CVE-2021-45485

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.(CVE-2021-4155)

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn t properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.(CVE-2021-45485)

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.(CVE-2021-45486)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• udf: Restore i_lenAlloc when inode expansion fails (Jan Kara) {CVE-2022-0617}
• udf: Fix NULL ptr deref when converting from inline format (Jan Kara) {CVE-2022-0617}
• Bluetooth: fix use-after-free error in lock_sock_nested() (Wang ShaoBo) {CVE-2021-3752}
• vt_kdsetmode: extend console locking (Linus Torvalds) {CVE-2021-3753}
• fget: check that the fd still exists after getting a ref to it (Linus Torvalds) {CVE-2021-4083}
• ipv6: use prandom_u32() for ID generation (Willy Tarreau) {CVE-2021-45485}
• virtio_console: Assure used length from device is limited (Xie Yongji) {CVE-2021-38160}
• bpf: Fix integer overflow in prealloc_elems_and_freelist() (Tatsuhiko Yasumatsu) {CVE-2021-41864}
• ext4: fix race writing to an inline_data file while its xattrs are changing (Theodore Ts'o) {CVE-2021-40490}
• xen-blkback: fix error handling in xen_blkbk_map() (Jan Beulich) {CVE-2021-26930}
• bpf, x86: Validate computation of branch displacements for x86-32 (Piotr Krysiuk) {CVE-2021-29154}
• bpf, x86: Validate computation of branch displacements for x86-64 (Piotr Krysiuk) {CVE-2021-29154}
• tipc: improve size validations for received domain records (Jon Paul Maloy) {CVE-2022-0435}
• cgroup: verify that source is a string (Christian Brauner) {CVE-2021-4154}

• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
• xirc2ps_cs: Fix use after free bug in xirc2ps_detach {CVE-2023-1670}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: use prandom_u32() for ID generation {CVE-2021-45485}

• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
• xirc2ps_cs: Fix use after free bug in xirc2ps_detach {CVE-2023-1670}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: use prandom_u32() for ID generation {CVE-2021-45485}

• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
• xirc2ps_cs: Fix use after free bug in xirc2ps_detach {CVE-2023-1670}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: use prandom_u32() for ID generation {CVE-2021-45485}

• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
• xirc2ps_cs: Fix use after free bug in xirc2ps_detach {CVE-2023-1670}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: use prandom_u32() for ID generation {CVE-2021-45485}

• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• netfilter: nf_tables: initialize registers in nft_do_chain() {CVE-2022-1016}
• xprtrdma: fix incorrect header size calculations {CVE-2022-0812}
• net: usb: fix memory leak in smsc75xx_bind {CVE-2021-47171}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Input: appletouch - initialize work before device registration {CVE-2021-46932}
• HID: usbhid: fix info leak in hid_submit_ctrl {CVE-2021-46906}
• quota: check block number when reading the block in quota file {CVE-2021-45868}
• mwifiex: Fix skb_over_panic in mwifiex_usb_recv() {CVE-2021-43976}
• atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait {CVE-2021-43975}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-43389}
• usb: hso: fix error handling code of hso_create_net_device {CVE-2021-37159}
• can: bcm: fix infoleak in struct bcm_msg_head {CVE-2021-34693}
• dm ioctl: fix out of bounds array access when no devices {CVE-2021-31916}
• KVM: x86: hyper-v: Fix Hyper-V context null-ptr-deref {CVE-2021-30178}
• perf/x86/intel: Fix a crash caused by zero PEBS status {CVE-2021-28971}
• btrfs: fix race when cloning extent buffer during rewind of an old root {CVE-2021-28964}
• ovl: fix missing negative dentry check in ovl_rename() {CVE-2021-20321}
• drm/ttm/nouveau: don't call tt destroy callback on alloc failure. {CVE-2021-20292}
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() {CVE-2021-4159}
• btrfs: unlock newly allocated extent buffer after error {CVE-2021-4149}
• tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. {CVE-2021-3679}
• net: mac802154: Fix general protection fault {CVE-2021-3659}
• nfsd4: readdirplus shouldn't return parent of export {CVE-2021-3178}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2021-0129}
• drm/nouveau: clean up all clients on device removal {CVE-2020-27820}
• drm/nouveau: Add a dedicated mutex for the clients list {CVE-2020-27820}
• drm/nouveau: use drm_dev_unplug() during device removal {CVE-2020-27820}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2020-26555}
• vsock: Fix memory leak in vsock_connect() {CVE-2022-3629}
• RDMA/core: Don't infoleak GRH fields {CVE-2021-3923}
• xen/netfront: force data bouncing when backend is untrusted {CVE-2022-33741}
• net: Rename and export copy_skb_header
• floppy: use a statically allocated error counter {CVE-2022-1652}
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• mISDN: fix use-after-free bugs in l1oip timer…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bnc#1192877)

