CVE-2021-33624

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.

The Linux Kernel, the operating system core itself.

Security Fix(es):

there was a null pointer dereference in llcp_sock_getname in net/nfc/llcp_sock.c and reproduced it in linux-5.13.0-rc2. An unprivileged user can trigger this bug and cause denial of service. #Root Cause After creating an nfc socket, bind the address by calling bind(), if LLCP_SAP_MAX was used as SAP, it cause the bind() failed and there would set llcp_sock->service_name as NULL. Although bind() returns an error here, it does not affect calling other socket functions. sock_getname() would invoke llcp_sock_getname(), llcp_sock_getname copied service name from llcp_sock->service_name by memcpy but llcp_sock->service_name is NULL. #Fix the patch for this issue: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=4ac06a1e013c(CVE-2021-3587)

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.(CVE-2020-36385)

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.(CVE-2020-28097)

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.(CVE-2021-33624)

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.(CVE-2021-35039)

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space(CVE-2021-22555)

A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user detaches bluetooth dongle or other way triggers unregister bluetooth device event. A local user could use this flaw to crash the system or escalate their privileges on the system.(CVE-2021-3573)

Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.(CVE-2021-0129)

net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.(CVE-2021-34693)

An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35.(CVE-2020-36387)

A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges.(CVE-2021-3609)

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.(CVE-2021-3600)

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.

This kernel-linus update is based on upstream 5.10.46 and fixes at least the following security issues:

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack (CVE-2021-33624).

net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693).

For other upstream fixes, see the referenced changelog.

This kernel update is based on upstream 5.10.46 and fixes at least the following security issues:

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack (CVE-2021-33624).

net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693).

For other upstream fixes, see the referenced changelog.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)

The following non-security bugs were fixed:

• 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• asm-generic/hyperv: Add missing function prototypes per -W1 warnings (bsc#1186071).
• ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
• bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• clocksource/drivers/hyper-v: Handle sched_clock differences inline (bsc#1186071).
• clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts (bsc#1186071).
• clocksource/drivers/hyper-v: Set clocksource rating based on Hyper-V feature (bsc#1186071).
• cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
• cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
• cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
• cxgb4: fix wrong shift (git-fixes).
• cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
• dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
• dax: Add an enum for specifying dax wakup mode (bsc#1187411).
• dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
• dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
• dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
• dmaengine: fsl-dpaa2-qdma: Fix error return code in two…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)

The following non-security bugs were fixed:

• 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
• bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
• cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
• cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
• cxgb4: fix wrong shift (git-fixes).
• cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
• dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
• dax: Add an enum for specifying dax wakup mode (bsc#1187411).
• dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
• dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
• dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
• dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions (git-fixes).
• dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc (git-fixes).
• dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM (git-fixes).
• dmaengine: stedma40: add missing iounmap() on error in d40_probe() (git-fixes).
• drm: Fix use-after-free read in drm_getunique() (git-fixes).
• drm: Lock pointer access in…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bnc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bnc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-33200: Fix leakage of uninitialized bpf stack under speculation. (bsc#1186484)

The following non-security bugs were fixed:

• af_packet: fix the tx skb protocol in raw sockets with ETH_P_ALL (bsc#1176081).
• kabi: preserve struct header_ops after bsc#1176081 fix (bsc#1176081).
• net: Do not set transport offset to invalid value (bsc#1176081).
• net: Introduce parse_protocol header_ops callback (bsc#1176081).
• net/ethernet: Add parse_protocol header_ops support (bsc#1176081).
• net/mlx5e: Remove the wrong assumption about transport offset (bsc#1176081).
• net/mlx5e: Trust kernel regarding transport offset (bsc#1176081).
• net/packet: Ask driver for protocol if not provided by user (bsc#1176081).
• net/packet: Remove redundant skb->protocol set (bsc#1176081).
• resource: Fix find_next_iomem_res() iteration issue (bsc#1181193).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).
• SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428).
• SUNRPC: More fixes for backlog congestion (bsc#1185428).
• x86/crash: Add e820 reserved ranges to kdump kernel's e820 table (bsc#1181193).
• x86/debug: Extend the lower bound of crash kernel low reservations (bsc#1153720).
• x86/e820, ioport: Add a new I/O resource descriptor IORES_DESC_RESERVED (bsc#1181193).
• x86/mm: Rework ioremap resource mapping determination (bsc#1181193).

