CVE-2020-36386

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.(CVE-2020-27170)

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.(CVE-2020-27171)

rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.(CVE-2021-28660)

A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.(CVE-2021-28964)

In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.(CVE-2021-28972)

In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.(CVE-2021-28971)

An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-35519)

There is a flaw reported in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker with a local account with a root privilege, can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.(CVE-2021-20292)

The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.(CVE-2021-3444)

An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.(CVE-2021-29265)

An issue was discovered in the Linux kernel through 5.11.10.…

An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: out-of-bounds reads in pinctrl subsystem (CVE-2020-0427)
• kernel: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24502)
• kernel: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24503)
• kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24504)
• kernel: Fragmentation cache not cleared on reconnection (CVE-2020-24586)
• kernel: Reassembling fragments encrypted under different keys (CVE-2020-24587)
• kernel: wifi frame payload being parsed incorrectly as an L2 frame (CVE-2020-24588)
• kernel: Forwarding EAPOL from unauthenticated wifi client (CVE-2020-26139)
• kernel: accepting plaintext data frames in protected networks (CVE-2020-26140)
• kernel: not verifying TKIP MIC of fragmented frames (CVE-2020-26141)
• kernel: accepting fragmented plaintext frames in protected networks (CVE-2020-26143)
• kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header (CVE-2020-26144)
• kernel: accepting plaintext broadcast fragments as full frames (CVE-2020-26145)
• kernel: powerpc: RTAS calls can be used to compromise kernel integrity (CVE-2020-27777)
• kernel: locking inconsistency in tty_io.c and tty_jobctrl.c can lead to a read-after-free (CVE-2020-29660)
• kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function via a long SSID value (CVE-2020-36158)
• kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt() (CVE-2020-36386)
• kernel: Improper access control in BlueZ may allow information disclosure vulnerability. (CVE-2021-0129)
• kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c (CVE-2021-3348)
• kernel: Linux kernel eBPF RINGBUF map oversized allocation (CVE-2021-3489)
• kernel: double free in bluetooth subsystem when the HCI device initialization fails (CVE-2021-3564)
• kernel: use-after-free in function hci_sock_bound_ioctl() (CVE-2021-3573)
• kernel: eBPF 32-bit source register truncation on div/mod (CVE-2021-3600)
• kernel: DoS in rb_per_cpu_empty() (CVE-2021-3679)
• kernel: Mounting overlayfs inside an unprivileged user namespace can reveal files (CVE-2021-3732)
• kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt() (CVE-2021-20194)
• kernel: Race condition in sctp_destroy_sock list_del (CVE-2021-23133)
• kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode (CVE-2021-28950)
• kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c (CVE-2021-28971)
• kernel: protection can be bypassed to leak content of kernel memory (CVE-2021-29155)
• kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c (CVE-2021-29646)
• kernel: lack a full memory barrier may lead to DoS (CVE-2021-29650)
• kernel: local escalation of privileges in handling of eBPF programs (CVE-2021-31440)
• kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak content of kernel memory (CVE-2021-31829)
• kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations by BPF verifier (CVE-2021-33200)
• kernel: reassembling encrypted fragments with non-consecutive packet numbers (CVE-2020-26146)
• kernel: reassembling mixed encrypted/plaintext fragments (CVE-2020-26147)
• kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check (CVE-2020-29368)
• kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50 (CVE-2021-3635)
• kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)
• kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure (CVE-2021-20239)
• kernel: out of bounds array access in drivers/md/dm-ioctl.c (CVE-2021-31916)

• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() {CVE-2020-36386}
• btrfs: only search for left_info if there is no right_info in try_merge_free_space {CVE-2019-19448}
• filldir[64]: remove WARN_ON_ONCE() for bad directory entries {CVE-2019-10220}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• ath9k: release allocated buffer if timed out {CVE-2019-19074}
• net: sched: sch_qfq: prevent slab-out-of-bounds in {CVE-2023-31436}
• memstick: r592: Fix UAF bug in r592_remove due to race {CVE-2023-3141}
• wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid {CVE-2023-23559}
• ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}

• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() {CVE-2020-36386}
• btrfs: only search for left_info if there is no right_info in try_merge_free_space {CVE-2019-19448}
• filldir[64]: remove WARN_ON_ONCE() for bad directory entries {CVE-2019-10220}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• ath9k: release allocated buffer if timed out {CVE-2019-19074}
• net: sched: sch_qfq: prevent slab-out-of-bounds in {CVE-2023-31436}
• memstick: r592: Fix UAF bug in r592_remove due to race {CVE-2023-3141}
• wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid {CVE-2023-23559}
• ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}

• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() {CVE-2020-36386}
• btrfs: only search for left_info if there is no right_info in try_merge_free_space {CVE-2019-19448}
• filldir[64]: remove WARN_ON_ONCE() for bad directory entries {CVE-2019-10220}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• ath9k: release allocated buffer if timed out {CVE-2019-19074}
• net: sched: sch_qfq: prevent slab-out-of-bounds in {CVE-2023-31436}
• memstick: r592: Fix UAF bug in r592_remove due to race {CVE-2023-3141}
• wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid {CVE-2023-23559}
• ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}

• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() {CVE-2020-36386}
• btrfs: only search for left_info if there is no right_info in try_merge_free_space {CVE-2019-19448}
• filldir[64]: remove WARN_ON_ONCE() for bad directory entries {CVE-2019-10220}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• ath9k: release allocated buffer if timed out {CVE-2019-19074}
• net: sched: sch_qfq: prevent slab-out-of-bounds in {CVE-2023-31436}
• memstick: r592: Fix UAF bug in r592_remove due to race {CVE-2023-3141}
• wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid {CVE-2023-23559}
• ext4: fix kernel infoleak via ext4_extent_header {CVE-2022-0850}

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. (bnc#1179610 bnc#1186463)
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free in drivers/infiniband/core/ucma.c which could be triggered if the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• ACPICA: Clean up context mutex during object deletion (git-fixes).
• ALSA: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 (git-fixes).
• ALSA: hda/realtek: headphone and mic do not work on an Acer laptop (git-fixes).
• ALSA: hda: update the power_state during the direct-complete (git-fixes).
• ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• arm64: Add missing ISB after invalidating TLB in __primary_switch (git-fixes).
• arm64: avoid -Woverride-init warning (git-fixes).
• arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL (git-fixes).
• arm64: kdump: update ppos when reading elfcorehdr (git-fixes).
• arm64: kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails (git-fixes).
• arm64: link with -z norelro for LLD or aarch64-elf (git-fixes).
• arm64: link with -z norelro regardless of CONFIG_RELOCATABLE (git-fixes).
• arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory (git-fixes).
• arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) (git-fixes).
• arm64: ptrace: Use NO_SYSCALL instead of -1 in syscall_trace_enter() (git-fixes).
• ARM64: vdso32: Install vdso32 from vdso_install (git-fixes).
• arm64: vdso32: make vdso32 install conditional (git-fixes).
• arm: mm: use __pfn_to_section() to get mem_section (git-fixes).
• ASoC: amd: fix for pcm_read() error (git-fixes).
• ASoC: cs43130: handle errors in cs43130_probe() properly (git-fixes).
• ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• bcache: avoid oversized read request in cache missing code path (bsc#1187357, bsc#1185570, bsc#1184631).
• bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
• bcache: do not pass BIOSET_NEED_BVECS for the 'bio_set' embedded in 'cache_set' (bsc#1187357).
• bcache: fix a regression of code compiling failure in debug.c (bsc#1187357).
• bcache: inherit the optimal I/O size (bsc#1187357).
• bcache: reduce redundant code in bch_cached_dev_run() (bsc#1187357).
• bcache: remove bcache device self-defined readahead (bsc#1187357, bsc#1185570, bsc#1184631).
• bcache: remove PTR_CACHE (bsc#1187357).
• bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
• bcache: use NULL instead of…

