CVE-2021-3348

The Linux Kernel, the operating system core itself.

Security Fix(es):

In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.(CVE-2020-28374)

An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.(CVE-2020-29568)

In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-119770583(CVE-2020-27068)

A flaw was found in the Linux kernels implementation of MIDI, where an attacker with a local account and the permissions to issue an ioctl commands to midi devices, could trigger a use-after-free. A write to this specific memory while freed and before use could cause the flow of execution to change and possibly allow for memory corruption or privilege escalation.(CVE-2020-27786)

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.(CVE-2021-3347)

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.(CVE-2021-3348)

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0423)

mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.(CVE-2020-36158)

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2020-8694)

IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. (CVE-2020-4788)

An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value.(CVE-2019-16089)

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0465)

In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0466)

A flaw was found in the Linux kernel futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.(CVE-2020-28374)

An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.(CVE-2020-29568)

In the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-119770583(CVE-2020-27068)

A flaw was found in the Linux kernels implementation of MIDI, where an attacker with a local account and the permissions to issue an ioctl commands to midi devices, could trigger a use-after-free. A write to this specific memory while freed and before use could cause the flow of execution to change and possibly allow for memory corruption or privilege escalation.(CVE-2020-27786)

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.(CVE-2021-3347)

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.(CVE-2021-3348)

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0423)

mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.(CVE-2020-36158)

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.(CVE-2020-8694)

IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. (CVE-2020-4788)

An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value.(CVE-2019-16089)

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0465)

In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2020-0466)

A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can…

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: out-of-bounds reads in pinctrl subsystem (CVE-2020-0427)
• kernel: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24502)
• kernel: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24503)
• kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24504)
• kernel: Fragmentation cache not cleared on reconnection (CVE-2020-24586)
• kernel: Reassembling fragments encrypted under different keys (CVE-2020-24587)
• kernel: wifi frame payload being parsed incorrectly as an L2 frame (CVE-2020-24588)
• kernel: Forwarding EAPOL from unauthenticated wifi client (CVE-2020-26139)
• kernel: accepting plaintext data frames in protected networks (CVE-2020-26140)
• kernel: not verifying TKIP MIC of fragmented frames (CVE-2020-26141)
• kernel: accepting fragmented plaintext frames in protected networks (CVE-2020-26143)
• kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header (CVE-2020-26144)
• kernel: accepting plaintext broadcast fragments as full frames (CVE-2020-26145)
• kernel: powerpc: RTAS calls can be used to compromise kernel integrity (CVE-2020-27777)
• kernel: locking inconsistency in tty_io.c and tty_jobctrl.c can lead to a read-after-free (CVE-2020-29660)
• kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function via a long SSID value (CVE-2020-36158)
• kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt() (CVE-2020-36386)
• kernel: Improper access control in BlueZ may allow information disclosure vulnerability. (CVE-2021-0129)
• kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c (CVE-2021-3348)
• kernel: Linux kernel eBPF RINGBUF map oversized allocation (CVE-2021-3489)
• kernel: double free in bluetooth subsystem when the HCI device initialization fails (CVE-2021-3564)
• kernel: use-after-free in function hci_sock_bound_ioctl() (CVE-2021-3573)
• kernel: eBPF 32-bit source register truncation on div/mod (CVE-2021-3600)
• kernel: DoS in rb_per_cpu_empty() (CVE-2021-3679)
• kernel: Mounting overlayfs inside an unprivileged user namespace can reveal files (CVE-2021-3732)
• kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt() (CVE-2021-20194)
• kernel: Race condition in sctp_destroy_sock list_del (CVE-2021-23133)
• kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode (CVE-2021-28950)
• kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c (CVE-2021-28971)
• kernel: protection can be bypassed to leak content of kernel memory (CVE-2021-29155)
• kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c (CVE-2021-29646)
• kernel: lack a full memory barrier may lead to DoS (CVE-2021-29650)
• kernel: local escalation of privileges in handling of eBPF programs (CVE-2021-31440)
• kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak content of kernel memory (CVE-2021-31829)
• kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations by BPF verifier (CVE-2021-33200)
• kernel: reassembling encrypted fragments with non-consecutive packet numbers (CVE-2020-26146)
• kernel: reassembling mixed encrypted/plaintext fragments (CVE-2020-26147)
• kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check (CVE-2020-29368)
• kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50 (CVE-2021-3635)
• kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)
• kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure (CVE-2021-20239)
• kernel: out of bounds array access in drivers/md/dm-ioctl.c (CVE-2021-31916)

This kernel update is based on upstream 5.10.12 and fixes at least the following security issues:

fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS (CVE-2021-3178).

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel (CVE-2021-3347).

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (CVE-2021-3348).