The following non-security bugs were fixed:

• ACPI: battery: Accept charges over the design capacity as full (git-fixes).
• ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• ACPICA: Avoid evaluating methods too early during system resume (git-fixes).
• ALSA: ctxfi: Fix out-of-range access (git-fixes).
• ALSA: gus: fix null pointer dereference on pointer block (git-fixes).
• ALSA: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• ALSA: ISA: not for M68K (git-fixes).
• ALSA: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• ALSA: timer: Fix use-after-free problem (git-fixes).
• ALSA: timer: Unconditionally unlink slave instances, too (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• ARM: 8970/1: decompressor: increase tag size (git-fixes).
• ARM: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• ARM: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe (git-fixes)
• ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores (git-fixes)
• ARM: 9064/1: hw_breakpoint: Do not directly check the event's (git-fixes)
• ARM: 9071/1: uprobes: Do not hook on thumb…

The SUSE Linux Enterprise 15 SP3 kernel was updated

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573) You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

The following security bugs were fixed:

• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)

The following non-security bugs were fixed:

• ACPI: battery: Accept charges over the design capacity as full (git-fixes).
• ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• ACPICA: Avoid evaluating methods too early during system resume (git-fixes).
• Add SMB 2 support for getting and setting SACLs (bsc#1192606).
• Add to supported.conf: fs/smbfs_common/cifs_arc4 fs/smbfs_common/cifs_md4
• ALSA: ctxfi: Fix out-of-range access (git-fixes).
• ALSA: gus: fix null pointer dereference on pointer block (git-fixes).
• ALSA: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• ALSA: ISA: not for M68K (git-fixes).
• ALSA: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• ALSA: timer: Fix use-after-free problem (git-fixes).
• ALSA: timer: Unconditionally unlink slave instances, too (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• ARM: 8970/1: decompressor: increase tag size (git-fixes).
• ARM: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• ARM: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• ARM: 9019/1:…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517).
• CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
• CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower privileged ones that could lead to privilege escalation (bsc#1194302).
• CVE-2021-46283: nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace (bnc#1194518).
• CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
• CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free memory corruption (bsc#1194529)
• CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges on the system. (bnc#1193727).
• CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
• CVE-2021-45485: In the IPv6 implementation net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses (bnc#1194094).
• CVE-2021-45486: In the IPv4 implementation net/ipv4/route.c has an information leak because the hash table is very small (bnc#1194087).

The following non-security bugs were fixed:

• ACPI: APD: Check for NULL pointer after calling devm_ioremap() (git-fixes).
• ACPI: Add stubs for wakeup handler functions (git-fixes).
• ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes (git-fixes).
• ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: ctl: Fix copy of updated id with element read/write (git-fixes).
• ALSA: drivers: opl3: Fix incorrect use of vp->state (git-fixes).
• ALSA: hda/hdmi: Disable silent stream on GLK (git-fixes).
• ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform (git-fixes).
• ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100 (git-fixes).
• ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 (git-fixes).
• ALSA: hda/realtek: Fix quirk for Clevo NJ51CU (git-fixes).
• ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 (git-fixes).
• ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers (git-fixes).
• ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ (git-fixes).
• ALSA: hda: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: hda: Make proper use of timecounter (git-fixes).
• ALSA: jack: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: jack: Check the return value of kstrdup() (git-fixes).
• ALSA: oss: fix compile error when OSS_DEBUG is enabled (git-fixes).
• ALSA: pcm: oss: Fix negative period/buffer sizes (git-fixes).
• ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() (git-fixes).
• ALSA: pcm: oss: Limit the period size to 16MB (git-fixes).
• ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID (git-fixes).
• ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk (git-fixes).
• ASoC: codecs: wcd934x: handle channel mappping list correctly (git-fixes).
• ASoC: codecs: wcd934x:…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517).
• CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
• CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower privileged ones that could lead to privilege escalation (bsc#1194302).
• CVE-2021-46283: nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace (bnc#1194518).
• CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
• CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free memory corruption (bsc#1194529)
• CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4 (bnc#1193727).
• CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
• CVE-2021-45485: In the IPv6 implementation in net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses (bnc#1194094).
• CVE-2021-45486: In the IPv4 implementation in net/ipv4/route.c has an information leak because the hash table is very small (bnc#1194087).

