CVE-2021-3347

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.(CVE-2020-28374)

An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.(CVE-2020-29568)

In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-119770583(CVE-2020-27068)

A flaw was found in the Linux kernels implementation of MIDI, where an attacker with a local account and the permissions to issue an ioctl commands to midi devices, could trigger a use-after-free. A write to this specific memory while freed and before use could cause the flow of execution to change and possibly allow for memory corruption or privilege escalation.(CVE-2020-27786)

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.(CVE-2021-3347)

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.(CVE-2021-3348)

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0423)

mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.(CVE-2020-36158)

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2020-8694)

IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. (CVE-2020-4788)

An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value.(CVE-2019-16089)

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0465)

In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0466)

A flaw was found in the Linux kernel futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.(CVE-2020-28374)

An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.(CVE-2020-29568)

In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-119770583(CVE-2020-27068)

A flaw was found in the Linux kernels implementation of MIDI, where an attacker with a local account and the permissions to issue an ioctl commands to midi devices, could trigger a use-after-free. A write to this specific memory while freed and before use could cause the flow of execution to change and possibly allow for memory corruption or privilege escalation.(CVE-2020-27786)

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.(CVE-2021-3347)

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.(CVE-2021-3348)

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0423)

mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.(CVE-2020-36158)

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2020-8694)

IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. (CVE-2020-4788)

An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value.(CVE-2019-16089)

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0465)

In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0466)

A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can…

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use after free in eventpoll.c may lead to escalation of privilege (CVE-2020-0466)

• kernel: SCSI target (LIO) write to any block on ILO backstore (CVE-2020-28374)

• kernel: Use after free via PI futex state (CVE-2021-3347)

• kernel: race conditions caused by wrong locking in net/vmw_vsock/af_vsock.c (CVE-2021-26708)

• kernel: out-of-bounds read in libiscsi module (CVE-2021-27364)

• kernel: heap buffer overflow in the iSCSI subsystem (CVE-2021-27365)

• Kernel: KVM: host stack overflow due to lazy update IOAPIC (CVE-2020-27152)

• kernel: iscsi: unrestricted access to sessions and handles (CVE-2021-27363)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• race condition when creating child sockets from syncookies (BZ#1915529)

• On System Z, a hash needs state randomized for entropy extraction (BZ#1915816)

• scsi: target: core_tmr_abort_task() reporting multiple aborts for the same se_cmd->tag (BZ#1918354)

• [mlx5] VF interface stats are not reflected in "ip -s link show" / "ifconfig <vf>" commands (BZ#1921060)

• Win10 guest automatic reboot after migration in Win10 and WSL2 on Intel hosts (BZ#1923281)

• [AlmaLinux 8.3] Repeated messages - Unable to burst-read optrom segment (BZ#1924222)

• Backport bug fix RDMA/umem: Prevent small pages from being returned by ib_umem_find_best_pgsz (BZ#1924691)

• [Cisco 8.3] AlmaLinux/Cent 8.2 fNIC driver needs a patch fix that addresses crash (BZ#1925186)

• AlmaLinux8.3 - The kernel misdetects zCX with z/VM (BZ#1925508)

• Backport 22e4663e91 ("mm/slub: fix panic in slab_alloc_node()") (BZ#1925511)

• SCTP "Address already in use" when no active endpoints from AlmaLinux 8.2 onwards (BZ#1927521)

• lpfc: Fix initial FLOGI failure due to BBSCN not supported (BZ#1927921)

• [mm] mm, oom: remove oom_lock from oom_reaper (BZ#1929738)

• Unexpected thread movement with AMD Milan compared to Rome (BZ#1929740)

• rpmbuild cannot build the userspace RPMs in the kernel package when the kernel itself is not built (BZ#1929910)

• [Regression] AlmaLinux8.2 - ISST-LTE:pVM:diapvmlp83:sum:memory DLPAR fails to add memory on multiple trials[mm/memory_hotplug.c:1163] (mm-) (BZ#1930168)

• Configuring the system with non-RT kernel will hang the system (BZ#1930735)

• Upstream Patch for Gracefully handle DMAR units with no supported address widthsx86/vt-d (BZ#1932199)

• gfs2: Deadlock between gfs2_{create_inode,inode_lookup} and delete_work_func (BZ#1937109)

