CVE-2020-36385

The Linux Kernel, the operating system core itself.

Security Fix(es):

there was a null pointer dereference in llcp_sock_getname in net/nfc/llcp_sock.c and reproduced it in linux-5.13.0-rc2. An unprivileged user can trigger this bug and cause denial of service. #Root Cause After creating an nfc socket, bind the address by calling bind(), if LLCP_SAP_MAX was used as SAP, it cause the bind() failed and there would set llcp_sock->service_name as NULL. Although bind() returns an error here, it does not affect calling other socket functions. sock_getname() would invoke llcp_sock_getname(), llcp_sock_getname copied service name from llcp_sock->service_name by memcpy but llcp_sock->service_name is NULL. #Fix the patch for this issue: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=4ac06a1e013c(CVE-2021-3587)

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.(CVE-2020-36385)

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.(CVE-2020-28097)

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.(CVE-2021-33624)

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.(CVE-2021-35039)

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space(CVE-2021-22555)

A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user detaches bluetooth dongle or other way triggers unregister bluetooth device event. A local user could use this flaw to crash the system or escalate their privileges on the system.(CVE-2021-3573)

Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.(CVE-2021-0129)

net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.(CVE-2021-34693)

An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35.(CVE-2020-36387)

A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges.(CVE-2021-3609)

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.(CVE-2021-3600)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

• kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers() of hid-input.c (CVE-2021-0512)

• kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE) (CVE-2021-3656)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [HPE 8.3 bug] No EDAC MC0 message with one-DIMM two-processor configuration under Rocky Linux8.3 (BZ#1982182)

• mlx: devlink port function shows all zero hw_addr (BZ#1986837)

• net/sched: act_mirred: allow saving the last chain processed on xmit path (BZ#1992230)

• Rocky Linux8.3 - System hang and / or r/o fs during SVC/v5k/v7k maintenance with ibmvfc (BZ#1993892)

• Rocky Linux8.1 Snapshot3 - PVT:940:virt:4TB:LPM operation failed by returning HSCLA2CF, HSCL365C SRC's - Linux partition suspend timeout (-> documentation/Linux Alert through LTC bug 182549) (BZ#1993952)

• Rocky Linux8.4 - benchTableRepDMLAsyncBarrier regresses by 34% on Rocky Linux8.4 on POWER9 compared to Rocky Linux8.2 (performance) (BZ#1997431)

• [panic] call trace: ice_probe+0x238/0x10f0 [ice] (BZ#1997539)

• [ice, PTP] ice: fix GPIO 1PPS signal (BZ#1997572)

• Fix locality handling in the tpm_tis driver (BZ#1998219)

• [ice, PTP]: fix Tx queue iteration for Tx timestamp enablement (BZ#2000128)

• PCI passthrough with NVidia GPU "Invalid device 0003:01:00.0 iommu_group file /sys/bus/pci/devices/0003:01:00.0/iommu_group is not a symlink" (BZ#2000602)

• [DELL 8.4 BUG] - System Hangs at Dell Logo When Boot to OS(e1000e with wrong GbE checksum) (BZ#2002335)

• Rocky Linux8.4 - kernel: Fix hanging ioctl caused by wrong msg counter (BZ#2002635)

• kernel: get_timespec64 does not ignore padding in compat syscalls (BZ#2003569)

• [mlx5] eth0: hw csum failure (BZ#2005980)

• xlog_grant_head_wait() does not return and system hangs (BZ#2007413)

• panic while breaking a lease/delegation after user mode helper invocation (BZ#2010331)

• Lockd invalid cast to nlm_lockowner (BZ#2010820)

• [xfstests generic/388] XFS: Assertion failed: 0, file: fs/xfs/xfs_mount.c, line: 1218 (BZ#2011919)

Enhancement(s):

• [Intel 8.5 FEAT] ice: Enable PTP Support (BZ#1998220)

• [Intel 8.5 FEAT] ice: Enable GPIO/SDP Support (BZ#1998221)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

• kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers() of hid-input.c (CVE-2021-0512)

• kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE) (CVE-2021-3656)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update RT source tree to the Rocky Linux-8.4.z source tree (BZ#2004117)

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

• kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers() of hid-input.c (CVE-2021-0512)

• kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE) (CVE-2021-3656)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [HPE 8.3 bug] No EDAC MC0 message with one-DIMM two-processor configuration under AlmaLinux8.3 (BZ#1982182)

