CVE-2021-26930

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c.

The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.

Security Fix(es):

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.(CVE-2021-26931)

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c.(CVE-2021-26930)

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.(CVE-2021-26932)

An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.(CVE-2021-28038)

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.(CVE-2021-27363)

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.(CVE-2021-27364)

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.(CVE-2021-27365)

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c.

• udf: Restore i_lenAlloc when inode expansion fails (Jan Kara) {CVE-2022-0617}
• udf: Fix NULL ptr deref when converting from inline format (Jan Kara) {CVE-2022-0617}
• Bluetooth: fix use-after-free error in lock_sock_nested() (Wang ShaoBo) {CVE-2021-3752}
• vt_kdsetmode: extend console locking (Linus Torvalds) {CVE-2021-3753}
• fget: check that the fd still exists after getting a ref to it (Linus Torvalds) {CVE-2021-4083}
• ipv6: use prandom_u32() for ID generation (Willy Tarreau) {CVE-2021-45485}
• virtio_console: Assure used length from device is limited (Xie Yongji) {CVE-2021-38160}
• bpf: Fix integer overflow in prealloc_elems_and_freelist() (Tatsuhiko Yasumatsu) {CVE-2021-41864}
• ext4: fix race writing to an inline_data file while its xattrs are changing (Theodore Ts'o) {CVE-2021-40490}
• xen-blkback: fix error handling in xen_blkbk_map() (Jan Beulich) {CVE-2021-26930}
• bpf, x86: Validate computation of branch displacements for x86-32 (Piotr Krysiuk) {CVE-2021-29154}
• bpf, x86: Validate computation of branch displacements for x86-64 (Piotr Krysiuk) {CVE-2021-29154}
• tipc: improve size validations for received domain records (Jon Paul Maloy) {CVE-2022-0435}
• cgroup: verify that source is a string (Christian Brauner) {CVE-2021-4154}

This kernel update is based on upstream 5.10.19 and fixes at least the following security issues:

There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y, CONFIG_BPF=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation. NOTE! Mageia kernel configs have HARDENED_USERCOPY enabled by default, making this an non-issue when using prebuilt kernels (CVE-2021-20194).

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability (CVE-2021-21781).

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error (CVE-2021-26930).

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though (CVE-2021-26931).

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable (CVE-2021-26932).

It also adds the following fixes:

• enable ACPI_EC_DEBUGFS (mga#28415)
• ALSA: hda: Add another CometLake-H PCI ID
• Revert 'drm/amd/display: Update NV1x SR latency values'
• drm/nouveau/kms: handle mDP connectors
• drm/i915/gt: One more flush for Baytrail clear residuals
• drm/i915/gt: Flush before changing register state
• drm/i915/gt: Correct surface base address for renderclear
• rtw88: 8821c: add RFE type 2 support
• update rtw89 patchset to v3
• tracing: Check length before giving out the filter buffer
• drop "revert 'Bluetooth: btusb: Add Qualcomm Bluetooth SoC WCN6855 support' (mga#27910)"
• Bluetooth: btusb: fix for Qualcomm Bluetooth adapters that stopped working due to not finding (unneeded) ROME firmware (real fix for mga#27910)
• media: uvcvideo: Allow entities with no pads
• mm/vmscan: restore zone_reclaim_mode ABI
• nvme: Add quirks for Lexar 256GB SSD (pterjan, mga#28417)
• nvme: add 48-bit DMA address quirk for Amazon NVMe controllers
• nvme-pci: add the…

This kernel-linus update is based on upstream 5.10.19 and fixes at least the following security issues:

There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y, CONFIG_BPF=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation. NOTE! Mageia kernel configs have HARDENED_USERCOPY enabled by default, making this an non-issue when using prebuilt kernels (CVE-2021-20194).

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability (CVE-2021-21781).

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error (CVE-2021-26930).

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though (CVE-2021-26931).

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable (CVE-2021-26932).