The following non-security bugs were fixed:

• ACPI: APD: Check for NULL pointer after calling devm_ioremap() (git-fixes).
• ACPI: Add stubs for wakeup handler functions (git-fixes).
• ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes (git-fixes).
• ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: ctl: Fix copy of updated id with element read/write (git-fixes).
• ALSA: drivers: opl3: Fix incorrect use of vp->state (git-fixes).
• ALSA: hda/hdmi: Disable silent stream on GLK (git-fixes).
• ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform (git-fixes).
• ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100 (git-fixes).
• ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 (git-fixes).
• ALSA: hda/realtek: Fix quirk for Clevo NJ51CU (git-fixes).
• ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 (git-fixes).
• ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers (git-fixes).
• ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ (git-fixes).
• ALSA: hda: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: hda: Make proper use of timecounter (git-fixes).
• ALSA: jack: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: jack: Check the return value of kstrdup() (git-fixes).
• ALSA: oss: fix compile error when OSS_DEBUG is enabled (git-fixes).
• ALSA: pcm: oss: Fix negative period/buffer sizes (git-fixes).
• ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() (git-fixes).
• ALSA: pcm: oss: Limit the period size to 16MB (git-fixes).
• ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID (git-fixes).
• ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk (git-fixes).
• ASoC: codecs: wcd934x: handle channel mappping…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bnc#1192877)

The following non-security bugs were fixed:

• ACPI: battery: Accept charges over the design capacity as full (git-fixes).
• ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• ACPICA: Avoid evaluating methods too early during system resume (git-fixes).
• ALSA: ctxfi: Fix out-of-range access (git-fixes).
• ALSA: gus: fix null pointer dereference on pointer block (git-fixes).
• ALSA: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• ALSA: ISA: not for M68K (git-fixes).
• ALSA: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• ALSA: timer: Fix use-after-free problem (git-fixes).
• ALSA: timer: Unconditionally unlink slave instances, too (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• ARM: 8970/1: decompressor: increase tag size (git-fixes).
• ARM: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• ARM: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe (git-fixes)
• ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores (git-fixes)
• ARM: 9064/1: hw_breakpoint: Do not directly check the event's (git-fixes)
• ARM: 9071/1: uprobes: Do not hook on thumb…

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)
• CVE-2021-0935: Fixed out of bounds write due to a use after free which could lead to local escalation of privilege with System execution privileges needed in ip6_xmit. (bsc#1192032)
• CVE-2018-25020: Fixed an issue in the BPF subsystem in the Linux kernel mishandled situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. (bsc#1193575)
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc. (bsc#1193731)
• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bsc#1194087)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bsc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bsc#1179599)

The following non-security bugs were fixed:

• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• cifs: Add new mount parameter 'acdirmax' to allow caching directory metadata (bsc#1190317).
• cifs: Add new parameter 'acregmax' for distinct file and directory metadata timeout (bsc#1190317).
• cifs: convert list_for_each to entry variant (jsc#SLE-20656).
• cifs: convert revalidate of directories to using directory metadata cache timeout (bsc#1190317).
• cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED (bsc#1190317).
• cifs: fiemap: do not return EINVAL if get nothing (bsc#1190317).
• cifs: Fix a potencially linear read overflow (git-fixes).
• cifs: fix a sign extension bug (git-fixes).
• cifs: fix incorrect check for null pointer in header_assemble (bsc#1190317).
• cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1190317).
• cifs: fix missed refcounting of ipc tcon (git-fixes).
• cifs: fix potential use-after-free bugs (jsc#SLE-20656).
• cifs: fix print of hdr_flags in dfscache_proc_show() (jsc#SLE-20656).
• cifs: fix wrong release in sess_alloc_buffer() failed path (bsc#1190317).
• cifs: for compound requests, use open handle if possible (bsc#1190317).
• cifs: introduce new helper for cifs_reconnect() (jsc#SLE-20656).
• cifs: move to generic async completion (bsc#1190317).
• cifs: nosharesock…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that could allow an authenticate user to cause a denial of service (bnc#1192877).
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).