• mlx: devlink port function shows all zero hw_addr (BZ#1986837)

• net/sched: act_mirred: allow saving the last chain processed on xmit path (BZ#1992230)

• AlmaLinux8.3 - System hang and / or r/o fs during SVC/v5k/v7k maintenance with ibmvfc (BZ#1993892)

• AlmaLinux8.1 Snapshot3 - PVT:940:virt:4TB:LPM operation failed by returning HSCLA2CF, HSCL365C SRC's - Linux partition suspend timeout (-> documentation/Linux Alert through LTC bug 182549) (BZ#1993952)

• AlmaLinux8.4 - benchTableRepDMLAsyncBarrier regresses by 34% on AlmaLinux8.4 on POWER9 compared to AlmaLinux8.2 (performance) (BZ#1997431)

• [panic] call trace: ice_probe+0x238/0x10f0 [ice] (BZ#1997539)

• [ice, PTP] ice: fix GPIO 1PPS signal (BZ#1997572)

• Fix locality handling in the tpm_tis driver (BZ#1998219)

• [ice, PTP]: fix Tx queue iteration for Tx timestamp enablement (BZ#2000128)

• PCI passthrough with NVidia GPU "Invalid device 0003:01:00.0 iommu_group file /sys/bus/pci/devices/0003:01:00.0/iommu_group is not a symlink" (BZ#2000602)

• [DELL 8.4 BUG] - System Hangs at Dell Logo When Boot to OS(e1000e with wrong GbE checksum) (BZ#2002335)

• AlmaLinux8.4 - kernel: Fix hanging ioctl caused by wrong msg counter (BZ#2002635)

• kernel: get_timespec64 does not ignore padding in compat syscalls (BZ#2003569)

• [mlx5] eth0: hw csum failure (BZ#2005980)

• xlog_grant_head_wait() does not return and system hangs (BZ#2007413)

• panic while breaking a lease/delegation after user mode helper invocation (BZ#2010331)

• Lockd invalid cast to nlm_lockowner (BZ#2010820)

• [xfstests generic/388] XFS: Assertion failed: 0, file: fs/xfs/xfs_mount.c, line: 1218 (BZ#2011919)

Enhancement(s):

• [Intel 8.5 FEAT] ice: Enable PTP Support (BZ#1998220)

• [Intel 8.5 FEAT] ice: Enable GPIO/SDP Support (BZ#1998221)

• CVE-2021-38198

  • ELSCVE-686: KVM: MMU: return page fault error code from permission_fault
  • ELSCVE-686: kvm: x86: MMU support for EPT accessed/dirty bits
  • ELSCVE-686: KVM: nVMX: fix EPT permissions as reported in exit qualification
  • ELSCVE-686: KVM: X86: MMU: Use the correct inherited permissions to get shadow page

• CVE-2021-3655

  • ELSCVE-715: sctp: add size validation when walking chunks
  • ELSCVE-715: sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
  • ELSCVE-715: sctp: validate chunk size in __rcv_asconf_lookup
  • ELSCVE-715: sctp: validate from_addr_param return
  • ELSCVE-715: sctp: fix return value check in __sctp_rcv_asconf_lookup

• CVE-2021-3428

  • ELSCVE-1704: ext4: don't allow overlapping system zones
  • ELSCVE-1704: ext4: check journal inode extents more carefully

• CVE-2021-38205

  • ELSCVE-389: net: xilinx_emaclite: Do not print real IOMEM pointer

• CVE-2021-28688

  • ELSCVE-670: xen-blkback: don't leak persistent grants from xen_blkbk_map()

• CVE-2021-34693

  • ELSCVE-668: can: bcm: fix infoleak in struct bcm_msg_head

• CVE-2020-25673

  • ELSCVE-819: nfc: Avoid endless loops caused by repeated llcp_sock_connect()