It also adds the following fixes:

• enable ACPI_EC_DEBUGFS (mga#28415)

For other upstream fixes, see the referenced changelogs.

This kernel update is based on upstream 5.10.19 and fixes at least the following security issues:

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability (CVE-2021-21781).

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error (CVE-2021-26930).

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though (CVE-2021-26931).

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable (CVE-2021-26932).

It also adds the following fixes:

• enable ACPI_EC_DEBUGFS (mga#28415)
• drop "revert 'Bluetooth: btusb: Add Qualcomm Bluetooth SoC WCN6855 support' (mga#27910)"
• Bluetooth: btusb: fix for Qualcomm Bluetooth adapters that stopped working due to not finding (unneeded) ROME firmware (real fix for mga#27910)
• media: uvcvideo: Allow entities with no pads
• mm/vmscan: restore zone_reclaim_mode ABI
• nvme: Add quirks for Lexar 256GB SSD (pterjan, mga#28417)
• nvme: add 48-bit DMA address quirk for Amazon NVMe controllers
• nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a SPCC device
• staging/rtl8723bs: sync with 5.12-rc1 (mga#28429)
• x86: fix seq_file iteration for pat/memtype.c

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.10.19 and fixes at least the following security issues:

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability (CVE-2021-21781).

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error (CVE-2021-26930).

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though (CVE-2021-26931).

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable (CVE-2021-26932).

It also adds the following fixes:

• enable ACPI_EC_DEBUGFS (mga#28415)

For other upstream fixes, see the referenced changelogs.

The openSUSE Linux Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).
• CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).
• CVE-2020-12364: Fixed a null pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).
• CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• ACPICA: Fix exception code class checks (git-fixes).
• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 2) (git-fixes).
• ALSA: hda: Add another CometLake-H PCI ID (git-fixes).
• ALSA: hda/hdmi: Drop bogus check at closing a stream (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• ALSA: pcm: Assure sync with the pending stop operation at suspend (git-fixes).
• ALSA: pcm: Call sync_stop at disconnection (git-fixes).
• ALSA: pcm: Do not call sync_stop if it hasn't been stopped (git-fixes).
• ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 (git-fixes).
• ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() (git-fixes).
• ALSA: usb-audio: Do not avoid stopping the stream at disconnection (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• ALSA: usb-audio: Handle invalid running state at releasing EP (git-fixes).
• ALSA: usb-audio: More strict state change in EP (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• armv7hl: lpae: Update config files. Disable KVM support (bsc#1182697)
• ASoC: cpcap: fix microphone timeslot mask (git-fixes).
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ASoC: simple-card-utils: Fix device module clock (git-fixes).
• ASoC: SOF: debug: Fix a potential issue on string buffer termination (git-fixes).
• ata: ahci_brcm: Add back regulators management (git-fixes).
• ata: sata_nv: Fix retrieving of active qcs (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• bcache: fix overflow in offset_to_stripe() (git-fixes).
• blk-mq: call commit_rqs while list empty but error happen (bsc#1182442).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (bsc#1182443).
• blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (bsc#1182444).
• block: fix inflight statistics of part0 (bsc#1182445).
• block: respect queue limit of max discard segment (bsc#1182441).
• block: virtio_blk: fix handling single range discard request (bsc#1182439).
• Bluetooth: btqcomsmd: Fix…