It also adds the following fixes:

• ALSA: hda: Add Cometlake-R PCI ID
• ALSA: hda: Add AlderLake-P PCI ID and HDMI codec vid
• ALSA: hda/via: Apply the workaround generically for Clevo machines
• ASoC: AMD Renoir - refine DMI entries for some Lenovo products
• crypto: arm64/sha - add missing module aliases
• drm/amdgpu: Add Missing Sienna Cichlid DID
• drm/gpu/nouveau/dispnv50: Restore pushing of all data
• fix and re-enamble 3rdparty rtl8821ce driver (mga#28150)
• iwlwifi: provide gso_type to GSO packets (fixes upload speed regression)

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.10.14 and fixes at least the following security issues:

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (CVE-2021-3348).

A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c (CVE-2021-26708).

It also adds the following fixes:

• make CONNECTOR builtin to enable PROC_EVENTS (mga#28312)

For other upstream fixes, see the referenced changelogs.

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).

The following non-security bugs were fixed:

• ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
• ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
• ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
• ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
• ALSA: pcm: fix hw_rule deps kABI (bsc#1181014).
• ALSA: pcm: One more dependency for hw constraints (bsc#1181014).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: usb-audio: Always apply the hw constraints for implicit fb sync (bsc#1181014).
• ALSA: usb-audio: Annotate the endpoint index in audioformat (git-fixes).
• ALSA: usb-audio: Avoid implicit feedback on Pioneer devices (bsc#1181014).
• ALSA: usb-audio: Avoid unnecessary interface re-setup (git-fixes).
• ALSA: usb-audio: Choose audioformat of a counter-part substream (git-fixes).
• ALSA: usb-audio: Fix hw constraints dependencies (bsc#1181014).
• ALSA: usb-audio: Fix implicit feedback sync setup for Pioneer devices (git-fixes).
• ALSA: usb-audio: Fix the missing endpoints creations for quirks (git-fixes).
• ALSA: usb-audio: Fix UAC1 rate setup for secondary endpoints (bsc#1181014).
• ALSA: usb-audio: Set sample rate for all sharing EPs on UAC1 (bsc#1181014).
• arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback (bsc#1152489).
• arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (bsc#1180130).
• arm64: pgtable: Fix pte_accessible() (bsc#1180130).
• ASoC: ak4458: correct reset polarity (git-fixes).
• ASoC: dapm: remove widget from dirty list on free (git-fixes).
• ASoC: Intel: fix error code cnl_set_dsp_D0() (git-fixes).
• ASoC: meson: axg-tdm-interface: fix loopback (git-fixes). -…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-36158: Fixed an issue wich might have allowed a remote attackers to execute arbitrary code via a long SSID value in mwifiex_cmd_802_11_ad_hoc_start() (bnc#1180559).
• CVE-2020-28374: Fixed a vulnerability caused by insufficient identifier checking in the LIO SCSI target code. This could have been used by a remote attackers to read or write files via directory traversal in an XCOPY request (bnc#1178372).

The following non-security bugs were fixed:

• ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
• ALSA: hda/conexant: add a new hda codec CX11970 (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk for more HP laptops (git-fixes).
• ALSA: hda/realtek: Add two 'Intel Reference board' SSID in the ALC256 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
• ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 (git-fixes).
• ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
• ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (git-fixes).
• ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
• ALSA: hda/realtek - Modify Dell platform name (git-fixes).
• ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 (git-fixes).
• ALSA: hda/realtek - Supported Dell fixed type headset (git-fixes).
• ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).

The following non-security bugs were fixed:

• ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
• ALSA: hda/conexant: add a new hda codec CX11970 (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk for more HP laptops (git-fixes).
• ALSA: hda/realtek: Add two 'Intel Reference board' SSID in the ALC256 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
• ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 (git-fixes).
• ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
• ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (git-fixes).
• ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
• ALSA: hda/realtek - Modify Dell platform name (git-fixes).
• ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 (git-fixes).
• ALSA: hda/realtek - Supported Dell fixed type headset (git-fixes).
• ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: pcm: fix hw_rule deps kABI (bsc#1181014).
• ALSA: pcm: One more dependency for hw constraints (bsc#1181014).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: usb-audio: Add quirk for BOSS AD-10 (git-fixes).
• ALSA: usb-audio: Add quirk for RC-505 (git-fixes).
• ALSA: usb-audio: Always apply the hw constraints for implicit fb sync (bsc#1181014).
• ALSA:…

The SUSE Linux Enterprise 15 SP2 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).