The SUSE Linux Enterprise 15 SP3 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. (bnc#1179610 bnc#1186463)
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free in drivers/infiniband/core/ucma.c which could be triggered if the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• ACPICA: Clean up context mutex during object deletion (git-fixes).
• ALSA: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 (git-fixes).
• ALSA: hda/realtek: headphone and mic do not work on an Acer laptop (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: update the power_state during the direct-complete (git-fixes).
• ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config (git-fixes).
• ASoC: amd: fix for pcm_read() error (git-fixes).
• ASoC: cs43130: handle errors in cs43130_probe() properly (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Enable CONFIG_PCI_PF_STUB for Nvidia Ampere vGPU support (jsc#SLE-17882 jsc#ECO-3691)
• HID: i2c-hid: Skip ELAN power-on command after reset (git-fixes).
• HID: i2c-hid: fix format string mismatch (git-fixes).
• HID: magicmouse: fix NULL-deref on disconnect (git-fixes).
• HID: multitouch: require Finger field to mark Win8 reports as MT (git-fixes).
• HID: pidff: fix error return code in hid_pidff_init() (git-fixes).
• NFC: SUSE specific brutal fix for runtime PM (bsc#1185589).
• NFS: Deal correctly with attribute generation counter overflow (git-fixes).
• NFS: Do not corrupt the value of pg_bytes_written in nfs_do_recoalesce() (git-fixes).
• NFS: Do not discard pNFS layout segments that are marked for return (git-fixes).
• NFS: Do not gratuitously clear the inode cache when lookup failed (git-fixes).
• NFS: Do not revalidate the directory permissions on a lookup failure (git-fixes).
• NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (git-fixes).
• NFS: fix an incorrect limit in filelayout_decode_layout() (git-fixes).
• NFSD: Repair misuse of sv_lock in 5.10.16-rt30 (git-fixes).
• NFSv4.2 fix handling of sr_eof in SEEK's reply (git-fixes).
• NFSv4.2: Always flush out writes in nfs42_proc_fallocate() (git-fixes).
• NFSv4.2: fix return value of _nfs4_get_security_label() (git-fixes).
• NFSv42: Copy offload should update the file size when appropriate (git-fixes).
• NFSv4: Do not discard segments marked for return in _pnfs_return_layout() (git-fixes).
• NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() (git-fixes).
• NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bnc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bnc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-33200: Fix leakage of uninitialized bpf stack under speculation. (bsc#1186484)

The following non-security bugs were fixed:

• af_packet: fix the tx skb protocol in raw sockets with ETH_P_ALL (bsc#1176081).
• kabi: preserve struct header_ops after bsc#1176081 fix (bsc#1176081).
• net: Do not set transport offset to invalid value (bsc#1176081).
• net: Introduce parse_protocol header_ops callback (bsc#1176081).
• net/ethernet: Add parse_protocol header_ops support (bsc#1176081).
• net/mlx5e: Remove the wrong assumption about transport offset (bsc#1176081).
• net/mlx5e: Trust kernel regarding transport offset (bsc#1176081).
• net/packet: Ask driver for protocol if not provided by user (bsc#1176081).
• net/packet: Remove redundant skb->protocol set (bsc#1176081).
• resource: Fix find_next_iomem_res() iteration issue (bsc#1181193).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).
• SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428).
• SUNRPC: More fixes for backlog congestion (bsc#1185428).
• x86/crash: Add e820 reserved ranges to kdump kernel's e820 table (bsc#1181193).
• x86/debug: Extend the lower bound of crash kernel low reservations (bsc#1153720).
• x86/e820, ioport: Add a new I/O resource descriptor IORES_DESC_RESERVED (bsc#1181193).
• x86/mm: Rework ioremap resource mapping determination (bsc#1181193).

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-0512: Fixed a possible out of bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bsc#1187595)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
• CVE-2021-29154: Fixed an incorrect computation of branch displacements in the BPF JIT compilers, which could allow to execute arbitrary code within the kernel context. (bsc#1184391)
• CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller. (bsc#1184611)
• CVE-2020-24586: Fixed a bug that, under the right circumstances, allows to inject arbitrary network packets and/or exfiltrate user data when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP. (bsc#1185859 bsc#1185863)
• CVE-2020-26139: Fixed a bug that allows an Access Point (AP) to forward EAPOL frames to other clients even though the sender has not yet successfully authenticated. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients. (bsc#1185863 bsc#1186062)
• CVE-2020-24587: Fixed a bug that allows an adversary to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (bsc#1185862 bsc#1185863)

The following non-security bugs were fixed:

• md: do not flush workqueue unconditionally in md_open (bsc#1184081).
• md: factor out a mddev_find_locked helper from mddev_find (bsc#1184081).
• md: md_open returns -EBUSY when entering racing area (bsc#1184081).
• md: split mddev_find (bsc#1184081).