The SUSE Linux Enterprise 15 SP2 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).
• CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).
• CVE-2020-12364: Fixed a null pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).
• CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• ACPICA: Fix exception code class checks (git-fixes).
• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 2) (git-fixes).
• ALSA: hda: Add another CometLake-H PCI ID (git-fixes).
• ALSA: hda/hdmi: Drop bogus check at closing a stream (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• ALSA: pcm: Assure sync with the pending stop operation at suspend (git-fixes).
• ALSA: pcm: Call sync_stop at disconnection (git-fixes).
• ALSA: pcm: Do not call sync_stop if it hasn't been stopped (git-fixes).
• ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 (git-fixes).
• ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() (git-fixes).
• ALSA: usb-audio: Do not avoid stopping the stream at disconnection (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• ALSA: usb-audio: Handle invalid running state at releasing EP (git-fixes).
• ALSA: usb-audio: More strict state change in EP (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• ASoC: cpcap: fix microphone timeslot mask (git-fixes).
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ASoC: simple-card-utils: Fix device module clock (git-fixes).
• ASoC: SOF: debug: Fix a potential issue on string buffer termination (git-fixes).
• ata: ahci_brcm: Add back regulators management (git-fixes).
• ata: sata_nv: Fix retrieving of active qcs (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• bcache: fix overflow in offset_to_stripe() (git-fixes).
• blk-mq: call commit_rqs while list empty but error happen (bsc#1182442).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (bsc#1182443).
• blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (bsc#1182444).
• block: fix inflight statistics of part0 (bsc#1182445).
• block: respect queue limit of max discard segment (bsc#1182441).
• block: virtio_blk: fix handling single range discard request (bsc#1182439).
• Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• cifs: check all path components in resolved dfs target (bsc#1180906).
• cifs: fix check of tcon dfs in smb1 (bsc#1180906).
• cifs: fix nodfs mount option (bsc#1180906).
• cifs: introduce helper for finding referral server (bsc#1180906).
• kernel-{binary,source}.spec.in: do not create loop symlinks (bsc#1179082)
• kernel-binary.spec: Add back initrd and image symlink ghosts to filelist (bsc#1182140). Fixes: 76a9256314c3 ('rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).')
• kernel-source.spec: Fix build with rpm 4.16 (boo#1179015). RPM_BUILD_ROOT is cleared before %%install. Do the unpack into RPM_BUILD_ROOT in %%install
• rpm/kernel-binary.spec.in: avoid using barewords (bsc#1179014)
• rpm/kernel-binary.spec.in: avoid using more barewords (bsc#1179014) %split_extra still contained two.
• rpm/kernel-binary.spec.in: Fix compressed module handling for in-tree KMP (jsc#SLE-10886)
• rpm/kernel-binary.spec.in: use grep -E instead of egrep (bsc#1179045) egrep is only a deprecated bash wrapper for 'grep -E'. So use the latter instead.
• rpm/kernel-module-subpackage: make Group tag optional (bsc#1163592)
• rpm/kernel-obs-build.spec.in: Add -q option to modprobe calls (bsc#1178401)
• rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).
• rpm/mkspec: do not build kernel-obs-build on x86_32 We want to use 64bit kernel due to various bugs (bsc#1178762 to name one). There is: ExportFilter: ^kernel-obs-build.*.x86_64.rpm$ . i586 in Factory's prjconf now. No other actively maintained distro (i.e. merging packaging branch) builds a x86_32 kernel, hence pushing to packaging directly.
• rpm/post.sh: Avoid purge-kernel for the first installed kernel (bsc#1180058)
• scripts/lib/SUSE/MyBS.pm: properly close prjconf Macros: section
• scsi: fc: add FPIN ELS definition (bsc#1181441).
• scsi/fc: kABI fixes for new ELS_FPIN definition (bsc#1181441)
• scsi: fc: Update Descriptor definition and add RDF and Link Integrity FPINs (bsc#1181441).
• scsi: Fix trivial spelling (bsc#1181441).
• scsi: qla2xxx: Add IOCB resource tracking (bsc#1181441).
• scsi: qla2xxx: Add more BUILD_BUG_ON() statements (bsc#1181441).
• scsi: qla2xxx: Address a set of sparse warnings (bsc#1181441).
• scsi: qla2xxx: Add rport fields in debugfs (bsc#1181441).
• scsi: qla2xxx: Add SLER and PI control support (bsc#1181441).
• scsi: qla2xxx: Allow dev_loss_tmo setting for FC-NVMe devices (bsc#1181441).
• scsi: qla2xxx: Allow ql2xextended_error_logging special value 1 to be set anytime (bsc#1181441).
• scsi: qla2xxx: Cast explicitly to uint16_t / uint32_t (bsc#1181441).
• scsi: qla2xxx: Change in PUREX to handle FPIN ELS requests (bsc#1181441).
• scsi: qla2xxx: Change post del message from debug level to log level (bsc#1181441).
• scsi: qla2xxx: Change {RD,WRT}REG*() function names from upper case into lower case (bsc#1181441).
• scsi: qla2xxx: Change two hardcoded constants into offsetof() / sizeof() expressions (bsc#1181441).
• scsi: qla2xxx: Check if FW supports MQ before enabling (bsc#1181441).
• scsi: qla2xxx: Check the size of struct fcp_hdr at compile time (bsc#1181441).
• scsi: qla2xxx: Correct the check for sscanf()…

