-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2022.4580
                   Security update for the Linux Kernel
                             15 September 2022

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Linux Kernel
Publisher:         SUSE
Operating System:  SUSE
Resolution:        Patch/Upgrade
CVE Names:         CVE-2022-36946 CVE-2022-36879 CVE-2022-26373
                   CVE-2022-21385 CVE-2022-20369 CVE-2022-20368
                   CVE-2022-20166 CVE-2022-3028 CVE-2022-2977
                   CVE-2022-2639 CVE-2022-2588 CVE-2021-4203
                   CVE-2020-36558 CVE-2020-36557 CVE-2020-36516

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2022/suse-su-20223274-1

Comment: CVSS (Max):  8.1 CVE-2020-36516 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
         CVSS Source: SUSE
         Calculator:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

- --------------------------BEGIN INCLUDED TEXT--------------------

SUSE Security Update: Security update for the Linux Kernel

______________________________________________________________________________

Announcement ID:   SUSE-SU-2022:3274-1
Rating:            important
References:        #1172145 #1177440 #1188944 #1191881 #1194535 #1196616
                   #1200598 #1200770 #1200910 #1201019 #1201420 #1201429
                   #1201705 #1201726 #1201940 #1201948 #1202096 #1202154
                   #1202346 #1202347 #1202393 #1202396 #1202672 #1202897
                   #1202898 #1203098
Cross-References:  CVE-2020-36516 CVE-2020-36557 CVE-2020-36558 CVE-2021-4203
                   CVE-2022-20166 CVE-2022-20368 CVE-2022-20369 CVE-2022-21385
                   CVE-2022-2588 CVE-2022-26373 CVE-2022-2639 CVE-2022-2977
                   CVE-2022-3028 CVE-2022-36879 CVE-2022-36946
Affected Products:
                   SUSE Linux Enterprise High Availability 12-SP4
                   SUSE Linux Enterprise High Performance Computing 12-SP4
                   SUSE Linux Enterprise Live Patching 12-SP4
                   SUSE Linux Enterprise Server 12-SP4
                   SUSE Linux Enterprise Server 12-SP4-LTSS
                   SUSE Linux Enterprise Server for SAP 12-SP4
                   SUSE OpenStack Cloud 9
                   SUSE OpenStack Cloud Crowbar 9
______________________________________________________________________________

An update that solves 15 vulnerabilities and has 11 fixes is now available.

Description:


The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various
security and bugfixes.

The following security bugs were fixed:

  o CVE-2022-36946: Fixed a denial of service (panic) inside nfqnl_mangle in
    net/netfilter/nfnetlink_queue.c (bnc#1201940).
  o CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/
    xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
  o CVE-2022-3028: Fixed race condition that was found in the IP framework for
    transforming packets (XFRM subsystem) (bnc#1202898).
  o CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
  o CVE-2022-2639: Fixed an integer coercion error that was found in the
    openvswitch kernel module (bnc#1202154).
  o CVE-2022-26373: Fixed non-transparent sharing of return predictor targets
    between contexts in some Intel Processors (bnc#1201726).
  o CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
  o CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed
    unprivileged local users to crash the machine (bnc#1202897).
  o CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of
    v4l2-mem2mem.c (bnc#1202347).
  o CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#
    1202346).
  o CVE-2022-20166: Fixed possible out of bounds write due to a heap buffer
    overflow in various methods of kernel base drivers (bnc#1200598).
  o CVE-2021-4203: Fixed use-after-free read flaw that was found in
    sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS
    race with listen() (bnc#1194535).
  o CVE-2020-36558: Fixed a race condition involving VT_RESIZEX could lead to a
    NULL pointer dereference and general protection fault (bnc#1200910).
  o CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and
    closing/opening of ttys that could have led to a use-after-free (bnc#
    1201429).
  o CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an
    attacker was able to inject data into or terminate a victim's TCP session
    (bnc#1196616).