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. (bnc#1179610 bnc#1186463)
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free in drivers/infiniband/core/ucma.c which could be triggered if the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• ACPICA: Clean up context mutex during object deletion (git-fixes).
• ALSA: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 (git-fixes).
• ALSA: hda/realtek: headphone and mic do not work on an Acer laptop (git-fixes).
• ALSA: hda: update the power_state during the direct-complete (git-fixes).
• ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• arm64: Add missing ISB after invalidating TLB in __primary_switch (git-fixes).
• arm64: avoid -Woverride-init warning (git-fixes).
• arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL (git-fixes).
• arm64: kdump: update ppos when reading elfcorehdr (git-fixes).
• arm64: kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails (git-fixes).
• arm64: link with -z norelro for LLD or aarch64-elf (git-fixes).
• arm64: link with -z norelro regardless of CONFIG_RELOCATABLE (git-fixes).
• arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory (git-fixes).
• arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) (git-fixes).
• arm64: ptrace: Use NO_SYSCALL instead of -1 in syscall_trace_enter() (git-fixes).
• ARM64: vdso32: Install vdso32 from vdso_install (git-fixes).
• arm64: vdso32: make vdso32 install conditional (git-fixes).
• arm: mm: use __pfn_to_section() to get mem_section (git-fixes).
• ASoC: amd: fix for pcm_read() error (git-fixes).
• ASoC: cs43130: handle errors in cs43130_probe() properly (git-fixes).
• ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• bcache: avoid oversized read request in cache missing code path (bsc#1187357, bsc#1185570, bsc#1184631).
• bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
• bcache: do not pass BIOSET_NEED_BVECS for the 'bio_set' embedded in 'cache_set' (bsc#1187357).
• bcache: fix a regression of code compiling failure in debug.c (bsc#1187357).
• bcache: inherit the optimal I/O size (bsc#1187357).
• bcache: reduce redundant code in bch_cached_dev_run() (bsc#1187357).
• bcache: remove bcache device self-defined readahead (bsc#1187357, bsc#1185570, bsc#1184631).
• bcache: remove PTR_CACHE (bsc#1187357).
• bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
• bcache: use NULL instead of…

The SUSE Linux Enterprise 15 SP3 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. (bnc#1179610 bnc#1186463)
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free in drivers/infiniband/core/ucma.c which could be triggered if the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• ACPICA: Clean up context mutex during object deletion (git-fixes).
• ALSA: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Elite Dragonfly G2 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8 (git-fixes).
• ALSA: hda/realtek: headphone and mic do not work on an Acer laptop (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• ALSA: hda: update the power_state during the direct-complete (git-fixes).
• ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config (git-fixes).
• ASoC: amd: fix for pcm_read() error (git-fixes).
• ASoC: cs43130: handle errors in cs43130_probe() properly (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Enable CONFIG_PCI_PF_STUB for Nvidia Ampere vGPU support (jsc#SLE-17882 jsc#ECO-3691)
• HID: i2c-hid: Skip ELAN power-on command after reset (git-fixes).
• HID: i2c-hid: fix format string mismatch (git-fixes).
• HID: magicmouse: fix NULL-deref on disconnect (git-fixes).
• HID: multitouch: require Finger field to mark Win8 reports as MT (git-fixes).
• HID: pidff: fix error return code in hid_pidff_init() (git-fixes).
• NFC: SUSE specific brutal fix for runtime PM (bsc#1185589).
• NFS: Deal correctly with attribute generation counter overflow (git-fixes).
• NFS: Do not corrupt the value of pg_bytes_written in nfs_do_recoalesce() (git-fixes).
• NFS: Do not discard pNFS layout segments that are marked for return (git-fixes).
• NFS: Do not gratuitously clear the inode cache when lookup failed (git-fixes).
• NFS: Do not revalidate the directory permissions on a lookup failure (git-fixes).
• NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (git-fixes).
• NFS: fix an incorrect limit in filelayout_decode_layout() (git-fixes).
• NFSD: Repair misuse of sv_lock in 5.10.16-rt30 (git-fixes).
• NFSv4.2 fix handling of sr_eof in SEEK's reply (git-fixes).
• NFSv4.2: Always flush out writes in nfs42_proc_fallocate() (git-fixes).
• NFSv4.2: fix return value of _nfs4_get_security_label() (git-fixes).
• NFSv42: Copy offload should update the file size when appropriate (git-fixes).
• NFSv4: Do not discard segments marked for return in _pnfs_return_layout() (git-fixes).
• NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() (git-fixes).
• NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2019-25045: Fixed an use-after-free issue in the Linux kernel The XFRM subsystem, related to an xfrm_state_fini panic. (bsc#1187049)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)