The SUSE Linux Enterprise 15 SP1 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• btrfs: Cleanup try_flush_qgroup (bsc#1182047).
• btrfs: Do not flush from btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve (bsc#1182130)
• btrfs: Free correct amount of space in btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: Remove btrfs_inode from btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: Simplify code flow in btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: Unlock extents in btrfs_zero_range in case of errors (bsc#1182047).
• Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() (git-fixes).
• ibmvnic: fix a race between open and reset (bsc#1176855 ltc#187293).
• kernel-binary.spec: Add back initrd and image symlink ghosts to filelist (bsc#1182140). Fixes: 76a9256314c3 ('rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).')
• libnvdimm/dimm: Avoid race between probe and available_slots_show() (bsc#1170442).
• net: bcmgenet: add support for ethtool rxnfc flows (git-fixes).
• net: bcmgenet: code movement (git-fixes).
• net: bcmgenet: fix mask check in bcmgenet_validate_flow() (git-fixes).
• net: bcmgenet: Fix WoL with password after deep sleep (git-fixes).
• net: bcmgenet: re-remove bcmgenet_hfb_add_filter (git-fixes).
• net: bcmgenet: set Rx mode before starting netif (git-fixes).
• net: bcmgenet: use __be16 for htons(ETH_P_IP) (git-fixes).
• net: bcmgenet: Use correct I/O accessors (git-fixes).
• net: lpc-enet: fix error return code in lpc_mii_init() (git-fixes).
• net/mlx4_en: Handle TX error CQE (bsc#1181854).
• net: moxa: Fix a potential double 'free_irq()' (git-fixes).
• net: sun: fix missing release regions in cas_init_one() (git-fixes).
• nvme-multipath: Early exit if no path is available (bsc#1180964).
• rpm/post.sh: Avoid purge-kernel for the first installed kernel (bsc#1180058)
• scsi: target: fix unmap_zeroes_data boolean initialisation (bsc#1163617).
• usb: dwc2: Abort transaction after errors with unknown reason (bsc#1180262).
• usb: dwc2: Do not update data length if it is 0 on inbound transfers (bsc#1180262).
• usb: dwc2: Make 'trimming xfer length' a debug message (bsc#1180262).
• vmxnet3: Remove buf_info from device accessible structures (bsc#1181671).
• xen/netback: avoid race in xenvif_rx_ring_slots_available() (bsc#1065600).
• xen/netback: fix spurious event detection for common event case (bsc#1182175).