• CVE-2021-23134

  • ELSCVE-620: net/nfc: fix use-after-free llcp_sock_bind/connect

• CVE-2021-3573

  • ELSCVE-846: Bluetooth: use correct lock to prevent UAF of hdev object

• CVE-2021-38204

  • ELSCVE-457: usb: max-3421: Prevent corruption of freed memory

• CVE-2021-42008

  • ELSCVE-1730: net: 6pack: fix slab-out-of-bounds in decode_data

• CVE-2020-36385

  • ELSCVE-1181: RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. (bnc#1179610 bnc#1186463)
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free in drivers/infiniband/core/ucma.c which could be triggered if the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• ACPICA: Clean up context mutex during object deletion (git-fixes).
• ALSA: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 (git-fixes).
• ALSA: hda/realtek: headphone and mic do not work on an Acer laptop (git-fixes).
• ALSA: hda: update the power_state during the direct-complete (git-fixes).
• ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• arm64: Add missing ISB after invalidating TLB in __primary_switch (git-fixes).
• arm64: avoid -Woverride-init warning (git-fixes).
• arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL (git-fixes).
• arm64: kdump: update ppos when reading elfcorehdr (git-fixes).
• arm64: kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails (git-fixes).
• arm64: link with -z norelro for LLD or aarch64-elf (git-fixes).
• arm64: link with -z norelro regardless of CONFIG_RELOCATABLE (git-fixes).
• arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory (git-fixes).
• arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) (git-fixes).
• arm64: ptrace: Use NO_SYSCALL instead of -1 in syscall_trace_enter() (git-fixes).
• ARM64: vdso32: Install vdso32 from vdso_install (git-fixes).
• arm64: vdso32: make vdso32 install conditional (git-fixes).
• arm: mm: use __pfn_to_section() to get mem_section (git-fixes).
• ASoC: amd: fix for pcm_read() error (git-fixes).
• ASoC: cs43130: handle errors in cs43130_probe() properly (git-fixes).
• ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• bcache: avoid oversized read request in cache missing code path (bsc#1187357, bsc#1185570, bsc#1184631).
• bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
• bcache: do not pass BIOSET_NEED_BVECS for the 'bio_set' embedded in 'cache_set' (bsc#1187357).
• bcache: fix a regression of code compiling failure in debug.c (bsc#1187357).
• bcache: inherit the optimal I/O size (bsc#1187357).
• bcache: reduce redundant code in bch_cached_dev_run() (bsc#1187357).
• bcache: remove bcache device self-defined readahead (bsc#1187357, bsc#1185570, bsc#1184631).
• bcache: remove PTR_CACHE (bsc#1187357).
• bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
• bcache: use NULL instead of…

The SUSE Linux Enterprise 15 SP3 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. (bnc#1179610 bnc#1186463)
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free in drivers/infiniband/core/ucma.c which could be triggered if the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• ACPICA: Clean up context mutex during object deletion (git-fixes).
• ALSA: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 (git-fixes).
• ALSA: hda/realtek: headphone and mic do not work on an Acer laptop (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: update the power_state during the direct-complete (git-fixes).
• ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config (git-fixes).
• ASoC: amd: fix for pcm_read() error (git-fixes).
• ASoC: cs43130: handle errors in cs43130_probe() properly (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Enable CONFIG_PCI_PF_STUB for Nvidia Ampere vGPU support (jsc#SLE-17882 jsc#ECO-3691)
• HID: i2c-hid: Skip ELAN power-on command after reset (git-fixes).
• HID: i2c-hid: fix format string mismatch (git-fixes).
• HID: magicmouse: fix NULL-deref on disconnect (git-fixes).
• HID: multitouch: require Finger field to mark Win8 reports as MT (git-fixes).
• HID: pidff: fix error return code in hid_pidff_init() (git-fixes).
• NFC: SUSE specific brutal fix for runtime PM (bsc#1185589).
• NFS: Deal correctly with attribute generation counter overflow (git-fixes).
• NFS: Do not corrupt the value of pg_bytes_written in nfs_do_recoalesce() (git-fixes).
• NFS: Do not discard pNFS layout segments that are marked for return (git-fixes).
• NFS: Do not gratuitously clear the inode cache when lookup failed (git-fixes).
• NFS: Do not revalidate the directory permissions on a lookup failure (git-fixes).
• NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (git-fixes).
• NFS: fix an incorrect limit in filelayout_decode_layout() (git-fixes).
• NFSD: Repair misuse of sv_lock in 5.10.16-rt30 (git-fixes).
• NFSv4.2 fix handling of sr_eof in SEEK's reply (git-fixes).
• NFSv4.2: Always flush out writes in nfs42_proc_fallocate() (git-fixes).
• NFSv4.2: fix return value of _nfs4_get_security_label() (git-fixes).
• NFSv42: Copy offload should update the file size when appropriate (git-fixes).
• NFSv4: Do not discard segments marked for return in _pnfs_return_layout() (git-fixes).
• NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() (git-fixes).
• NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bnc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bnc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-33200: Fix leakage of uninitialized bpf stack under speculation. (bsc#1186484)