The following non-security bugs were fixed:

• acpi: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• acpi: battery: Accept charges over the design capacity as full (git-fixes).
• acpica: Avoid evaluating methods too early during system resume (git-fixes).
• alsa: ISA: not for M68K (git-fixes).
• alsa: ctxfi: Fix out-of-range access (git-fixes).
• alsa: gus: fix null pointer dereference on pointer block (git-fixes).
• alsa: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• alsa: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• alsa: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• alsa: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• alsa: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• alsa: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• alsa: timer: Fix use-after-free problem (git-fixes).
• alsa: timer: Unconditionally unlink slave instances, too (git-fixes).
• alsa: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• arm: 8970/1: decompressor: increase tag size (git-fixes).
• arm: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• arm: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• arm: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• arm: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe (git-fixes)
• arm: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores (git-fixes)
• arm: 9064/1: hw_breakpoint: Do not directly check…

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2021-4083: Fixed a race condition with Unix domain socket garbage collection that can lead to read memory after free. (bsc#1193727)
• CVE-2021-4149: Fixed an improper lock operation in btrfs which allows users to crash the kernel or deadlock the system. (bsc#1194001)
• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bsc#1194087)
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc. (bsc#1193731)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2018-25020: Fixed an issue in the BPF subsystem in the Linux kernel mishandled situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. (bsc#1193575)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2021-0935: Fixed out of bounds write due to a use after free which could lead to local escalation of privilege with System execution privileges needed in ip6_xmit. (bsc#1192032)
• CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bsc#1192847)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bsc#1179599)

The following non-security bugs were fixed:

• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22913)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22913).
• cifs: Add new mount parameter 'acdirmax' to allow caching directory metadata (bsc#1190317).
• cifs: Add new parameter 'acregmax' for distinct file and directory metadata timeout (bsc#1190317).
• cifs: convert list_for_each to entry variant (jsc#SLE-20656).
• cifs: convert revalidate of directories to using directory metadata cache timeout (bsc#1190317).
• cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED (bsc#1190317).
• cifs: fiemap: do not return EINVAL if get nothing (bsc#1190317).
• cifs: Fix a potencially linear read overflow (git-fixes).
• cifs: fix a sign extension bug (git-fixes).
• cifs: fix incorrect check for null pointer in header_assemble (bsc#1190317).
• cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1190317).
• cifs: fix missed refcounting of ipc tcon (git-fixes).
• cifs: fix…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2019-15126: Fixed a vulnerability in Broadcom and Cypress Wi-Fi chips, used in RPi family of devices aka 'Kr00k'. (bsc#1167162)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bsc#1179599)
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc. (bsc#1193731)
• CVE-2021-0935: Fixed out of bounds write due to a use after free which could lead to local escalation of privilege with System execution privileges needed in ip6_xmit. (bsc#1192032)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bsc#1192847)
• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bsc#1194087)

The following non-security bugs were fixed:

• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• cifs: fix missed refcounting of ipc tcon (git-fixes).
• cifs: nosharesock should be set on new server (git-fixes).
• config: INPUT_EVBUG=n (bsc#1192974). Debug driver unsuitable for production, only enabled on ppc64.
• constraints: Build aarch64 on recent ARMv8.1 builders. Request asimdrdm feature which is available only on recent ARMv8.1 CPUs. This should prevent scheduling the kernel on an older slower builder.
• edac/amd64: Handle three rank interleaving mode (bsc#1114648).
• elfcore: correct reference to CONFIG_UML (git-fixes).
• fuse: release pipe buf after last use (bsc#1193318).
• genirq: Move initial affinity setup to irq_startup() (bsc#1193231).
• genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP (bsc#1193231).
• genirq: Remove mask argument from setup_affinity() (bsc#1193231).
• genirq: Rename setup_affinity() to irq_setup_affinity() (bsc#1193231).
• genirq: Split out irq_startup() code (bsc#1193231).
• kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740).
• kernel-binary.spec.in Stop templating the scriptlets for subpackages (bsc#1190358). The script part for base package case is completely separate from the part for subpackages. Remove the part for subpackages from the base package script and use the KMP scripts for subpackages instead.
• kernel-binary.spec.in: add zstd to BuildRequires if used
• kernel-binary.spec.in: make sure zstd is supported by kmod if used
• kernel-binary.spec: Check for no kernel signing certificates. Also remove…