The SUSE Linux Enterprise 15 SP2 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).
• CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).
• CVE-2020-12364: Fixed a null pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).
• CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• ACPICA: Fix exception code class checks (git-fixes).
• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 2) (git-fixes).
• ALSA: hda: Add another CometLake-H PCI ID (git-fixes).
• ALSA: hda/hdmi: Drop bogus check at closing a stream (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• ALSA: pcm: Assure sync with the pending stop operation at suspend (git-fixes).
• ALSA: pcm: Call sync_stop at disconnection (git-fixes).
• ALSA: pcm: Do not call sync_stop if it hasn't been stopped (git-fixes).
• ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 (git-fixes).
• ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() (git-fixes).
• ALSA: usb-audio: Do not avoid stopping the stream at disconnection (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• ALSA: usb-audio: Handle invalid running state at releasing EP (git-fixes).
• ALSA: usb-audio: More strict state change in EP (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• ASoC: cpcap: fix microphone timeslot mask (git-fixes).
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ASoC: simple-card-utils: Fix device module clock (git-fixes).
• ASoC: SOF: debug: Fix a potential issue on string buffer termination (git-fixes).
• ata: ahci_brcm: Add back regulators management (git-fixes).
• ata: sata_nv: Fix retrieving of active qcs (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• bcache: fix overflow in offset_to_stripe() (git-fixes).
• blk-mq: call commit_rqs while list empty but error happen (bsc#1182442).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (bsc#1182443).
• blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (bsc#1182444).
• block: fix inflight statistics of part0 (bsc#1182445).
• block: respect queue limit of max discard segment (bsc#1182441).
• block: virtio_blk: fix handling single range discard request (bsc#1182439).
• Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• kernel-{binary,source}.spec.in: do not create loop symlinks (bsc#1179082)
• kernel-source.spec: Fix build with rpm 4.16 (boo#1179015).
• rpm/kernel-binary.spec.in: avoid using barewords (bsc#1179014)
• rpm/kernel-binary.spec.in: avoid using more barewords (bsc#1179014) %split_extra still contained two.
• rpm/kernel-binary.spec.in: Fix compressed module handling for in-tree KMP (jsc#SLE-10886) The in-tree KMP that is built with SLE kernels have a different scriptlet that is embedded in kernel-binary.spec.in rather than *.sh files.
• rpm/kernel-binary.spec.in: use grep -E instead of egrep (bsc#1179045) egrep is only a deprecated bash wrapper for 'grep -E'. So use the latter instead.
• rpm/kernel-module-subpackage: make Group tag optional (bsc#1163592)
• rpm/kernel-obs-build.spec.in: Add -q option to modprobe calls (bsc#1178401)
• rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).
• rpm/mkspec: do not build kernel-obs-build on x86_32 We want to use 64bit kernel due to various bugs (bsc#1178762 to name one).
• rpm/post.sh: Avoid purge-kernel for the first installed kernel (bsc#1180058)
• xen/netback: avoid race in xenvif_rx_ring_slots_available() (bsc#1065600).
• xen/netback: fix spurious event detection for common event case (bsc#1182175).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).
• CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).
• CVE-2020-12364: Fixed a null pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).
• CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 2) (git-fixes).
• ALSA: hda: Add another CometLake-H PCI ID (git-fixes).
• ALSA: hda/hdmi: Drop bogus check at closing a stream (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• ALSA: pcm: Assure sync with the pending stop operation at suspend (git-fixes).
• ALSA: pcm: Call sync_stop at disconnection (git-fixes).
• ALSA: pcm: Do not call sync_stop if it hasn't been stopped (git-fixes).
• ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 (git-fixes).
• ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() (git-fixes).
• ALSA: usb-audio: Do not avoid stopping the stream at disconnection (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• ALSA: usb-audio: Handle invalid running state at releasing EP (git-fixes).
• ALSA: usb-audio: More strict state change in EP (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• ASoC: cpcap: fix microphone timeslot mask (git-fixes).
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ASoC: simple-card-utils: Fix device module clock (git-fixes).
• ASoC: SOF: debug: Fix a potential issue on string buffer termination (git-fixes).
• ata: ahci_brcm: Add back regulators management (git-fixes).
• ata: sata_nv: Fix retrieving of active qcs (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• bcache: fix overflow in offset_to_stripe() (git-fixes).
• blk-mq: call commit_rqs while list empty but error happen (bsc#1182442).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (bsc#1182443).
• blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (bsc#1182444).
• block: fix inflight statistics of part0 (bsc#1182445).
• block: respect queue limit of max discard segment (bsc#1182441).
• block: virtio_blk: fix handling single range discard request (bsc#1182439).
• Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function (git-fixes).
• Bluetooth: btusb: Fix memory leak in…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).

