kernel-default-debuginfo-4.12.14-95.108.1 kernel-default-debugsource-4.12.14-95.108.1 kernel-default-devel-4.12.14-95.108.1 kernel-default-devel-debuginfo-4.12.14-95.108.1 kernel-syms-4.12.14-95.108.1 o SUSE OpenStack Cloud Crowbar 9 (noarch): kernel-devel-4.12.14-95.108.1 kernel-macros-4.12.14-95.108.1 kernel-source-4.12.14-95.108.1 o SUSE OpenStack Cloud 9 (x86_64): kernel-default-4.12.14-95.108.1 kernel-default-base-4.12.14-95.108.1 kernel-default-base-debuginfo-4.12.14-95.108.1 kernel-default-debuginfo-4.12.14-95.108.1 kernel-default-debugsource-4.12.14-95.108.1 kernel-default-devel-4.12.14-95.108.1 kernel-default-devel-debuginfo-4.12.14-95.108.1 kernel-syms-4.12.14-95.108.1 o SUSE OpenStack Cloud 9 (noarch): kernel-devel-4.12.14-95.108.1 kernel-macros-4.12.14-95.108.1 kernel-source-4.12.14-95.108.1 o SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64): kernel-default-4.12.14-95.108.1 kernel-default-base-4.12.14-95.108.1 kernel-default-base-debuginfo-4.12.14-95.108.1 kernel-default-debuginfo-4.12.14-95.108.1 kernel-default-debugsource-4.12.14-95.108.1 kernel-default-devel-4.12.14-95.108.1 kernel-syms-4.12.14-95.108.1 o SUSE Linux Enterprise Server for SAP 12-SP4 (x86_64): kernel-default-devel-debuginfo-4.12.14-95.108.1 o SUSE Linux Enterprise Server for SAP 12-SP4 (noarch): kernel-devel-4.12.14-95.108.1 kernel-macros-4.12.14-95.108.1 kernel-source-4.12.14-95.108.1 o SUSE Linux Enterprise Server 12-SP4-LTSS (aarch64 ppc64le s390x x86_64): kernel-default-4.12.14-95.108.1 kernel-default-base-4.12.14-95.108.1 kernel-default-base-debuginfo-4.12.14-95.108.1 kernel-default-debuginfo-4.12.14-95.108.1 kernel-default-debugsource-4.12.14-95.108.1 kernel-default-devel-4.12.14-95.108.1 kernel-syms-4.12.14-95.108.1 o SUSE Linux Enterprise Server 12-SP4-LTSS (x86_64): kernel-default-devel-debuginfo-4.12.14-95.108.1 o SUSE Linux Enterprise Server 12-SP4-LTSS (noarch): kernel-devel-4.12.14-95.108.1 kernel-macros-4.12.14-95.108.1 kernel-source-4.12.14-95.108.1 o SUSE Linux Enterprise Server 12-SP4-LTSS (s390x): kernel-default-man-4.12.14-95.108.1 o SUSE Linux Enterprise Live Patching 12-SP4 (ppc64le s390x x86_64): kernel-default-kgraft-4.12.14-95.108.1 kernel-default-kgraft-devel-4.12.14-95.108.1 kgraft-patch-4_12_14-95_108-default-1-6.3.1 o SUSE Linux Enterprise High Availability 12-SP4 (ppc64le s390x x86_64): cluster-md-kmp-default-4.12.14-95.108.1 cluster-md-kmp-default-debuginfo-4.12.14-95.108.1 dlm-kmp-default-4.12.14-95.108.1 dlm-kmp-default-debuginfo-4.12.14-95.108.1 gfs2-kmp-default-4.12.14-95.108.1 gfs2-kmp-default-debuginfo-4.12.14-95.108.1 kernel-default-debuginfo-4.12.14-95.108.1 kernel-default-debugsource-4.12.14-95.108.1 