The following non-security bugs were fixed:

• af_packet: fix the tx skb protocol in raw sockets with ETH_P_ALL (bsc#1176081).
• kabi: preserve struct header_ops after bsc#1176081 fix (bsc#1176081).
• net: Do not set transport offset to invalid value (bsc#1176081).
• net: Introduce parse_protocol header_ops callback (bsc#1176081).
• net/ethernet: Add parse_protocol header_ops support (bsc#1176081).
• net/mlx5e: Remove the wrong assumption about transport offset (bsc#1176081).
• net/mlx5e: Trust kernel regarding transport offset (bsc#1176081).
• net/packet: Ask driver for protocol if not provided by user (bsc#1176081).
• net/packet: Remove redundant skb->protocol set (bsc#1176081).
• resource: Fix find_next_iomem_res() iteration issue (bsc#1181193).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).
• SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428).
• SUNRPC: More fixes for backlog congestion (bsc#1185428).
• x86/crash: Add e820 reserved ranges to kdump kernel's e820 table (bsc#1181193).
• x86/debug: Extend the lower bound of crash kernel low reservations (bsc#1153720).
• x86/e820, ioport: Add a new I/O resource descriptor IORES_DESC_RESERVED (bsc#1181193).
• x86/mm: Rework ioremap resource mapping determination (bsc#1181193).

The SUSE Linux Enterprise 11 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).
• CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).
• CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read uninitialized memory (bnc#1188563 bnc#1192267).
• CVE-2014-7841: The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation, when ASCONF is used, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk (bnc#904899 bnc#905100).
• CVE-2021-20265: A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function when a signal was pending. This flaw allowed an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability (bnc#1183089).
• CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673 bnc#1192036).
• CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value (bnc#1186109 bnc#1188876).
• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).
• CVE-2021-42008: The decode_data function in drivers/net/hamradio/6pack.c had a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access (bnc#1191315).
• CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
• CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth stack (bsc#1188172).
• CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computed the access permissions of a shadow page, leading to a missing guest protection page fault (bnc#1189262).
• CVE-2021-3653: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the 'int_ctl' field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. (bnc#1189399).
• CVE-2021-3679: A lack of CPU resource in the Linux kernel tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057).
• CVE-2021-3609: A potential local privilege escalation in the CAN BCM networking protocol was fixed (bsc#1187215).
• CVE-2020-36385: drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c (bnc#1187050).

The following non-security bugs were fixed:

• sctp: check asoc peer.asconf_capable before processing asconf (bsc#1190351).
• sctp: fully initialize v4 addr in some functions (bsc#1188563).
• sctp: simplify addr copy (bsc#1188563).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. (bnc#1179610 bnc#1186463)
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free in drivers/infiniband/core/ucma.c which could be triggered if the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• ACPICA: Clean up context mutex during object deletion (git-fixes).
• ALSA: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 (git-fixes).
• ALSA: hda/realtek: headphone and mic do not work on an Acer laptop (git-fixes).
• ALSA: hda: update the power_state during the direct-complete (git-fixes).
• ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• arm64: Add missing ISB after invalidating TLB in __primary_switch (git-fixes).
• arm64: avoid -Woverride-init warning (git-fixes).
• arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL (git-fixes).
• arm64: kdump: update ppos when reading elfcorehdr (git-fixes).
• arm64: kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails (git-fixes).
• arm64: link with -z norelro for LLD or aarch64-elf (git-fixes).
• arm64: link with -z norelro regardless of CONFIG_RELOCATABLE (git-fixes).
• arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory (git-fixes).
• arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) (git-fixes).
• arm64: ptrace: Use NO_SYSCALL instead of -1 in syscall_trace_enter() (git-fixes).
• ARM64: vdso32: Install vdso32 from vdso_install (git-fixes).
• arm64: vdso32: make vdso32 install conditional (git-fixes).
• arm: mm: use __pfn_to_section() to get mem_section (git-fixes).
• ASoC: amd: fix for pcm_read() error (git-fixes).
• ASoC: cs43130: handle errors in cs43130_probe() properly (git-fixes).
• ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• bcache: avoid oversized read request in cache missing code path (bsc#1187357, bsc#1185570, bsc#1184631).
• bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
• bcache: do not pass BIOSET_NEED_BVECS for the 'bio_set' embedded in 'cache_set' (bsc#1187357).
• bcache: fix a regression of code compiling failure in debug.c (bsc#1187357).
• bcache: inherit the optimal I/O size (bsc#1187357).
• bcache: reduce redundant code in bch_cached_dev_run() (bsc#1187357).
• bcache: remove bcache device self-defined readahead (bsc#1187357, bsc#1185570, bsc#1184631).
• bcache: remove PTR_CACHE (bsc#1187357).
• bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
• bcache: use NULL instead of…