The following non-security bugs were fixed:

• ALSA: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• blk-mq: Swap two calls in blk_mq_exit_queue() (bsc#1187453).
• blk-wbt: Fix missed wakeup (bsc#1186627).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• btrfs: account for new extents being deleted in total_bytes_pinned (bsc#1135481).
• btrfs: add a comment explaining the data flush steps (bsc#1135481).
• btrfs: add btrfs_reserve_data_bytes and use it (bsc#1135481).
• btrfs: add flushing states for handling data reservations (bsc#1135481).
• btrfs: add missing error handling after doing leaf/node binary search (bsc#1187833).
• btrfs: add the data transaction commit logic into may_commit_transaction (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when freeing reserved bytes (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when reserving space (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when unpinning anything (bsc#1135481).
• btrfs: change insert_dirty_subvol to return errors (bsc#1187833).
• btrfs: change nr to u64 in btrfs_start_delalloc_roots (bsc#1135481).
• btrfs: check record_root_in_trans related failures in select_reloc_root (bsc#1187833).
• btrfs: check return value of btrfs_commit_transaction in relocation (bsc#1187833).
• btrfs: check tickets after waiting on ordered extents (bsc#1135481).
• btrfs: cleanup error handling in prepare_to_merge (bsc#1187833).
• btrfs: convert BUG_ON()'s in relocate_tree_block (bsc#1187833).
• btrfs: convert BUG_ON()'s in select_reloc_root() to proper errors (bsc#1187833).
• btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s (bsc#1187833).
• btrfs: convert some BUG_ON()'s to ASSERT()'s in do_relocation (bsc#1187833).
• btrfs: do async reclaim for data reservations (bsc#1135481).
• btrfs: do not force commit if we are data (bsc#1135481).
• btrfs: do not leak reloc root if we fail to read the fs root (bsc#1187833).
• btrfs: do not make defrag wait on async_delalloc_pages (bsc#1135481).
• btrfs: do not…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2019-25045: Fixed an use-after-free issue in the Linux kernel The XFRM subsystem, related to an xfrm_state_fini panic. (bsc#1187049)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)

The following non-security bugs were fixed:

• ALSA: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• blk-mq: Swap two calls in blk_mq_exit_queue() (bsc#1187453).
• blk-wbt: Fix missed wakeup (bsc#1186627).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• btrfs: account for new extents being deleted in total_bytes_pinned (bsc#1135481).
• btrfs: add a comment explaining the data flush steps (bsc#1135481).
• btrfs: add btrfs_reserve_data_bytes and use it (bsc#1135481).
• btrfs: add flushing states for handling data reservations (bsc#1135481).
• btrfs: add missing error handling after doing leaf/node binary search (bsc#1187833).
• btrfs: add the data transaction commit logic into may_commit_transaction (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when freeing reserved bytes (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when reserving space (bsc#1135481).
• btrfs: call btrfs_try_granting_tickets when unpinning anything (bsc#1135481).
• btrfs: change insert_dirty_subvol to return errors (bsc#1187833).
• btrfs: change nr to u64 in btrfs_start_delalloc_roots (bsc#1135481).
• btrfs: check record_root_in_trans related failures in select_reloc_root (bsc#1187833).
• btrfs: check return value of btrfs_commit_transaction in relocation (bsc#1187833).
• btrfs: check tickets after waiting on ordered extents (bsc#1135481).
• btrfs: cleanup error handling in prepare_to_merge (bsc#1187833).
• btrfs: convert BUG_ON()'s in relocate_tree_block (bsc#1187833).
• btrfs: convert BUG_ON()'s in select_reloc_root() to proper errors (bsc#1187833).
• btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s (bsc#1187833).
• btrfs: convert some BUG_ON()'s to ASSERT()'s in do_relocation (bsc#1187833).
• btrfs: do async reclaim for data reservations (bsc#1135481).
• btrfs: do not force commit if we are data (bsc#1135481).
• btrfs: do not leak reloc root if we fail to read the fs root (bsc#1187833).
• btrfs: do not make defrag wait on async_delalloc_pages (bsc#1135481).
• btrfs: do not…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling ioremap…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2019-25045: Fixed an use-after-free issue in the Linux kernel The XFRM subsystem, related to an xfrm_state_fini panic. (bsc#1187049)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)