• Failing on tsx-ctrl when the flag doesn't change anything (BZ#1939013)

Enhancement(s):

• RFE: Backport all Audit enhancements and fixes up to version 5.10-rc1 (BZ#1907520)

• AlmaLinux8.4: Update the target driver (BZ#1918363)

• [Mellanox 8.4 FEAT] mlx5: Hairpin Support in Switch Mode (BZ#1924689)

In fixup_pi_state_owner of futex.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• ELS-138: netfilter: x_tables: add missing tables zeroing
• ELS-138: CVE-2021-33909: seq_file: disallow extremely large seq buffer allocation
• ELS-138: CVE-2021-22555: netfilter: x_tables: fix compat match/target pad out-of-bound write
• ELS-138: CVE-2020-29661: tty: Fix ->pgrp locking in tiocspgrp()
• ELS-138: CVE-2020-25656: vt: keyboard, extend func_buf_lock to readers
• ELS-138: CVE-2020-25656: tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
• ELS-138: CVE-2020-25656: vt: keyboard, simplify vt_kdgkbsent
• ELS-138: CVE-2020-25211: netfilter: ctnetlink: add a range check for l3/l4 protonum
• ELS-138: CKSIX-276: CVE-2019-19532: HID: Fix assumption that devices have inputs
• ELS-138: CVE-2021-27365: scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE
• ELS-138: CVE-2021-27365: scsi: iscsi: Verify lengths on passthrough PDUs
• ELS-138: CVE-2021-27363: CVE-2021-27364: scsi: iscsi: Restrict sessions and handles to admin capabilities
• ELS-138: sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
• ELS-138: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
• ELS-138: CVE-2019-14615: drm/i915/gen9: Clear residual context state on context switch
• ELS-138: CVE-2020-8647, CVE-2020-8649: vgacon: Fix a UAF in vgacon_invert_region
• ELS-138: CVE-2020-14331: vgacon: Fix for missing check in scrollback handling
• ELS-138: CVE-2021-3347: futex: Handle faults correctly for PI futexes
• ELS-138: CVE-2021-3347: futex: Provide and use pi_state_update_owner()
• ELS-138: KEYS: allow reaching the keys quotas exactly
• ELS-138: KEYS: reaching the keys quotas correctly
• ELS-138: fix -ENOMEM result with invalid user space pointer in sendto() syscall
• ELS-138: CVE-2017-18344: posix-timer: Properly check sigevent->sigev_notify
• ELS-138: CVE-2018-6927: futex: Prevent overflow by strengthen input validation
• ELS-138: CVE-2017-6951: KEYS: Change the name of the dead type to ".dead" to prevent user access
• ELS-138: CVE-2017-15299: KEYS: don't let add_key() update an uninstantiated key
• ELS-138: fix CVE-2016-9604
• ELS-138: KEYS: add missing permission check for request_key() destination
• ELS-138: CVE-2017-10661: timerfd: Protect the might cancel mechanism proper
• ELS-138: fix CVE-2017-7472
• ELS-138: fix CVE-2017-15274

• CKSIX-267: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
• CKSIX-267: CVE-2019-14615: drm/i915/gen9: Clear residual context state on context switch
• CKSIX-267: CVE-2020-8647, CVE-2020-8649: vgacon: Fix a UAF in vgacon_invert_region
• CKSIX-267: CVE-2020-14331: vgacon: Fix for missing check in scrollback handling
• CKSIX-268: CVE-2021-3347: futex: Handle faults correctly for PI futexes
• CKSIX-268: CVE-2021-3347: futex: Provide and use pi_state_update_owner()
• CKSIX-263: KEYS: allow reaching the keys quotas exactly
• CKSIX-263: KEYS: reaching the keys quotas correctly
• CKSIX-263: fix -ENOMEM result with invalid user space pointer in sendto() syscall
• CKSIX-263: CVE-2017-18344: posix-timer: Properly check sigevent->sigev_notify
• CKSIX-263: CVE-2018-6927: futex: Prevent overflow by strengthen input validation
• CKSIX-258: CVE-2017-6951: KEYS: Change the name of the dead type to ".dead" to prevent user access
• CKSIX-258: CVE-2017-15299: KEYS: don't let add_key() update an uninstantiated key
• CKSIX-258: fix CVE-2016-9604
• CKSIX-258: KEYS: add missing permission check for request_key() destination
• CKSIX-258: CVE-2017-10661: timerfd: Protect the might cancel mechanism proper
• CKSIX-258: fix CVE-2017-7472
• CKSIX-258: fix CVE-2017-15274

This kernel update is based on upstream 5.10.12 and fixes at least the following security issues:

fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS (CVE-2021-3178).