The SUSE Linux Enterprise 15 SP3 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. (bnc#1179610 bnc#1186463)
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free in drivers/infiniband/core/ucma.c which could be triggered if the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• ACPICA: Clean up context mutex during object deletion (git-fixes).
• ALSA: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 (git-fixes).
• ALSA: hda/realtek: headphone and mic do not work on an Acer laptop (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: update the power_state during the direct-complete (git-fixes).
• ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config (git-fixes).
• ASoC: amd: fix for pcm_read() error (git-fixes).
• ASoC: cs43130: handle errors in cs43130_probe() properly (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Enable CONFIG_PCI_PF_STUB for Nvidia Ampere vGPU support (jsc#SLE-17882 jsc#ECO-3691)
• HID: i2c-hid: Skip ELAN power-on command after reset (git-fixes).
• HID: i2c-hid: fix format string mismatch (git-fixes).
• HID: magicmouse: fix NULL-deref on disconnect (git-fixes).
• HID: multitouch: require Finger field to mark Win8 reports as MT (git-fixes).
• HID: pidff: fix error return code in hid_pidff_init() (git-fixes).
• NFC: SUSE specific brutal fix for runtime PM (bsc#1185589).
• NFS: Deal correctly with attribute generation counter overflow (git-fixes).
• NFS: Do not corrupt the value of pg_bytes_written in nfs_do_recoalesce() (git-fixes).
• NFS: Do not discard pNFS layout segments that are marked for return (git-fixes).
• NFS: Do not gratuitously clear the inode cache when lookup failed (git-fixes).
• NFS: Do not revalidate the directory permissions on a lookup failure (git-fixes).
• NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (git-fixes).
• NFS: fix an incorrect limit in filelayout_decode_layout() (git-fixes).
• NFSD: Repair misuse of sv_lock in 5.10.16-rt30 (git-fixes).
• NFSv4.2 fix handling of sr_eof in SEEK's reply (git-fixes).
• NFSv4.2: Always flush out writes in nfs42_proc_fallocate() (git-fixes).
• NFSv4.2: fix return value of _nfs4_get_security_label() (git-fixes).
• NFSv42: Copy offload should update the file size when appropriate (git-fixes).
• NFSv4: Do not discard segments marked for return in _pnfs_return_layout() (git-fixes).
• NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() (git-fixes).
• NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling ioremap…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)
• CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller. (bsc#1184611)
• CVE-2021-33034: Fixed an issue in net/bluetooth/hci_event.c where a use-after-free leads to writing an arbitrary value. (bsc#1186111)
• CVE-2020-26139: Fixed a bug that allows an Access Point (AP) to forward EAPOL frames to other clients even though the sender has not yet successfully authenticated. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients. (bsc#1186062)
• CVE-2021-23134: Fixed a use After Free vulnerability in nfc sockets which allows local attackers to elevate their privileges. (bsc#1186060)
• CVE-2020-24586: Fixed a bug that, under the right circumstances, allows to inject arbitrary network packets and/or exfiltrate user data when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP. (bsc#1185859)
• CVE-2020-26141: Fixed a flaw that could allows an adversary to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bsc#1185987)
• CVE-2020-26145: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject arbitrary network packets. (bsc#1185860)
• CVE-2020-24587: Fixed a bug that allows an adversary to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (bsc#1185862)
• CVE-2020-26147: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames. (bsc#1185987)

The following non-security bugs were fixed:

• kABI: Fix kABI after modifying struct __call_single_data (bsc#1180846).
• kernel/smp: add boot parameter for controlling CSD lock debugging (bsc#1180846).
• kernel/smp: Add source and destination CPUs to __call_single_data (bsc#1180846).
• kernel/smp: make csdlock timeout depend on boot parameter (bsc#1180846).
• kernel/smp: Provide CSD lock…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bnc#1188116)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges (bsc#1188062).
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation (bsc#1187050).