The following non-security bugs were fixed:

• ACPI: custom_method: fix a possible memory leak (git-fixes).
• ACPI: custom_method: fix potential use-after-free issue (git-fixes).
• ACPI: GTDT: Do not corrupt interrupt mappings on watchdow probe failure (git-fixes).
• ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro (git-fixes).
• ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer (git-fixes).
• ALSA: hda/conexant: Re-order CX5066 quirk table entries (git-fixes).
• ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries (git-fixes).
• ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries (git-fixes).
• ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries (git-fixes).
• ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries (git-fixes).
• ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices (git-fixes).
• ALSA: hda/realtek: reset eapd coeff to default value for alc287 (git-fixes).
• ALSA: hdsp: do not disable if not enabled (git-fixes).
• ALSA: hdspm: do not disable if not enabled (git-fixes).
• ALSA: line6: Fix racy initialization of LINE6 MIDI (git-fixes).
• ALSA: rme9652: do not disable if not enabled (git-fixes).
• ALSA: sb: Fix two use after free in snd_sb_qsound_build (git-fixes).
• ALSA: timer: Fix master timer notification (git-fixes).
• ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: cs35l33: fix an error code in probe() (git-fixes).
• ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
• ASoC: rt286: Generalize support for ALC3263 codec (git-fixes).
• ASoC: rt286: Make RT286_SET_GPIO_* readable and writable (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• blk-mq: Swap two calls in blk_mq_exit_queue() (bsc#1187453).
• blk-wbt: Fix missed wakeup (bsc#1186627).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• Bluetooth: initialize skb_queue_head at l2cap_chan_create() (git-fixes).
• Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default (git-fixes).
• Bluetooth: SMP: Fail if remote and local public keys are identical (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)
• CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller. (bsc#1184611)
• CVE-2021-33034: Fixed an issue in net/bluetooth/hci_event.c where a use-after-free leads to writing an arbitrary value. (bsc#1186111)
• CVE-2020-26139: Fixed a bug that allows an Access Point (AP) to forward EAPOL frames to other clients even though the sender has not yet successfully authenticated. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients. (bsc#1186062)
• CVE-2021-23134: Fixed a use After Free vulnerability in nfc sockets which allows local attackers to elevate their privileges. (bsc#1186060)
• CVE-2020-24586: Fixed a bug that, under the right circumstances, allows to inject arbitrary network packets and/or exfiltrate user data when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP. (bsc#1185859)
• CVE-2020-26141: Fixed a flaw that could allows an adversary to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bsc#1185987)
• CVE-2020-26145: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject arbitrary network packets. (bsc#1185860)
• CVE-2020-24587: Fixed a bug that allows an adversary to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (bsc#1185862)
• CVE-2020-26147: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames. (bsc#1185987)

The following non-security bugs were fixed:

• kABI: Fix kABI after modifying struct __call_single_data (bsc#1180846).
• kernel/smp: add boot parameter for controlling CSD lock debugging (bsc#1180846).
• kernel/smp: Add source and destination CPUs to __call_single_data (bsc#1180846).
• kernel/smp: make csdlock timeout depend on boot parameter (bsc#1180846).
• kernel/smp: Provide CSD lock…