ocfs2-kmp-default-4.12.14-95.108.1 ocfs2-kmp-default-debuginfo-4.12.14-95.108.1 References: o https://www.suse.com/security/cve/CVE-2020-36516.html o https://www.suse.com/security/cve/CVE-2020-36557.html o https://www.suse.com/security/cve/CVE-2020-36558.html o https://www.suse.com/security/cve/CVE-2021-4203.html o https://www.suse.com/security/cve/CVE-2022-20166.html o https://www.suse.com/security/cve/CVE-2022-20368.html o https://www.suse.com/security/cve/CVE-2022-20369.html o https://www.suse.com/security/cve/CVE-2022-21385.html o https://www.suse.com/security/cve/CVE-2022-2588.html o https://www.suse.com/security/cve/CVE-2022-26373.html o https://www.suse.com/security/cve/CVE-2022-2639.html o https://www.suse.com/security/cve/CVE-2022-2977.html o https://www.suse.com/security/cve/CVE-2022-3028.html o https://www.suse.com/security/cve/CVE-2022-36879.html o https://www.suse.com/security/cve/CVE-2022-36946.html o https://bugzilla.suse.com/1172145 o https://bugzilla.suse.com/1177440 o https://bugzilla.suse.com/1188944 o https://bugzilla.suse.com/1191881 o https://bugzilla.suse.com/1194535 o https://bugzilla.suse.com/1196616 o https://bugzilla.suse.com/1200598 o https://bugzilla.suse.com/1200770 o https://bugzilla.suse.com/1200910 o https://bugzilla.suse.com/1201019 o https://bugzilla.suse.com/1201420 o https://bugzilla.suse.com/1201429 o https://bugzilla.suse.com/1201705 o https://bugzilla.suse.com/1201726 o https://bugzilla.suse.com/1201940 o https://bugzilla.suse.com/1201948 o https://bugzilla.suse.com/1202096 o https://bugzilla.suse.com/1202154 o https://bugzilla.suse.com/1202346 o https://bugzilla.suse.com/1202347 o https://bugzilla.suse.com/1202393 o https://bugzilla.suse.com/1202396 o https://bugzilla.suse.com/1202672 o https://bugzilla.suse.com/1202897 o https://bugzilla.suse.com/1202898 o https://bugzilla.suse.com/1203098 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYyJqx8kNZI30y1K9AQhr+g//SnMk/vJE+ct+qSXZemrQN8m/6GRss8i/ 8NAqr3WvEx6W9R2hctokIo0ygY060IawG6Xp5waDYcxbnGgfmwL9ksfIAmPr+ixb Tn+cOnnmL0JSJ4RDRcsYjkTZqnc1KproGGuXUAJygP+hvR+HIPGzGNCd+iNXdHbf VwVXtnGAo3chvzSVB8dbJh+Fm2sVtUYsCe+7WltUlvuNBshQ0CwLXwgO7x/YIVBd Nx9kJTA01pkyVE0Jl5aYyccqUWCUYKT/ibX9/dnUvrRJeGtTBNQk/kCYutuKnkJB rEEqN5k+zOb7g6Dz/qNbaFdRcYQsFJNyEbt4Hp2HwqxPcX5EhLGwF0/u6nWPoseB TQLB1ZGPn/+YSUrWccsYTQhxk4wJlDjprPK4z1EIvy5N8DuLwbKd0uq/FnEKVuHg C+YUgmaEvu1Myh3RzGB7DG3vfNYoQ4Us9RTepHBzoGYkxG7dqXOmKLL5Nq5Viqu0 MbezpGlO/cfeFYi7R2S0A5kwEB3ObwTXEwJ4v3Q3itdVmkj2dAYjsmnzw7d333cv G6jaYNOD7zHZDVeDY9uBx+4kPZxHbZgmi1mnNphS6ZbFA/4g0dqtkABPt6SGkhR0 zJufbFM2/ABL+hD0m625yPb8peE/gpN/UO8p5/k8iuY/bZB1n7xF12IArdPrkykI jddbyScObGA= =0I98 -----END PGP SIGNATURE-----