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)

The following non-security bugs were fixed:

• 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• asm-generic/hyperv: Add missing function prototypes per -W1 warnings (bsc#1186071).
• ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
• bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• clocksource/drivers/hyper-v: Handle sched_clock differences inline (bsc#1186071).
• clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts (bsc#1186071).
• clocksource/drivers/hyper-v: Set clocksource rating based on Hyper-V feature (bsc#1186071).
• cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
• cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
• cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
• cxgb4: fix wrong shift (git-fixes).
• cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
• dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
• dax: Add an enum for specifying dax wakup mode (bsc#1187411).
• dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
• dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
• dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
• dmaengine: fsl-dpaa2-qdma: Fix error return code in two…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2019-25045: Fixed an use-after-free issue in the Linux kernel The XFRM subsystem, related to an xfrm_state_fini panic. (bsc#1187049)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)

The following non-security bugs were fixed:

• ALSA: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• blk-mq: Swap two calls in blk_mq_exit_queue() (bsc#1187453).
• blk-wbt: Fix missed wakeup (bsc#1186627).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• btrfs: account for new extents being deleted in total_bytes_pinned (bsc#1135481).
• btrfs: add a comment explaining the data flush steps (bsc#1135481).
• btrfs: add btrfs_reserve_data_bytes and use it (bsc#1135481).
• btrfs: add flushing states for handling data reservations (bsc#1135481).
• btrfs: add missing error handling after doing leaf/node binary search (bsc#1187833).
• btrfs: add the data transaction commit logic into may_commit_transaction (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when freeing reserved bytes (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when reserving space (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when unpinning anything (bsc#1135481).
• btrfs: change insert_dirty_subvol to return errors (bsc#1187833).
• btrfs: change nr to u64 in btrfs_start_delalloc_roots (bsc#1135481).
• btrfs: check record_root_in_trans related failures in select_reloc_root (bsc#1187833).
• btrfs: check return value of btrfs_commit_transaction in relocation (bsc#1187833).
• btrfs: check tickets after waiting on ordered extents (bsc#1135481).
• btrfs: cleanup error handling in prepare_to_merge (bsc#1187833).
• btrfs: convert BUG_ON()'s in relocate_tree_block (bsc#1187833).
• btrfs: convert BUG_ON()'s in select_reloc_root() to proper errors (bsc#1187833).
• btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s (bsc#1187833).
• btrfs: convert some BUG_ON()'s to ASSERT()'s in do_relocation (bsc#1187833).
• btrfs: do async reclaim for data reservations (bsc#1135481).
• btrfs: do not force commit if we are data (bsc#1135481).
• btrfs: do not leak reloc root if we fail to read the fs root (bsc#1187833).
• btrfs: do not make defrag wait on async_delalloc_pages (bsc#1135481).
• btrfs: do not…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2019-25045: Fixed an use-after-free issue in the Linux kernel The XFRM subsystem, related to an xfrm_state_fini panic. (bsc#1187049)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)

The following non-security bugs were fixed:

• ALSA: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• blk-mq: Swap two calls in blk_mq_exit_queue() (bsc#1187453).
• blk-wbt: Fix missed wakeup (bsc#1186627).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• btrfs: account for new extents being deleted in total_bytes_pinned (bsc#1135481).
• btrfs: add a comment explaining the data flush steps (bsc#1135481).
• btrfs: add btrfs_reserve_data_bytes and use it (bsc#1135481).
• btrfs: add flushing states for handling data reservations (bsc#1135481).
• btrfs: add missing error handling after doing leaf/node binary search (bsc#1187833).
• btrfs: add the data transaction commit logic into may_commit_transaction (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when freeing reserved bytes (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when reserving space (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when unpinning anything (bsc#1135481).
• btrfs: change insert_dirty_subvol to return errors (bsc#1187833).
• btrfs: change nr to u64 in btrfs_start_delalloc_roots (bsc#1135481).
• btrfs: check record_root_in_trans related failures in select_reloc_root (bsc#1187833).
• btrfs: check return value of btrfs_commit_transaction in relocation (bsc#1187833).
• btrfs: check tickets after waiting on ordered extents (bsc#1135481).
• btrfs: cleanup error handling in prepare_to_merge (bsc#1187833).
• btrfs: convert BUG_ON()'s in relocate_tree_block (bsc#1187833).
• btrfs: convert BUG_ON()'s in select_reloc_root() to proper errors (bsc#1187833).
• btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s (bsc#1187833).
• btrfs: convert some BUG_ON()'s to ASSERT()'s in do_relocation (bsc#1187833).
• btrfs: do async reclaim for data reservations (bsc#1135481).
• btrfs: do not force commit if we are data (bsc#1135481).
• btrfs: do not leak reloc root if we fail to read the fs root (bsc#1187833).
• btrfs: do not make defrag wait on async_delalloc_pages (bsc#1135481).
• btrfs: do not…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling ioremap…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2019-25045: Fixed an use-after-free issue in the Linux kernel The XFRM subsystem, related to an xfrm_state_fini panic. (bsc#1187049)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)

The following non-security bugs were fixed:

• ACPI: custom_method: fix a possible memory leak (git-fixes).
• ACPI: custom_method: fix potential use-after-free issue (git-fixes).
• ACPI: GTDT: Do not corrupt interrupt mappings on watchdow probe failure (git-fixes).
• ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro (git-fixes).
• ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer (git-fixes).
• ALSA: hda/conexant: Re-order CX5066 quirk table entries (git-fixes).
• ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries (git-fixes).
• ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries (git-fixes).
• ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries (git-fixes).
• ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries (git-fixes).
• ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices (git-fixes).
• ALSA: hda/realtek: reset eapd coeff to default value for alc287 (git-fixes).
• ALSA: hdsp: do not disable if not enabled (git-fixes).
• ALSA: hdspm: do not disable if not enabled (git-fixes).
• ALSA: line6: Fix racy initialization of LINE6 MIDI (git-fixes).
• ALSA: rme9652: do not disable if not enabled (git-fixes).
• ALSA: sb: Fix two use after free in snd_sb_qsound_build (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: cs35l33: fix an error code in probe() (git-fixes).
• ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
• ASoC: rt286: Generalize support for ALC3263 codec (git-fixes).
• ASoC: rt286: Make RT286_SET_GPIO_* readable and writable (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• blk-mq: Swap two calls in blk_mq_exit_queue() (bsc#1187453).
• blk-wbt: Fix missed wakeup (bsc#1186627).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Bluetooth: initialize skb_queue_head at l2cap_chan_create() (git-fixes).
• Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default (git-fixes).
• Bluetooth: SMP: Fail if remote and local public keys are identical (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)

The following non-security bugs were fixed:

• 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
• bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
• cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
• cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
• cxgb4: fix wrong shift (git-fixes).
• cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
• dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
• dax: Add an enum for specifying dax wakup mode (bsc#1187411).
• dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
• dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
• dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
• dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions (git-fixes).
• dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc (git-fixes).
• dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM (git-fixes).
• dmaengine: stedma40: add missing iounmap() on error in d40_probe() (git-fixes).
• drm: Fix use-after-free read in drm_getunique() (git-fixes).
• drm: Lock pointer access in…