The following non-security bugs were fixed:

• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode (git-fixes).
• arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan (git-fixes).
• ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
• ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
• ata: ahci_sunxi: Disable DIPM (git-fixes).
• ath10k: Fix an error code in ath10k_add_interface() (git-fixes).
• Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
• brcmfmac: correctly report average RSSI in station info (git-fixes).
• brcmfmac: fix setting of station info chains bitmask (git-fixes).
• brcmsmac: mac80211_if: Fix a resource leak in an error handling path (git-fixes).
• can: flexcan: disable completely the ECC mechanism (git-fixes).
• can: gw: synchronize rcu operations before removing gw job entry (git-fixes).
• can: hi311x: hi3110_can_probe(): silence clang warning (git-fixes).
• can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path (git-fixes).
• can: xilinx_can: xcan_chip_start(): fix failure with invalid bus (git-fixes).
• cfg80211: call cfg80211_leave_ocb when switching away from OCB (git-fixes).
• char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() (git-fixes).
• crypto: cavium/nitrox - Fix an error rhandling path in 'nitrox_probe()' (git-fixes).
• crypto: ccp - Fix a resource leak in an error handling path (12sp5).
• cxgb4: fix wrong shift (git-fixes).
• drm: qxl: ensure surf.data is ininitialized (git-fixes).
• drm/nouveau: wait for moving fence after pinning v2 (git-fixes).
• drm/radeon: wait for moving fence after pinning (git-fixes).
• drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write() (git-fixes).
• extcon: max8997: Add missing modalias string (git-fixes).
• extcon: sm5502: Drop invalid register write in sm5502_reg_data (git-fixes).
• fpga: stratix10-soc: Add missing fpga_mgr_free() call (git-fixes).
• fuse: check connected before queueing on fpq->io (bsc#1188273).
• fuse: reject internal errno (bsc#1188274).
• genirq: Disable interrupts for force threaded handlers (git-fixes)
• genirq: Fix reference leaks on irq affinity notifiers (git-fixes)
• genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY (git-fixes)
• genirq/irqdomain: Do not try to free an interrupt that has no (git-fixes)
• gve: Fix swapped vars when fetching max queues (git-fixes).
• HID: Add BUS_VIRTUAL to hid_connect logging (git-fixes).
• HID: gt683r: add missing MODULE_DEVICE_TABLE (git-fixes).
• HID: hid-sensor-hub: Return error for hid_set_field() failure (git-fixes).
• HID: usbhid: fix info leak in hid_submit_ctrl (git-fixes).
• hwmon: (max31722) Remove non-standard ACPI device IDs (git-fixes).
• hwmon: (max31790) Fix fan speed reporting for fan7..12 (git-fixes).
• i2c: robotfuzz-osif: fix…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)

The following non-security bugs were fixed:

• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode (git-fixes).
• arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan (git-fixes).
• ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
• ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
• ata: ahci_sunxi: Disable DIPM (git-fixes).
• ath10k: Fix an error code in ath10k_add_interface() (git-fixes).
• Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
• brcmfmac: correctly report average RSSI in station info (git-fixes).
• brcmfmac: fix setting of station info chains bitmask (git-fixes).
• brcmsmac: mac80211_if: Fix a resource leak in an error handling path (git-fixes).
• can: gw: synchronize rcu operations before removing gw job entry (git-fixes).
• can: hi311x: hi3110_can_probe(): silence clang warning (git-fixes).
• can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path (git-fixes).
• cfg80211: call cfg80211_leave_ocb when switching away from OCB (git-fixes).
• char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() (git-fixes).
• crypto: cavium/nitrox - Fix an error rhandling path in 'nitrox_probe()' (git-fixes).
• cxgb4: fix wrong shift (git-fixes).
• drm: qxl: ensure surf.data is ininitialized (git-fixes).
• drm/nouveau: wait for moving fence after pinning v2 (git-fixes).
• drm/radeon: wait for moving fence after pinning (git-fixes).
• drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write() (git-fixes).
• extcon: max8997: Add missing modalias string (git-fixes).
• extcon: sm5502: Drop invalid register write in sm5502_reg_data (git-fixes).
• fpga: stratix10-soc: Add missing fpga_mgr_free() call (git-fixes).
• fuse: check connected before queueing on fpq->io (bsc#1188273).
• fuse: reject internal errno (bsc#1188274).
• genirq: Disable interrupts for force threaded handlers (git-fixes)
• genirq: Fix reference leaks on irq affinity notifiers (git-fixes)
• genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY (git-fixes)
• genirq/irqdomain: Do not try to free an interrupt that has no (git-fixes)
• gve: Fix swapped vars when fetching max queues (git-fixes).
• HID: Add BUS_VIRTUAL to hid_connect logging (git-fixes).
• HID: gt683r: add missing MODULE_DEVICE_TABLE (git-fixes).
• HID: hid-sensor-hub: Return error for hid_set_field() failure (git-fixes).
• HID: usbhid: fix info leak in hid_submit_ctrl (git-fixes).
• hwmon: (max31722) Remove non-standard ACPI device IDs (git-fixes).
• hwmon: (max31790) Fix fan speed reporting for fan7..12 (git-fixes).
• i2c: robotfuzz-osif: fix control-request directions (git-fixes).
• ibmvnic: Allow device probe if the device is not ready at boot (bsc#1184114 ltc#192237).
• ibmvnic: fix kernel build warning (bsc#1184114 ltc#192237).
• ibmvnic: fix kernel build…