The SUSE Linux Enterprise 15 SP3 kernel was updated

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573) You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

The following security bugs were fixed:

• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)

The following non-security bugs were fixed:

• ACPI: battery: Accept charges over the design capacity as full (git-fixes).
• ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• ACPICA: Avoid evaluating methods too early during system resume (git-fixes).
• Add SMB 2 support for getting and setting SACLs (bsc#1192606).
• Add to supported.conf: fs/smbfs_common/cifs_arc4 fs/smbfs_common/cifs_md4
• ALSA: ctxfi: Fix out-of-range access (git-fixes).
• ALSA: gus: fix null pointer dereference on pointer block (git-fixes).
• ALSA: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• ALSA: ISA: not for M68K (git-fixes).
• ALSA: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• ALSA: timer: Fix use-after-free problem (git-fixes).
• ALSA: timer: Unconditionally unlink slave instances, too (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• ARM: 8970/1: decompressor: increase tag size (git-fixes).
• ARM: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• ARM: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• ARM: 9019/1:…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517).
• CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
• CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower privileged ones that could lead to privilege escalation (bsc#1194302).
• CVE-2021-46283: nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace (bnc#1194518).
• CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
• CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free memory corruption (bsc#1194529)
• CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges on the system. (bnc#1193727).
• CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
• CVE-2021-45485: In the IPv6 implementation net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses (bnc#1194094).
• CVE-2021-45486: In the IPv4 implementation net/ipv4/route.c has an information leak because the hash table is very small (bnc#1194087).

The following non-security bugs were fixed:

• ACPI: APD: Check for NULL pointer after calling devm_ioremap() (git-fixes).
• ACPI: Add stubs for wakeup handler functions (git-fixes).
• ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes (git-fixes).
• ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: ctl: Fix copy of updated id with element read/write (git-fixes).
• ALSA: drivers: opl3: Fix incorrect use of vp->state (git-fixes).
• ALSA: hda/hdmi: Disable silent stream on GLK (git-fixes).
• ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform (git-fixes).
• ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100 (git-fixes).
• ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 (git-fixes).
• ALSA: hda/realtek: Fix quirk for Clevo NJ51CU (git-fixes).
• ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 (git-fixes).
• ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers (git-fixes).
• ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ (git-fixes).
• ALSA: hda: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: hda: Make proper use of timecounter (git-fixes).
• ALSA: jack: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: jack: Check the return value of kstrdup() (git-fixes).
• ALSA: oss: fix compile error when OSS_DEBUG is enabled (git-fixes).
• ALSA: pcm: oss: Fix negative period/buffer sizes (git-fixes).
• ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() (git-fixes).
• ALSA: pcm: oss: Limit the period size to 16MB (git-fixes).
• ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID (git-fixes).
• ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk (git-fixes).
• ASoC: codecs: wcd934x: handle channel mappping list correctly (git-fixes).
• ASoC: codecs: wcd934x:…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517).
• CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel that occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower privileged ones that could lead to privilege escalation (bsc#1194302).
• CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
• CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free memory corruption (bsc#1194529)
• CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges on the system. (bnc#1193727).
• CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
• CVE-2021-45485: The IPv6 implementation in net/ipv6/output_core.c had an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses (bnc#1194094).
• CVE-2021-45486: The IPv4 implementation in net/ipv4/route.c had an information leak because the hash table is very small (bnc#1194087).
• CVE-2021-4001: A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. (bnc#1192990).
• CVE-2021-28715: Guest can force Linux netback driver to hog large amounts of kernel memory. Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There was a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. ()
• CVE-2021-28714: Guest can force Linux netback driver to hog large amounts of kernel memory. Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There was a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing (bnc#1193442).
• CVE-2021-28713: Rogue backends can cause DoS of guests via high frequency…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517).
• CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
• CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower privileged ones that could lead to privilege escalation (bsc#1194302).
• CVE-2021-46283: nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace (bnc#1194518).
• CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
• CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free memory corruption (bsc#1194529)
• CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4 (bnc#1193727).
• CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
• CVE-2021-45485: In the IPv6 implementation in net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses (bnc#1194094).
• CVE-2021-45486: In the IPv4 implementation in net/ipv4/route.c has an information leak because the hash table is very small (bnc#1194087).