The following non-security bugs were fixed:

• cifs: report error instead of invalid when revalidating a dentry fails (bsc#1177440).
• xen/netback: fix spurious event detection for common event case (bsc#1182175).

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).

The following non-security bug was fixed:

• xen/netback: fix spurious event detection for common event case (bsc#1182175).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).
• CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).
• CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).
• CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).
• CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).
• CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).
• CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).
• CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).
• CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).
• CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).
• CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).
• CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).
• CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).
• CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).
• CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).
• CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).
• CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).

The following non-security bugs were fixed:

• ACPI: scan: Rearrange memory allocation in acpi_device_add() (git-fixes).
• ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits (git-fixes).
• ALSA: hda: Drop the BATCH workaround for AMD controllers (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• bfq: Fix kABI for update internal depth state…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).
• CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).
• CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).
• CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).
• CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).
• CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).
• CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).
• CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).
• CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).
• CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).
• CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).
• CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).
• CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).
• CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).
• CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).
• CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).
• CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).
• CVE-2020-27673: Fixed a potential denial of service at high rate of events to dom0, aka CID-e99502f76271 (bsc#1177411 ).

The following non-security bugs were fixed:

• ACPI: scan: Rearrange memory allocation in acpi_device_add() (git-fixes).
• ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits (git-fixes).
• ALSA: hda: Drop the BATCH workaround for AMD controllers (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).
• CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).
• CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).
• CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).
• CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).
• CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).
• CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).
• CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).
• CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).
• CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).
• CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).
• CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access (bsc#1179660, bsc#1179428).
• CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).
• CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).
• CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).
• CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).
• CVE-2021-3483: Fixed a use-after-free in nosy.c (bsc#1184393).
• CVE-2021-30002: Fixed a memory leak for large arguments in video_usercopy (bsc#1184120).
• CVE-2021-29154: Fixed incorrect computation of branch displacements, allowing arbitrary code execution (bsc#1184391).
• CVE-2021-20219: Fixed a denial of service in n_tty_receive_char_special (bsc#1184397).
• CVE-2020-36311: Fixed a denial of service (soft lockup) by triggering destruction of a large SEV VM (bsc#1184511).
• CVE-2020-25670,…

This update for the Linux Kernel 4.12.14-150_58 fixes several issues.

The following security issues were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184171).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc##1182294, bsc#1183646).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1182294).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1183022).

This update for the Linux Kernel 5.3.18-24_49 fixes several issues.

The following security issues were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184171).
• CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183658).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc##1182294, bsc#1183646).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1182294).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1183022).

This update for the Linux Kernel 4.4.180-94_135 fixes one issue.

The following security issues were fixed:

• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc##1182294, bsc#1183646).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1182294).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1183022).

Ben Harris discovered that the Linux kernel would strip extended privilege attributes of files when performing a failed unprivileged system call. A local attacker could use this to cause a denial of service. (CVE-2015-1350)

Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PVR USB devices in the Linux kernel did not properly handle some error conditions. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16644)

It was discovered that the timer stats implementation in the Linux kernel allowed the discovery of a real PID value while inside a PID namespace. A local attacker could use this to expose sensitive information. (CVE-2017-5967)

Wen Xu discovered that the xfs file system implementation in the Linux kernel did not properly validate the number of extents in an inode. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13095)

It was discovered that the Fujitsu ES network device driver for the Linux kernel did not properly check for errors in some situations, leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service. (CVE-2019-16231)

It was discovered that the Marvell 8xxx Libertas WLAN device driver in the Linux kernel did not properly check for errors in certain situations, leading to a NULL pointer dereference. A local attacker could possibly use this to cause a denial of service. (CVE-2019-16232)

It was discovered that the ADIS16400 IIO IMU Driver for the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-19061)