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel (CVE-2021-3347).

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (CVE-2021-3348).

It also adds the following fixes:

• ALSA: hda: Add Cometlake-R PCI ID
• ALSA: hda: Add AlderLake-P PCI ID and HDMI codec vid
• ALSA: hda/via: Apply the workaround generically for Clevo machines
• ASoC: AMD Renoir - refine DMI entries for some Lenovo products
• crypto: arm64/sha - add missing module aliases
• drm/amdgpu: Add Missing Sienna Cichlid DID
• drm/gpu/nouveau/dispnv50: Restore pushing of all data
• fix and re-enamble 3rdparty rtl8821ce driver (mga#28150)
• iwlwifi: provide gso_type to GSO packets (fixes upload speed regression)

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.10.12 and fixes at least the following security issue:

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel (CVE-2021-3347).

For other upstream fixes, see the referenced changelog.

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).

The following non-security bugs were fixed:

• ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
• ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
• ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
• ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
• ALSA: pcm: fix hw_rule deps kABI (bsc#1181014).
• ALSA: pcm: One more dependency for hw constraints (bsc#1181014).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: usb-audio: Always apply the hw constraints for implicit fb sync (bsc#1181014).
• ALSA: usb-audio: Annotate the endpoint index in audioformat (git-fixes).
• ALSA: usb-audio: Avoid implicit feedback on Pioneer devices (bsc#1181014).
• ALSA: usb-audio: Avoid unnecessary interface re-setup (git-fixes).
• ALSA: usb-audio: Choose audioformat of a counter-part substream (git-fixes).
• ALSA: usb-audio: Fix hw constraints dependencies (bsc#1181014).
• ALSA: usb-audio: Fix implicit feedback sync setup for Pioneer devices (git-fixes).
• ALSA: usb-audio: Fix the missing endpoints creations for quirks (git-fixes).
• ALSA: usb-audio: Fix UAC1 rate setup for secondary endpoints (bsc#1181014).
• ALSA: usb-audio: Set sample rate for all sharing EPs on UAC1 (bsc#1181014).
• arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback (bsc#1152489).
• arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (bsc#1180130).
• arm64: pgtable: Fix pte_accessible() (bsc#1180130).
• ASoC: ak4458: correct reset polarity (git-fixes).
• ASoC: dapm: remove widget from dirty list on free (git-fixes).
• ASoC: Intel: fix error code cnl_set_dsp_D0() (git-fixes).
• ASoC: meson: axg-tdm-interface: fix loopback (git-fixes). -…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-36158: Fixed an issue wich might have allowed a remote attackers to execute arbitrary code via a long SSID value in mwifiex_cmd_802_11_ad_hoc_start() (bnc#1180559).
• CVE-2020-28374: Fixed a vulnerability caused by insufficient identifier checking in the LIO SCSI target code. This could have been used by a remote attackers to read or write files via directory traversal in an XCOPY request (bnc#1178372).

The following non-security bugs were fixed:

• ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
• ALSA: hda/conexant: add a new hda codec CX11970 (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk for more HP laptops (git-fixes).
• ALSA: hda/realtek: Add two 'Intel Reference board' SSID in the ALC256 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
• ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 (git-fixes).
• ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
• ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (git-fixes).
• ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
• ALSA: hda/realtek - Modify Dell platform name (git-fixes).
• ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 (git-fixes).
• ALSA: hda/realtek - Supported Dell fixed type headset (git-fixes).
• ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-36158: Fixed an issue wich might have allowed a remote attackers to execute arbitrary code via a long SSID value in mwifiex_cmd_802_11_ad_hoc_start() (bnc#1180559).
• CVE-2020-28374: Fixed a vulnerability caused by insufficient identifier checking in the LIO SCSI target code. This could have been used by a remote attackers to read or write files via directory traversal in an XCOPY request (bnc#1178372).