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116 ).
• CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062).
• CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
• CVE-2021-33624: In kernel/bpf/verifier.c a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db (bnc#1187554).
• CVE-2021-0605: In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1187601).
• CVE-2021-0512: In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1187595).
• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time (bnc#1179610).
• CVE-2021-34693: net/can/bcm.c in the Linux kernel allowed local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized (bnc#1187452).
• CVE-2020-36385: An issue was discovered in the Linux kernel drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c (bnc#1187050).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36386: An issue was discovered in the Linux kernel net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf (bnc#1187038).
• CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets (bnc#1185861).
• CVE-2021-33200: kernel/bpf/verifier.c enforced incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit (bnc#1186484).
• CVE-2021-33034: net/bluetooth/hci_event.c had a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value (bnc#1186111).
• CVE-2020-26139: An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients (bnc#1186062).…

The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116).
• CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062).
• CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
• CVE-2021-33624: In kernel/bpf/verifier.c a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db (bnc#1187554).
• CVE-2021-0605: In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the kernel with System execution privileges needed. User interaction is not needed for exploitation (bnc#1187601).
• CVE-2021-0512: In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1187595).
• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time (bnc#1179610 bnc#1186463).
• CVE-2021-34693: net/can/bcm.c allowed local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized (bnc#1187452).
• CVE-2020-36385: An issue was discovered in drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c (bnc#1187050).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36386: An issue was discovered net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf (bnc#1187038).
• CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets (bnc#1185861).
• CVE-2021-33200: kernel/bpf/verifier.c enforced incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit (bnc#1186484).

The following non-security bugs were fixed:

• block: do not use blocking queue entered for recursive bio (bsc#1104967).
• s390/stack: fix possible register corruption with stack switch helper (git-fixes).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bnc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bnc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-33200: Fix leakage of uninitialized bpf stack under speculation. (bsc#1186484)

The following non-security bugs were fixed:

• af_packet: fix the tx skb protocol in raw sockets with ETH_P_ALL (bsc#1176081).
• kabi: preserve struct header_ops after bsc#1176081 fix (bsc#1176081).
• net: Do not set transport offset to invalid value (bsc#1176081).
• net: Introduce parse_protocol header_ops callback (bsc#1176081).
• net/ethernet: Add parse_protocol header_ops support (bsc#1176081).
• net/mlx5e: Remove the wrong assumption about transport offset (bsc#1176081).
• net/mlx5e: Trust kernel regarding transport offset (bsc#1176081).
• net/packet: Ask driver for protocol if not provided by user (bsc#1176081).
• net/packet: Remove redundant skb->protocol set (bsc#1176081).
• resource: Fix find_next_iomem_res() iteration issue (bsc#1181193).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).
• SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428).
• SUNRPC: More fixes for backlog congestion (bsc#1185428).
• x86/crash: Add e820 reserved ranges to kdump kernel's e820 table (bsc#1181193).
• x86/debug: Extend the lower bound of crash kernel low reservations (bsc#1153720).
• x86/e820, ioport: Add a new I/O resource descriptor IORES_DESC_RESERVED (bsc#1181193).
• x86/mm: Rework ioremap resource mapping determination (bsc#1181193).

Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. (CVE-2021-33624)

It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

Alexey Kardashevskiy discovered that the KVM implementation for PowerPC systems in the Linux kernel did not properly validate RTAS arguments in some situations. An attacker in a guest vm could use this to cause a denial of service (host OS crash) or possibly execute arbitrary code. (CVE-2021-37576)

It was discovered that the Virtio console implementation in the Linux kernel did not properly validate input lengths in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38160)

Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly order connection setup operations. An attacker controlling a remote NFS server could use this to cause a denial of service on the client. (CVE-2021-38199)

It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2021-38204)

Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. (CVE-2021-33624)

It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

It was discovered that the Virtio console implementation in the Linux kernel did not properly validate input lengths in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38160)

Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly order connection setup operations. An attacker controlling a remote NFS server could use this to cause a denial of service on the client. (CVE-2021-38199)

It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2021-38204)

Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. (CVE-2021-41073)

Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. (CVE-2021-33624)

Benedict Schlueter discovered that the BPF subsystem in the Linux kernel did not properly protect against Speculative Store Bypass (SSB) side- channel attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-34556)

Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly protect against Speculative Store Bypass (SSB) side-channel attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-35477)