The following non-security bugs were fixed:

  o cifs: fix error paths in cifs_tree_connect() (bsc#1177440).
  o cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share
    (bsc#1188944).
  o cifs: report error instead of invalid when revalidating a dentry fails (bsc
    #1177440).
  o cifs: skip trailing separators of prefix paths (bsc#1188944).
  o kernel-obs-build: include qemu_fw_cfg (boo#1201705)
  o lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420
    ZDI-CAN-17325).
  o mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc#
    1203098).
  o mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes,
    bsc#1203098).
  o net_sched: cls_route: disallow handle of 0 (bsc#1202393).
  o objtool: Add --backtrace support (bsc#1202396).
  o objtool: Add support for intra-function calls (bsc#1202396).
  o objtool: Allow no-op CFI ops in alternatives (bsc#1202396).
  o objtool: Convert insn type to enum (bsc#1202396).
  o objtool: Do not use ignore flag for fake jumps (bsc#1202396).
  o objtool: Fix !CFI insn_state propagation (bsc#1202396).
  o objtool: Fix ORC vs alternatives (bsc#1202396).
  o objtool: Fix sibling call detection (bsc#1202396).
  o objtool: Make handle_insn_ops() unconditional (bsc#1202396).
  o objtool: Remove INSN_STACK (bsc#1202396).
  o objtool: Remove check preventing branches within alternative (bsc#1202396).
  o objtool: Rename elf_open() to prevent conflict with libelf from
    elftoolchain (bsc#1202396).
  o objtool: Rename struct cfi_state (bsc#1202396).
  o objtool: Rework allocating stack_ops on decode (bsc#1202396).
  o objtool: Rewrite alt->skip_orig (bsc#1202396).
  o objtool: Set insn->func for alternatives (bsc#1202396).
  o objtool: Support conditional retpolines (bsc#1202396).
  o objtool: Support multiple stack_op per instruction (bsc#1202396).
  o objtool: Track original function across branches (bsc#1202396).
  o objtool: Uniquely identify alternative instruction groups (bsc#1202396).
  o objtool: Use Elf_Scn typedef instead of assuming struct name (bsc#1202396).
  o powerpc/pci: Fix broken INTx configuration via OF (bsc#1172145 ltc#184630
    bsc#1200770 ltc#198666).
  o powerpc/pci: Remove LSI mappings on device teardown (bsc#1172145 ltc#184630
    bsc#1200770 ltc#198666).
  o powerpc/pci: Use of_irq_parse_and_map_pci() helper (bsc#1172145 ltc#184630
    bsc#1200770 ltc#198666).
  o rpm: Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).

Special Instructions and Notes:

Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE OpenStack Cloud Crowbar 9:
    zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-3274=1
  o SUSE OpenStack Cloud 9:
    zypper in -t patch SUSE-OpenStack-Cloud-9-2022-3274=1
  o SUSE Linux Enterprise Server for SAP 12-SP4:
    zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-3274=1
  o SUSE Linux Enterprise Server 12-SP4-LTSS:
    zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-3274=1
  o SUSE Linux Enterprise Live Patching 12-SP4:
    zypper in -t patch SUSE-SLE-Live-Patching-12-SP4-2022-3274=1
    Please note that this is the initial kernel livepatch without fixes itself,
    this package is later updated by seperate standalone kernel livepatch
    updates.
  o SUSE Linux Enterprise High Availability 12-SP4:
    zypper in -t patch SUSE-SLE-HA-12-SP4-2022-3274=1