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116 ).
• CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062).
• CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
• CVE-2021-33624: In kernel/bpf/verifier.c a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db (bnc#1187554).
• CVE-2021-0605: In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1187601).
• CVE-2021-0512: In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1187595).
• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time (bnc#1179610).
• CVE-2021-34693: net/can/bcm.c in the Linux kernel allowed local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized (bnc#1187452).
• CVE-2020-36385: An issue was discovered in the Linux kernel drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c (bnc#1187050).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36386: An issue was discovered in the Linux kernel net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf (bnc#1187038).
• CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets (bnc#1185861).
• CVE-2021-33200: kernel/bpf/verifier.c enforced incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit (bnc#1186484).
• CVE-2021-33034: net/bluetooth/hci_event.c had a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value (bnc#1186111).
• CVE-2020-26139: An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients (bnc#1186062).…

The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116).
• CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062).
• CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215).
• CVE-2021-33624: In kernel/bpf/verifier.c a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db (bnc#1187554).
• CVE-2021-0605: In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the kernel with System execution privileges needed. User interaction is not needed for exploitation (bnc#1187601).
• CVE-2021-0512: In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1187595).
• CVE-2020-26558: Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time (bnc#1179610 bnc#1186463).
• CVE-2021-34693: net/can/bcm.c allowed local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized (bnc#1187452).
• CVE-2020-36385: An issue was discovered in drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c (bnc#1187050).
• CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36386: An issue was discovered net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf (bnc#1187038).
• CVE-2020-24588: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets (bnc#1185861).
• CVE-2021-33200: kernel/bpf/verifier.c enforced incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit (bnc#1186484).

The following non-security bugs were fixed:

• block: do not use blocking queue entered for recursive bio (bsc#1104967).
• s390/stack: fix possible register corruption with stack switch helper (git-fixes).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bnc#1179610)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bnc#1186463)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861 bsc#1185863)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-33200: Fix leakage of uninitialized bpf stack under speculation. (bsc#1186484)

The following non-security bugs were fixed:

• af_packet: fix the tx skb protocol in raw sockets with ETH_P_ALL (bsc#1176081).
• kabi: preserve struct header_ops after bsc#1176081 fix (bsc#1176081).
• net: Do not set transport offset to invalid value (bsc#1176081).
• net: Introduce parse_protocol header_ops callback (bsc#1176081).
• net/ethernet: Add parse_protocol header_ops support (bsc#1176081).
• net/mlx5e: Remove the wrong assumption about transport offset (bsc#1176081).
• net/mlx5e: Trust kernel regarding transport offset (bsc#1176081).
• net/packet: Ask driver for protocol if not provided by user (bsc#1176081).
• net/packet: Remove redundant skb->protocol set (bsc#1176081).
• resource: Fix find_next_iomem_res() iteration issue (bsc#1181193).
• scsi: scsi_dh_alua: Retry RTPG on a different path after failure (bsc#1174978 bsc#1185701).
• SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428).
• SUNRPC: More fixes for backlog congestion (bsc#1185428).
• x86/crash: Add e820 reserved ranges to kdump kernel's e820 table (bsc#1181193).
• x86/debug: Extend the lower bound of crash kernel low reservations (bsc#1153720).
• x86/e820, ioport: Add a new I/O resource descriptor IORES_DESC_RESERVED (bsc#1181193).
• x86/mm: Rework ioremap resource mapping determination (bsc#1181193).

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)
• CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463)
• CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610)
• CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038)
• CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861)
• CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller. (bsc#1184611)
• CVE-2021-33034: Fixed an issue in net/bluetooth/hci_event.c where a use-after-free leads to writing an arbitrary value. (bsc#1186111)
• CVE-2020-26139: Fixed a bug that allows an Access Point (AP) to forward EAPOL frames to other clients even though the sender has not yet successfully authenticated. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients. (bsc#1186062)
• CVE-2021-23134: Fixed a use After Free vulnerability in nfc sockets which allows local attackers to elevate their privileges. (bsc#1186060)
• CVE-2020-24586: Fixed a bug that, under the right circumstances, allows to inject arbitrary network packets and/or exfiltrate user data when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP. (bsc#1185859)
• CVE-2020-26141: Fixed a flaw that could allows an adversary to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bsc#1185987)
• CVE-2020-26145: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject arbitrary network packets. (bsc#1185860)
• CVE-2020-24587: Fixed a bug that allows an adversary to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (bsc#1185862)
• CVE-2020-26147: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames. (bsc#1185987)