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116 ).
• CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062).
• CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
• CVE-2021-33624: In kernel/bpf/verifier.c a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db (bnc#1187554).
• CVE-2021-0605: In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1187601).
• CVE-2021-0512: In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1187595).
• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time (bnc#1179610).
• CVE-2021-34693: net/can/bcm.c in the Linux kernel allowed local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized (bnc#1187452).
• CVE-2020-36385: An issue was discovered in the Linux kernel drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c (bnc#1187050).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36386: An issue was discovered in the Linux kernel net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf (bnc#1187038).
• CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets (bnc#1185861).
• CVE-2021-33200: kernel/bpf/verifier.c enforced incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit (bnc#1186484).
• CVE-2021-33034: net/bluetooth/hci_event.c had a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value (bnc#1186111).
• CVE-2020-26139: An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients (bnc#1186062).…

The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116).
• CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062).
• CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
• CVE-2021-33624: In kernel/bpf/verifier.c a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db (bnc#1187554).
• CVE-2021-0605: In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the kernel with System execution privileges needed. User interaction is not needed for exploitation (bnc#1187601).
• CVE-2021-0512: In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1187595).
• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time (bnc#1179610 bnc#1186463).
• CVE-2021-34693: net/can/bcm.c allowed local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized (bnc#1187452).
• CVE-2020-36385: An issue was discovered in drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c (bnc#1187050).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36386: An issue was discovered net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf (bnc#1187038).
• CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets (bnc#1185861).
• CVE-2021-33200: kernel/bpf/verifier.c enforced incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit (bnc#1186484).

The following non-security bugs were fixed:

• block: do not use blocking queue entered for recursive bio (bsc#1104967).
• s390/stack: fix possible register corruption with stack switch helper (git-fixes).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bnc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bnc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-33200: Fix leakage of uninitialized bpf stack under speculation. (bsc#1186484)

The following non-security bugs were fixed:

• af_packet: fix the tx skb protocol in raw sockets with ETH_P_ALL (bsc#1176081).
• kabi: preserve struct header_ops after bsc#1176081 fix (bsc#1176081).
• net: Do not set transport offset to invalid value (bsc#1176081).
• net: Introduce parse_protocol header_ops callback (bsc#1176081).
• net/ethernet: Add parse_protocol header_ops support (bsc#1176081).
• net/mlx5e: Remove the wrong assumption about transport offset (bsc#1176081).
• net/mlx5e: Trust kernel regarding transport offset (bsc#1176081).
• net/packet: Ask driver for protocol if not provided by user (bsc#1176081).
• net/packet: Remove redundant skb->protocol set (bsc#1176081).
• resource: Fix find_next_iomem_res() iteration issue (bsc#1181193).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).
• SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428).
• SUNRPC: More fixes for backlog congestion (bsc#1185428).
• x86/crash: Add e820 reserved ranges to kdump kernel's e820 table (bsc#1181193).
• x86/debug: Extend the lower bound of crash kernel low reservations (bsc#1153720).
• x86/e820, ioport: Add a new I/O resource descriptor IORES_DESC_RESERVED (bsc#1181193).
• x86/mm: Rework ioremap resource mapping determination (bsc#1181193).