The following non-security bugs were fixed:

• ACPI: APD: Check for NULL pointer after calling devm_ioremap() (git-fixes).
• ACPI: Add stubs for wakeup handler functions (git-fixes).
• ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes (git-fixes).
• ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: ctl: Fix copy of updated id with element read/write (git-fixes).
• ALSA: drivers: opl3: Fix incorrect use of vp->state (git-fixes).
• ALSA: hda/hdmi: Disable silent stream on GLK (git-fixes).
• ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform (git-fixes).
• ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED (git-fixes).
• ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100 (git-fixes).
• ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 (git-fixes).
• ALSA: hda/realtek: Fix quirk for Clevo NJ51CU (git-fixes).
• ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 (git-fixes).
• ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers (git-fixes).
• ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ (git-fixes).
• ALSA: hda: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: hda: Make proper use of timecounter (git-fixes).
• ALSA: jack: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
• ALSA: jack: Check the return value of kstrdup() (git-fixes).
• ALSA: oss: fix compile error when OSS_DEBUG is enabled (git-fixes).
• ALSA: pcm: oss: Fix negative period/buffer sizes (git-fixes).
• ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() (git-fixes).
• ALSA: pcm: oss: Limit the period size to 16MB (git-fixes).
• ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID (git-fixes).
• ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk (git-fixes).
• ASoC: codecs: wcd934x: handle channel mappping…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-4083: Fixed race condition in Unix domain socket garbage collection that could lead to read memory after free (bsc#1193727).
• CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
• CVE-2021-4149: Fixed improper lock operation in btrfs that allowed users to crash the kernel or deadlock the system (bsc#1194001).
• CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower privileged ones that could lead to privilege escalation (bsc#1194302).
• CVE-2021-4202: Fixed race condition in nci_request() that could cause use-after-free (bsc#1194529).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel that occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses (bsc#1194094).
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c (bnc#1194087).
• CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517).
• CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).

The following non-security bugs were fixed:

• ext4: Avoid trim error on fs with small groups (bsc#1191271).
• fget: clarify and improve __fget_files() implementation (bsc#1193727).
• kabi/severities: Add a kabi exception for drivers/tee/tee
• kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).
• livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
• media: Revert 'media: uvcvideo: Set unique vdev name based in type' (bsc#1193255).
• moxart: fix potential use-after-free on remove path (bsc#1194516).
• powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic (bsc#1193901).
• powerpc: handle kdump appropriately with crash_kexec_post_notifiers option (bsc#1193901).
• tpm: fix potential NULL pointer access in tpm_del_char_device (bsc#1184209, bsc#1193660).
• vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).

The SUSE Linux Enterprise 12 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
• CVE-2019-0136: Fixed insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver that may have allowed an unauthenticated user to potentially enable denial of service via adjacent access (bnc#1193157).
• CVE-2020-35519: Fixed out-of-bounds memory access in x25_bind in net/x25/af_x25.c. A bounds check failure allowed a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information (bnc#1183696).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that may have allowed an authenticated user to potentially cause denial of service via local access (bnc#1192877).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4155: Fixed XFS map issue when unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (bsc#1194272).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-43976: Fixed insufficient access control in drivers/net/wireless/marvell/mwifiex/usb.c that allowed an attacker who connect a crafted USB device to cause denial of service (bnc#1192847).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-45485: Fixed information leak in the IPv6 implementation in net/ipv6/output_core.c (bnc#1194094).
• CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table (bnc#1194087).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