Package List:

  o SUSE OpenStack Cloud Crowbar 9 (x86_64):
       kernel-default-4.12.14-95.108.1
       kernel-default-base-4.12.14-95.108.1
       kernel-default-base-debuginfo-4.12.14-95.108.1
       kernel-default-debuginfo-4.12.14-95.108.1
       kernel-default-debugsource-4.12.14-95.108.1
       kernel-default-devel-4.12.14-95.108.1
       kernel-default-devel-debuginfo-4.12.14-95.108.1
       kernel-syms-4.12.14-95.108.1
  o SUSE OpenStack Cloud Crowbar 9 (noarch):
       kernel-devel-4.12.14-95.108.1
       kernel-macros-4.12.14-95.108.1
       kernel-source-4.12.14-95.108.1
  o SUSE OpenStack Cloud 9 (x86_64):
       kernel-default-4.12.14-95.108.1
       kernel-default-base-4.12.14-95.108.1
       kernel-default-base-debuginfo-4.12.14-95.108.1
       kernel-default-debuginfo-4.12.14-95.108.1
       kernel-default-debugsource-4.12.14-95.108.1
       kernel-default-devel-4.12.14-95.108.1
       kernel-default-devel-debuginfo-4.12.14-95.108.1
       kernel-syms-4.12.14-95.108.1
  o SUSE OpenStack Cloud 9 (noarch):
       kernel-devel-4.12.14-95.108.1
       kernel-macros-4.12.14-95.108.1
       kernel-source-4.12.14-95.108.1
  o SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64):
       kernel-default-4.12.14-95.108.1
       kernel-default-base-4.12.14-95.108.1
       kernel-default-base-debuginfo-4.12.14-95.108.1
       kernel-default-debuginfo-4.12.14-95.108.1
       kernel-default-debugsource-4.12.14-95.108.1
       kernel-default-devel-4.12.14-95.108.1
       kernel-syms-4.12.14-95.108.1
  o SUSE Linux Enterprise Server for SAP 12-SP4 (x86_64):
       kernel-default-devel-debuginfo-4.12.14-95.108.1
  o SUSE Linux Enterprise Server for SAP 12-SP4 (noarch):
       kernel-devel-4.12.14-95.108.1
       kernel-macros-4.12.14-95.108.1
       kernel-source-4.12.14-95.108.1
  o SUSE Linux Enterprise Server 12-SP4-LTSS (aarch64 ppc64le s390x x86_64):
       kernel-default-4.12.14-95.108.1
       kernel-default-base-4.12.14-95.108.1
       kernel-default-base-debuginfo-4.12.14-95.108.1
       kernel-default-debuginfo-4.12.14-95.108.1
       kernel-default-debugsource-4.12.14-95.108.1
       kernel-default-devel-4.12.14-95.108.1
       kernel-syms-4.12.14-95.108.1
  o SUSE Linux Enterprise Server 12-SP4-LTSS (x86_64):
       kernel-default-devel-debuginfo-4.12.14-95.108.1
  o SUSE Linux Enterprise Server 12-SP4-LTSS (noarch):
       kernel-devel-4.12.14-95.108.1
       kernel-macros-4.12.14-95.108.1
       kernel-source-4.12.14-95.108.1
  o SUSE Linux Enterprise Server 12-SP4-LTSS (s390x):
       kernel-default-man-4.12.14-95.108.1
  o SUSE Linux Enterprise Live Patching 12-SP4 (ppc64le s390x x86_64):
       kernel-default-kgraft-4.12.14-95.108.1
       kernel-default-kgraft-devel-4.12.14-95.108.1
       kgraft-patch-4_12_14-95_108-default-1-6.3.1
  o SUSE Linux Enterprise High Availability 12-SP4 (ppc64le s390x x86_64):
       cluster-md-kmp-default-4.12.14-95.108.1
       cluster-md-kmp-default-debuginfo-4.12.14-95.108.1
       dlm-kmp-default-4.12.14-95.108.1
       dlm-kmp-default-debuginfo-4.12.14-95.108.1
       gfs2-kmp-default-4.12.14-95.108.1
       gfs2-kmp-default-debuginfo-4.12.14-95.108.1
       kernel-default-debuginfo-4.12.14-95.108.1
       kernel-default-debugsource-4.12.14-95.108.1
       ocfs2-kmp-default-4.12.14-95.108.1
       ocfs2-kmp-default-debuginfo-4.12.14-95.108.1