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)
• CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller. (bsc#1184611)
• CVE-2021-33034: Fixed an issue in net/bluetooth/hci_event.c where a use-after-free leads to writing an arbitrary value. (bsc#1186111)
• CVE-2020-26139: Fixed a bug that allows an Access Point (AP) to forward EAPOL frames to other clients even though the sender has not yet successfully authenticated. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients. (bsc#1186062)
• CVE-2021-23134: Fixed a use After Free vulnerability in nfc sockets which allows local attackers to elevate their privileges. (bsc#1186060)
• CVE-2020-24586: Fixed a bug that, under the right circumstances, allows to inject arbitrary network packets and/or exfiltrate user data when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP. (bsc#1185859)
• CVE-2020-26141: Fixed a flaw that could allows an adversary to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bsc#1185987)
• CVE-2020-26145: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject arbitrary network packets. (bsc#1185860)
• CVE-2020-24587: Fixed a bug that allows an adversary to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (bsc#1185862)
• CVE-2020-26147: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames. (bsc#1185987)

The following non-security bugs were fixed:

• Bluetooth: SMP: Fail if remote and local public keys are identical (git-fixes).
• Drivers: hv: vmbus: Increase wait time for VMbus unload (bsc#1185724).
• Drivers: hv: vmbus: Initialize unload_event statically (bsc#1185724).
• hv_netvsc: Add handlers for ethtool get/set msg level (bsc#1175462).
• hv_netvsc: avoid retry on send during shutdown…

This update for the Linux Kernel 4.4.180-94_127 fixes several issues.

The following security issues were fixed:

• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2020-36385: Fixed a use-after-free vulnerability reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called. (bnc#1187050)

This update for the Linux Kernel 5.3.18-24_49 fixes several issues.

The following security issues were fixed:

• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2020-36385: Fixed a use-after-free vulnerability reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called. (bnc#1187050)

This update for the Linux Kernel 4.12.14-197_56 fixes several issues.

The following security issues were fixed:

• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2020-36385: Fixed a use-after-free vulnerability reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called. (bnc#1187050)

This update for the Linux Kernel 5.3.18-24_53_4 fixes several issues.

The following security issues were fixed:

• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2020-36385: Fixed a use-after-free vulnerability reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called. (bnc#1187050)
• CVE-2021-23133: Fixed a race condition in the SCTP sockets that could lead to kernel privilege escalation from the context of a network service or an unprivileged process. (bnc#1184675)
• CVE-2021-33034: Fixed a use-after-free vulnerability when destroying an hci_chan which leads to writing an arbitrary value. (bnc#1186111)
• CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller. (bsc#1184611)
• CVE-2020-36322: Fixed an issue in the FUSE filesystem implementation. This bug was addressed with a previous fix, which turned out was incomplete, and its incompleteness is tracked as CVE-2021-28950. (bsc#1184211)
• CVE-2021-29154: Fixed an incorrect computation of branch displacements in the BPF JIT compilers, which could allow to execute arbitrary code within the kernel context. (bsc#1184391)
• CVE-2021-3444: The bpf verifier did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. (bsc#1184170)
• CVE-2021-28660: Fixed an out-of-bounds write in rtw_wx_set_scan which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1183593)
• CVE-2021-27365: Fixed an issue in certain iSCSI data structures that do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. (bsc#1182715)
• CVE-2021-28688: Fixed some uninitialization pointers in Xen that could result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. (bsc#1183646)
• CVE-2021-27363: Fixed a kernel pointer leak that can be used to determine the address of the iscsi_transport structure. (bsc#1182716)
• CVE-2021-27364: Fixed an issue that provides an unprivileged user the ability of craft Netlink messages. (bsc#1182717)

This update for the Linux Kernel 4.12.14-197_72 fixes several issues.

The following security issues were fixed:

• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2020-36385: Fixed a use-after-free vulnerability reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called. (bnc#1187050)

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bsc#1187038).
• CVE-2021-22543: Fixed an improper handling of VM_IO|VM_PFNMAP vmas in KVM that allows users to start and control a VM to read/write random pages of memory and can result in local privilege escalation. (bnc#1186482)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
• ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
• ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
• HID: Add BUS_VIRTUAL to hid_connect logging (git-fixes).
• HID: gt683r: add missing MODULE_DEVICE_TABLE (git-fixes).
• HID: hid-sensor-hub: Return error for hid_set_field() failure (git-fixes).
• HID: usbhid: fix info leak in hid_submit_ctrl (git-fixes).
• HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes).
• Input: hil_kbd - fix error return code in hil_dev_connect() (git-fixes).
• Input: usbtouchscreen - fix control-request directions (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Mark TI C667X to avoid bus reset (git-fixes).
• PCI: Mark some NVIDIA GPUs to avoid bus reset…