The following non-security bugs were fixed:

• Bluetooth: SMP: Fail if remote and local public keys are identical (git-fixes).
• Drivers: hv: vmbus: Increase wait time for VMbus unload (bsc#1185724).
• Drivers: hv: vmbus: Initialize unload_event statically (bsc#1185724).
• hv_netvsc: Add handlers for ethtool get/set msg level (bsc#1175462).
• hv_netvsc: avoid retry on send during shutdown…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bsc#1187038).
• CVE-2021-22543: Fixed an improper handling of VM_IO|VM_PFNMAP vmas in KVM that allows users to start and control a VM to read/write random pages of memory and can result in local privilege escalation. (bnc#1186482)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
• ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
• ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
• HID: Add BUS_VIRTUAL to hid_connect logging (git-fixes).
• HID: gt683r: add missing MODULE_DEVICE_TABLE (git-fixes).
• HID: hid-sensor-hub: Return error for hid_set_field() failure (git-fixes).
• HID: usbhid: fix info leak in hid_submit_ctrl (git-fixes).
• HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes).
• Input: hil_kbd - fix error return code in hil_dev_connect() (git-fixes).
• Input: usbtouchscreen - fix control-request directions (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Mark TI C667X to avoid bus reset (git-fixes).
• PCI: Mark some NVIDIA GPUs to avoid bus reset…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bsc#1187038).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: quirks: fix false kABI positive (git-fixes).
• Revert 'USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem' (git-fixes).
• USB: cdc-acm: blacklist Heimann USB Appset device (git-fixes).
• USB: move many drivers to use DEVICE_ATTR_WO (git-fixes).
• USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: option: add support for u-blox LARA-R6 family (git-fixes).
• USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS (git-fixes).
• ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
• can: ems_usb: fix memory leak (git-fixes).
• can: esd_usb2: fix memory leak (git-fixes).
• can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
• can: mcba_usb_start(): add missing urb->transfer_dma initialization (git-fixes).
• can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF (git-fixes).
• can: sja1000: sja1000_err(): do not count arbitration lose as an error (git-fixes).
• can: sun4i_can: sun4i_can_err(): do not count arbitration lose as an error (git-fixes).
• can: ti_hecc: Fix memleak in ti_hecc_probe (git-fixes).
• can: usb_8dev: fix memory leak (git-fixes).
• ceph: do not WARN if we're still opening a session to an MDS (bsc#1188750).
• cifs: Fix preauth hash corruption (git-fixes).
• cifs: Return correct error code from…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bsc#1187038 ).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: quirks: fix false kABI positive (git-fixes).
• USB: cdc-acm: blacklist Heimann USB Appset device (git-fixes).
• USB: move many drivers to use DEVICE_ATTR_WO (git-fixes).
• USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: option: add support for u-blox LARA-R6 family (git-fixes).
• USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS (git-fixes).
• ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
• can: ems_usb: fix memory leak (git-fixes).
• can: esd_usb2: fix memory leak (git-fixes).
• can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
• can: mcba_usb_start(): add missing urb->transfer_dma initialization (git-fixes).
• can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF (git-fixes).
• can: sja1000: sja1000_err(): do not count arbitration lose as an error (git-fixes).
• can: sun4i_can: sun4i_can_err(): do not count arbitration lose as an error (git-fixes).
• can: ti_hecc: Fix memleak in ti_hecc_probe (git-fixes).
• can: usb_8dev: fix memory leak (git-fixes).
• ceph: do not WARN if we're still opening a session to an MDS (bsc#1188750).
• cifs: Fix preauth hash corruption (git-fixes).
• cifs: Return correct error code from smb2_get_enc_key (git-fixes).
• cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath (git-fixes).
• cifs: fix interrupted close commands (git-fixes).
• cifs: fix…