References:

  o https://www.suse.com/security/cve/CVE-2020-36516.html
  o https://www.suse.com/security/cve/CVE-2020-36557.html
  o https://www.suse.com/security/cve/CVE-2020-36558.html
  o https://www.suse.com/security/cve/CVE-2021-4203.html
  o https://www.suse.com/security/cve/CVE-2022-20166.html
  o https://www.suse.com/security/cve/CVE-2022-20368.html
  o https://www.suse.com/security/cve/CVE-2022-20369.html
  o https://www.suse.com/security/cve/CVE-2022-21385.html
  o https://www.suse.com/security/cve/CVE-2022-2588.html
  o https://www.suse.com/security/cve/CVE-2022-26373.html
  o https://www.suse.com/security/cve/CVE-2022-2639.html
  o https://www.suse.com/security/cve/CVE-2022-2977.html
  o https://www.suse.com/security/cve/CVE-2022-3028.html
  o https://www.suse.com/security/cve/CVE-2022-36879.html
  o https://www.suse.com/security/cve/CVE-2022-36946.html
  o https://bugzilla.suse.com/1172145
  o https://bugzilla.suse.com/1177440
  o https://bugzilla.suse.com/1188944
  o https://bugzilla.suse.com/1191881
  o https://bugzilla.suse.com/1194535
  o https://bugzilla.suse.com/1196616
  o https://bugzilla.suse.com/1200598
  o https://bugzilla.suse.com/1200770
  o https://bugzilla.suse.com/1200910
  o https://bugzilla.suse.com/1201019
  o https://bugzilla.suse.com/1201420
  o https://bugzilla.suse.com/1201429
  o https://bugzilla.suse.com/1201705
  o https://bugzilla.suse.com/1201726
  o https://bugzilla.suse.com/1201940
  o https://bugzilla.suse.com/1201948
  o https://bugzilla.suse.com/1202096
  o https://bugzilla.suse.com/1202154
  o https://bugzilla.suse.com/1202346
  o https://bugzilla.suse.com/1202347
  o https://bugzilla.suse.com/1202393
  o https://bugzilla.suse.com/1202396
  o https://bugzilla.suse.com/1202672
  o https://bugzilla.suse.com/1202897
  o https://bugzilla.suse.com/1202898
  o https://bugzilla.suse.com/1203098

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBYyJqx8kNZI30y1K9AQhr+g//SnMk/vJE+ct+qSXZemrQN8m/6GRss8i/
8NAqr3WvEx6W9R2hctokIo0ygY060IawG6Xp5waDYcxbnGgfmwL9ksfIAmPr+ixb
Tn+cOnnmL0JSJ4RDRcsYjkTZqnc1KproGGuXUAJygP+hvR+HIPGzGNCd+iNXdHbf
VwVXtnGAo3chvzSVB8dbJh+Fm2sVtUYsCe+7WltUlvuNBshQ0CwLXwgO7x/YIVBd
Nx9kJTA01pkyVE0Jl5aYyccqUWCUYKT/ibX9/dnUvrRJeGtTBNQk/kCYutuKnkJB
rEEqN5k+zOb7g6Dz/qNbaFdRcYQsFJNyEbt4Hp2HwqxPcX5EhLGwF0/u6nWPoseB
TQLB1ZGPn/+YSUrWccsYTQhxk4wJlDjprPK4z1EIvy5N8DuLwbKd0uq/FnEKVuHg
C+YUgmaEvu1Myh3RzGB7DG3vfNYoQ4Us9RTepHBzoGYkxG7dqXOmKLL5Nq5Viqu0
MbezpGlO/cfeFYi7R2S0A5kwEB3ObwTXEwJ4v3Q3itdVmkj2dAYjsmnzw7d333cv
G6jaYNOD7zHZDVeDY9uBx+4kPZxHbZgmi1mnNphS6ZbFA/4g0dqtkABPt6SGkhR0
zJufbFM2/ABL+hD0m625yPb8peE/gpN/UO8p5/k8iuY/bZB1n7xF12IArdPrkykI
jddbyScObGA=
=0I98
-----END PGP SIGNATURE-----