It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly handle error conditions. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

Alexey Kardashevskiy discovered that the KVM implementation for PowerPC systems in the Linux kernel did not properly validate RTAS arguments in some situations. An attacker in a guest vm could use this to cause a denial of service (host OS crash) or possibly execute arbitrary code. (CVE-2021-37576)

It was discovered that the Virtio console implementation in the Linux kernel did not properly validate input lengths in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38160)

Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly order connection setup operations. An attacker controlling a remote NFS server could use this to cause a denial of service on the client. (CVE-2021-38199)

It was discovered that the Sun RPC implementation in the Linux kernel contained an out-of-bounds access error. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38201)

It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2021-38204)

It was discovered that the Xilinx 10/100 Ethernet Lite device driver in the Linux kernel could report pointer addresses in some situations. An attacker could use this information to ease the exploitation of another vulnerability. (CVE-2021-38205)

Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. (CVE-2021-41073)

Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. (CVE-2021-33624)

Benedict Schlueter discovered that the BPF subsystem in the Linux kernel did not properly protect against Speculative Store Bypass (SSB) side- channel attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-34556)

Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly protect against Speculative Store Bypass (SSB) side-channel attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-35477)

It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly handle error conditions. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

Alexey Kardashevskiy discovered that the KVM implementation for PowerPC systems in the Linux kernel did not properly validate RTAS arguments in some situations. An attacker in a guest vm could use this to cause a denial of service (host OS crash) or possibly execute arbitrary code. (CVE-2021-37576)

It was discovered that the Virtio console implementation in the Linux kernel did not properly validate input lengths in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38160)

Michael Wakabayashi discovered that the NFSv4 client implementation in the Linux kernel did not properly order connection setup operations. An attacker controlling a remote NFS server could use this to cause a denial of service on the client. (CVE-2021-38199)

It was discovered that the Sun RPC implementation in the Linux kernel contained an out-of-bounds access error. A remote attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-38201)

It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2021-38204)

It was discovered that the Xilinx 10/100 Ethernet Lite device driver in the Linux kernel could report pointer addresses in some situations. An attacker could use this information to ease the exploitation of another vulnerability. (CVE-2021-38205)

It was discovered that a race condition existed in the Atheros Ath9k WiFi driver in the Linux kernel. An attacker could possibly use this to expose sensitive information (WiFi network traffic). (CVE-2020-3702)

Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. (CVE-2021-33624)

Benedict Schlueter discovered that the BPF subsystem in the Linux kernel did not properly protect against Speculative Store Bypass (SSB) side- channel attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-34556)

Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly protect against Speculative Store Bypass (SSB) side-channel attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-35477)

It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly handle error conditions. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

It was discovered that the btrfs file system in the Linux kernel did not properly handle removing a non-existent device id. An attacker with CAP_SYS_ADMIN could use this to cause a denial of service. (CVE-2021-3739)

It was discovered that the Qualcomm IPC Router protocol implementation in the Linux kernel did not properly validate metadata in some situations. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2021-3743)

It was discovered that the virtual terminal (vt) device implementation in the Linux kernel contained a race condition in its ioctl handling that led to an out-of-bounds read vulnerability. A local attacker could possibly use this to expose sensitive information. (CVE-2021-3753)

It was discovered that the Linux kernel did not properly account for the memory usage of certain IPC objects. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3759)

It was discovered that the BPF subsystem in the Linux kernel contained an integer overflow in its hash table implementation. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-38166)

It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2021-38204)

It was discovered that the Xilinx 10/100 Ethernet Lite device driver in the Linux kernel could report pointer addresses in some situations. An attacker could use this information to ease the exploitation of another vulnerability. (CVE-2021-38205)

It was discovered that the ext4 file system in the Linux kernel contained a race condition when writing xattrs to an inode. A local attacker could use this to cause a denial of service or possibly gain administrative privileges. (CVE-2021-40490)

It was discovered that the 6pack network protocol driver in the Linux kernel did not properly perform validation checks. A privileged attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-42008)