-…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
• CVE-2019-0136: Fixed insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver that may have allowed an unauthenticated user to potentially enable denial of service via adjacent access (bnc#1193157).
• CVE-2020-35519: Fixed out-of-bounds memory access in x25_bind in net/x25/af_x25.c. A bounds check failure allowed a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information (bnc#1183696).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that may have allowed an authenticated user to potentially cause denial of service via local access (bnc#1192877).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4155: Fixed XFS map issue when unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (bsc#1194272).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-43976: Fixed insufficient access control in drivers/net/wireless/marvell/mwifiex/usb.c that allowed an attacker who connect a crafted USB device to cause denial of service (bnc#1192847).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-45485: Fixed information leak in the IPv6 implementation in net/ipv6/output_core.c (bnc#1194094).
• CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table (bnc#1194087).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

-…

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation could reassemble mixed encrypted and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets or exfiltrate selected fragments. (CVE-2020-26147)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access control. An authenticated attacker could possibly use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)

It was discovered that the RPA PCI Hotplug driver implementation in the Linux kernel did not properly handle device name writes via sysfs, leading to a buffer overflow. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-28972)

It was discovered that a use-after-free existed in the Bluetooth HCI driver of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33034)

Norbert Slusarek discovered that the CAN broadcast manger (bcm) protocol implementation in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2021-34693)

马哲宇 discovered that the IEEE 1394 (Firewire) nosy packet sniffer driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3483)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3564)

Murray McAllister discovered that the joystick device interface in the Linux kernel did not properly validate data passed via an ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code on systems with a joystick device registered. (CVE-2021-3612)

It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. (CVE-2021-3679)

It was discovered that the MAX-3421 host USB device driver in the Linux kernel did not properly handle device removal events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2021-38204)

It was discovered that the 6pack network protocol driver in the Linux kernel did not properly perform validation checks. A privileged attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-42008)

Amit Klein discovered that the IPv6 implementation in the Linux kernel could disclose internal state in some situations. An attacker could possibly use this to expose sensitive information. (CVE-2021-45485)

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. (CVE-2022-0492)

It was discovered that the aufs file system in the Linux kernel did not properly restrict mount namespaces, when mounted with the non-default allow_userns option set. A local attacker could use this to gain administrative privileges. (CVE-2016-2853)

It was discovered that the aufs file system in the Linux kernel did not properly maintain POSIX ACL xattr data, when mounted with the non-default allow_userns option. A local attacker could possibly use this to gain elevated privileges. (CVE-2016-2854)

It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use this to construct a malicious f2fs image that, when mounted and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-19449)

It was discovered that the XFS file system implementation in the Linux kernel did not properly validate meta data in some circumstances. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service. (CVE-2020-12655)

Kiyin (尹亮) discovered that the NFC LLCP protocol implementation in the Linux kernel contained a reference counting error. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25670)

Kiyin (尹亮) discovered that the NFC LLCP protocol implementation in the Linux kernel did not properly deallocate memory in certain error situations. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2020-25671, CVE-2020-25672)

Kiyin (尹亮) discovered that the NFC LLCP protocol implementation in the Linux kernel did not properly handle error conditions in some situations, leading to an infinite loop. A local attacker could use this to cause a denial of service. (CVE-2020-25673)

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation incorrectly handled EAPOL frames from unauthenticated senders. A physically proximate attacker could inject malicious packets to cause a denial of service (system crash). (CVE-2020-26139)

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation could reassemble mixed encrypted and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets or exfiltrate selected fragments. (CVE-2020-26147)

It was discovered that the BR/EDR pin-code pairing procedure in the Linux kernel was vulnerable to an impersonation attack. A physically proximate attacker could possibly use this to pair to a device without knowledge of the pin-code. (CVE-2020-26555)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access control. An authenticated attacker could possibly use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)

It was discovered that the FUSE user space file system implementation in the Linux kernel did not properly handle bad inodes in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2020-36322)

It was discovered that the Infiniband RDMA userspace connection manager implementation in the Linux kernel contained a race condition leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possible execute arbitrary code. (CVE-2020-36385)

It was discovered that the DRM subsystem in the Linux kernel contained double-free vulnerabilities. A privileged attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-20292)

It was discovered that a race condition existed in the timer implementation in the Linux kernel. A privileged attacker could use…