It was discovered that a race condition existed in the floppy device driver in the Linux kernel. An attacker with access to the floppy device could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-20261)

Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schönherr discovered that the Xen paravirtualization backend in the Linux kernel did not properly propagate errors to frontend drivers in some situations. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26930)

Jan Beulich discovered that multiple Xen backends in the Linux kernel did not properly handle certain error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26931)

Jan Beulich discovered that the Xen netback backend in the Linux kernel did not properly handle certain error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-28038)

Loris Reiff discovered that the BPF implementation in the Linux kernel did not properly validate attributes in the getsockopt BPF hook. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-20194)

Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schönherr discovered that the Xen paravirtualization backend in the Linux kernel did not properly propagate errors to frontend drivers in some situations. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26930)

Jan Beulich discovered that multiple Xen backends in the Linux kernel did not properly handle certain error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26931)

It was discovered that the network block device (nbd) driver in the Linux kernel contained a use-after-free vulnerability during device setup. A local attacker with access to the nbd device could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3348)

It was discovered that the DRM subsystem in the Linux kernel contained double-free vulnerabilities. A privileged attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-20292)

Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schönherr discovered that the Xen paravirtualization backend in the Linux kernel did not properly propagate errors to frontend drivers in some situations. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26930)

Jan Beulich discovered that multiple Xen backends in the Linux kernel did not properly handle certain error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26931)

Jan Beulich discovered that the Xen netback backend in the Linux kernel did not properly handle certain error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-28038)

It was discovered that the Xen paravirtualization backend in the Linux kernel did not properly deallocate memory in some situations. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-28688)

It was discovered that the Freescale Gianfar Ethernet driver for the Linux kernel did not properly handle receive queue overrun when jumbo frames were enabled in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2021-29264)

It was discovered that the USB/IP driver in the Linux kernel contained race conditions during the update of local and shared status. An attacker could use this to cause a denial of service (system crash). (CVE-2021-29265)

It was discovered that a race condition existed in the netfilter subsystem of the Linux kernel when replacing tables. A local attacker could use this to cause a denial of service (system crash). (CVE-2021-29650)

Arnd Bergmann discovered that the video4linux subsystem in the Linux kernel did not properly deallocate memory in some situations. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-30002)

Ryota Shiga discovered that the eBPF implementation in the Linux kernel did not properly verify that a BPF program only reserved as much memory for a ring buffer as was allocated. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3489)

Manfred Paul discovered that the eBPF implementation in the Linux kernel did not properly track bounds on bitwise operations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3490)

Billy Jheng Bing-Jhong discovered that the io_uring implementation of the Linux kernel did not properly enforce the MAX_RW_COUNT limit in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3491)

It was discovered that the Nouveau GPU driver in the Linux kernel did not properly handle error conditions in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25639)

Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schönherr discovered that the Xen paravirtualization backend in the Linux kernel did not properly propagate errors to frontend drivers in some situations. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26930)

Jan Beulich discovered that multiple Xen backends in the Linux kernel did not properly handle certain error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26931)

It was discovered that the fastrpc driver in the Linux kernel did not prevent user space applications from sending kernel RPC messages. A local attacker could possibly use this to gain elevated privileges. (CVE-2021-28375)

It was discovered that the Freescale Gianfar Ethernet driver for the Linux kernel did not properly handle receive queue overrun when jumbo frames were enabled in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2021-29264)

It was discovered that the USB/IP driver in the Linux kernel contained race conditions during the update of local and shared status. An attacker could use this to cause a denial of service (system crash). (CVE-2021-29265)

It was discovered that the vDPA backend virtio driver in the Linux kernel contained a use-after-free vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-29266)

It was discovered that the TIPC protocol implementation in the Linux kernel did not properly validate passed encryption key sizes. A local attacker could use this to cause a denial of service (system crash). (CVE-2021-29646)

It was discovered that a race condition existed in the netfilter subsystem of the Linux kernel when replacing tables. A local attacker could use this to cause a denial of service (system crash). (CVE-2021-29650)