The following non-security bugs were fixed:

• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check (git-fixes).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: timer: Limit max amount of slave instances (git-fixes).
• ALSA: usb-audio: Add delay quirk for all…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).

The following non-security bugs were fixed:

• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (bsc#1180130).
• arm64: pgtable: Fix pte_accessible() (bsc#1180130).
• ASoC: dapm: remove widget from dirty list on free (git-fixes).
• ASoC: Intel: haswell: Add missing pm_ops (git-fixes).
• bnxt_en: Do not query FW when netif_running() is false (bsc#1086282).
• bnxt_en: Fix accumulation of bp->net_stats_prev (bsc#1104745 ).
• bnxt_en: fix error return code in bnxt_init_board() (git-fixes).
• bnxt_en: fix error return code in bnxt_init_one() (bsc#1050242 ).
• bnxt_en: fix HWRM error when querying VF temperature (bsc#1104745).
• bnxt_en: Improve stats context resource accounting with RDMA driver loaded (bsc#1104745).
• bnxt_en: read EEPROM A2h address using page 0 (git-fixes).
• bnxt_en: Release PCI regions when DMA mask setup fails during probe (git-fixes).
• bnxt_en: Reset rings if ring reservation fails during open() (bsc#1086282).
• bnxt_en: return proper error codes in bnxt_show_temp (bsc#1104745).
• bonding: set dev->needed_headroom in bond_setup_by_slave() (git-fixes).
• btrfs: add a flags argument to LOGICAL_INO and call it LOGICAL_INO_V2 (bsc#1174206).
• btrfs: add a flag to iterate_inodes_from_logical to find all
• btrfs: add a flag to iterate_inodes_from_logical to find all extent refs for uncompressed extents (bsc#1174206).
• btrfs: add a flag to iterate_inodes_from_logical to find all extent refs for uncompressed extents (bsc#1174206).
• btrfs: increase output size for LOGICAL_INO_V2 ioctl (bsc#1174206).
• btrfs: qgroup: do not try to wait flushing if we're already holding a transaction (bsc#1179575).
• caif: no need to check return value of debugfs_create functions (git-fixes).
• can: c_can: c_can_power_up(): fix error handling (git-fixes).
• can: dev:…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).

The following non-security bugs were fixed:

• ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
• ALSA: hda/conexant: add a new hda codec CX11970 (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk for more HP laptops (git-fixes).
• ALSA: hda/realtek: Add two 'Intel Reference board' SSID in the ALC256 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
• ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 (git-fixes).
• ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
• ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (git-fixes).
• ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
• ALSA: hda/realtek - Modify Dell platform name (git-fixes).
• ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 (git-fixes).
• ALSA: hda/realtek - Supported Dell fixed type headset (git-fixes).
• ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: pcm: fix hw_rule deps kABI (bsc#1181014).
• ALSA: pcm: One more dependency for hw constraints (bsc#1181014).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: usb-audio: Add quirk for BOSS AD-10 (git-fixes).
• ALSA: usb-audio: Add quirk for RC-505 (git-fixes).
• ALSA: usb-audio: Always apply the hw constraints for implicit fb sync (bsc#1181014).
• ALSA:…

The SUSE Linux Enterprise 15 SP2 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).

The following non-security bugs were fixed:

• ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda/conexant: add a new hda codec CX11970 (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
• ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (git-fixes).
• ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
• ALSA: hda/realtek - Modify Dell platform name (git-fixes).
• ALSA: hda/realtek - Supported Dell fixed type headset (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk for more HP laptops (git-fixes).
• ALSA: hda/realtek: Add two 'Intel Reference board' SSID in the ALC256 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
• ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 (git-fixes).
• ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 (git-fixes).
• ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
• ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: pcm: One more dependency for hw constraints (bsc#1181014).
• ALSA: pcm: fix hw_rule deps kABI (bsc#1181014).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: usb-audio: Add quirk for BOSS AD-10 (git-fixes).
• ALSA: usb-audio: Add quirk for RC-505 (git-fixes).
• ALSA: usb-audio:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check (git-fixes).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: timer: Limit max amount of slave instances (git-fixes).
• ALSA: usb-audio: Add delay quirk for H570e USB headsets (git-fixes).
• ALSA: usb-audio: Add…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket() that could be triggered by local attackers (with access to the nbd device) via an I/O request (bnc#1181504).
• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).

The following non-security bugs were fixed:

• blk-mq: improve heavily contended tag case (bsc#1178198).
• debugfs_lookup(): switch to lookup_one_len_unlocked() (bsc#1171979).
• epoll: Keep a reference on files added to the check list (bsc#1180031).
• fix regression in 'epoll: Keep a reference on files added to the check list' (bsc#1180031, git-fixes).
• futex: Do not enable IRQs…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (bnc#1176485 ).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service (bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2019-19063: Fixed two memory leaks in the rtl_usb_probe() which could eventually have allowed attackers to cause a denial of service (memory consumption) (bnc#1157298 ).
• CVE-2019-6133: Fixed an issue where the 'start time' protection mechanism could have been bypassed and therefore authorization decisions are improperly cached (bsc#1128172).

The following non-security bugs were fixed:

• HID: Fix slab-out-of-bounds read in hid_field_extract (bsc#1180052).
• epoll: Keep a reference on files added to the check list (bsc#1180031).
• fix regression in 'epoll: Keep a reference…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-10781: A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable (bnc#1173074).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c where uninitialized memory leaks to userspace (bnc#1179429).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
• CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation (bnc#1105322).

The following non-security bugs were fixed:

• cifs: do not revalidate mountpoint dentries (bsc#1177440).
• cifs: fix potential use-after-free in cifs_echo_request() (bsc#1139944).
• cifs: ignore…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).

The following non-security bugs were fixed:

• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ASoC: Intel: haswell: Add missing pm_ops (git-fixes).
• ASoC: dapm: remove widget from dirty list on free (git-fixes).
• EDAC/amd64: Fix PCI component registration (bsc#1112178).
• IB/mlx5: Fix DEVX support for MLX5_CMD_OP_INIT2INIT_QP command (bsc#1103991).
• KVM: SVM: Initialize prev_ga_tag before use (bsc#1180912).
• KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages (bsc#1181230).
• NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock (git-fixes).
• NFS: nfs_igrab_and_active must first reference the superblock (git-fixes).
• NFS: switch nfsiod to be an UNBOUND workqueue (git-fixes).
• NFSv4.2: condition READDIR's mask for security label based on LSM state (git-fixes).
• RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel() (bsc#1103992).
• RDMA/bnxt_re: Do not add user qps to flushlist (bsc#1050244 ).
• RDMA/bnxt_re: Do not report transparent vlan from QP1 (bsc#1104742).
• RDMA/cma: Do not overwrite sgid_attr after device is released (bsc#1103992).
• RDMA/core: Ensure security pkey modify is not lost (bsc#1046306 ).
• RDMA/core: Fix pkey and port assignment in get_new_pps (bsc#1046306).
• RDMA/core: Fix protection fault in get_pkey_idx_qp_list (bsc#1046306).
• RDMA/core: Fix reported speed and width (bsc#1046306 ).
• RDMA/core: Fix return error value in _ib_modify_qp() to negative (bsc#1103992).
• RDMA/core: Fix use of logical OR in get_new_pps (bsc#1046306 ).
• RDMA/hns: Bugfix for memory window mtpt configuration (bsc#1104427).
• RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver (bsc#1104427).
• RDMA/hns: Fix cmdq parameter of querying pf timer resource (bsc#1104427 bsc#1126206).
• RDMA/hns: Fix missing sq_sig_type when querying QP (bsc#1104427 ).
• RDMA/hns: bugfix for slab-out-of-bounds when…

This update for the Linux Kernel 4.12.14-197_78 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2021-0342: Fixed a potential memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges required (bsc#1180859).

This update for the Linux Kernel 4.12.14-197_75 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).
• CVE-2021-0342: Fixed a potential memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges required (bsc#1180859).

This update for the Linux Kernel 4.12.14-95_54 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• Fixed an issue where NFS client filesystems got unmounted on fail-over (bsc#1182468).
• Fixed an issue where NFS client hanged on write errors (bsc#1182108).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).

This update for the Linux Kernel 4.12.14-95_48 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• Fixed an issue where NFS client filesystems got unmounted on fail-over (bsc#1182468).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).