The following non-security bugs were fixed:

• ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda/conexant: add a new hda codec CX11970 (git-fixes).
• ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).
• ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 (git-fixes).
• ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T (git-fixes).
• ALSA: hda/realtek - Modify Dell platform name (git-fixes).
• ALSA: hda/realtek - Supported Dell fixed type headset (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk for more HP laptops (git-fixes).
• ALSA: hda/realtek: Add two 'Intel Reference board' SSID in the ALC256 (git-fixes).
• ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256 (git-fixes).
• ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 (git-fixes).
• ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658 (git-fixes).
• ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines (git-fixes).
• ALSA: hda/tegra: fix tegra-hda on tegra30 soc (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Apply the workaround generically for Clevo machines (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: hda: Add Cometlake-R PCI ID (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: pcm: One more dependency for hw constraints (bsc#1181014).
• ALSA: pcm: fix hw_rule deps kABI (bsc#1181014).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: usb-audio: Add quirk for BOSS AD-10 (git-fixes).
• ALSA: usb-audio: Add quirk for RC-505 (git-fixes).
• ALSA: usb-audio:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).

The following non-security bugs were fixed:

• ACPI: PNP: compare the string length in the matching_id() (git-fixes).
• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
• ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
• ALSA: ca0106: fix error code handling (git-fixes).
• ALSA: ctl: allow TLV read operation for callback type of element in locked case (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO (git-fixes).
• ALSA: hda/generic: Add option to enforce preferred_dacs pairs (git-fixes).
• ALSA: hda/hdmi: always check pin power status in i915 pin fixup (git-fixes).
• ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged (git-fixes).
• ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 (git-fixes).
• ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table (git-fixes).
• ALSA: hda: Fix potential race in unsol event handler (git-fixes).
• ALSA: info: Drop WARN_ON() from buffer NULL sanity check (git-fixes).
• ALSA: isa/wavefront: prevent out of bounds write in ioctl (git-fixes).
• ALSA: line6: Perform sanity check for each URB creation (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: pcm: oss: Fix a few more UBSAN fixes (git-fixes).
• ALSA: pcm: oss: Fix potential out-of-bounds shift (git-fixes).
• ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check (git-fixes).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ALSA: timer: Limit max amount of slave instances (git-fixes).
• ALSA: usb-audio: Add delay quirk for H570e USB headsets (git-fixes).
• ALSA: usb-audio: Add…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket() that could be triggered by local attackers (with access to the nbd device) via an I/O request (bnc#1181504).
• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).

The following non-security bugs were fixed:

• blk-mq: improve heavily contended tag case (bsc#1178198).
• debugfs_lookup(): switch to lookup_one_len_unlocked() (bsc#1171979).
• epoll: Keep a reference on files added to the check list (bsc#1180031).
• fix regression in 'epoll: Keep a reference on files added to the check list' (bsc#1180031, git-fixes).
• futex: Do not enable IRQs…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395).
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
• CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).
• CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
• CVE-2020-10781: A flaw was found in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable (bnc#1173074).
• CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
• CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
• CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
• CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
• CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
• CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
• CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).
• CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
• CVE-2020-29371: An issue was discovered in romfs_dev_read in fs/romfs/storage.c where uninitialized memory leaks to userspace (bnc#1179429).
• CVE-2020-15437: Fixed a null pointer dereference which could have allowed local…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
• CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup (bnc#1181504).
• CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
• CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
• CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
• CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
• CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).

The following non-security bugs were fixed:

• ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
• ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
• ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
• ALSA: doc: Fix reference to mixart.rst (git-fixes).
• ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).
• ALSA: firewire-tascam: Fix integer overflow in midi_port_work() (git-fixes).
• ALSA: hda/via: Add minimum mute flag (git-fixes).
• ALSA: hda/via: Fix runtime PM for Clevo W35xSS (git-fixes).
• ALSA: pcm: Clear the full allocated memory at hw_params (git-fixes).
• ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() (git-fixes).
• ASoC: Intel: haswell: Add missing pm_ops (git-fixes).
• ASoC: dapm: remove widget from dirty list on free (git-fixes).
• EDAC/amd64: Fix PCI component registration (bsc#1112178).
• IB/mlx5: Fix DEVX support for MLX5_CMD_OP_INIT2INIT_QP command (bsc#1103991).
• KVM: SVM: Initialize prev_ga_tag before use (bsc#1180912).
• KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages (bsc#1181230).
• NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock (git-fixes).
• NFS: nfs_igrab_and_active must first reference the superblock (git-fixes).
• NFS: switch nfsiod to be an UNBOUND workqueue (git-fixes).
• NFSv4.2: condition READDIR's mask for security label based on LSM state (git-fixes).
• RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel() (bsc#1103992).
• RDMA/bnxt_re: Do not add user qps to flushlist (bsc#1050244 ).
• RDMA/bnxt_re: Do not report transparent vlan from QP1 (bsc#1104742).
• RDMA/cma: Do not overwrite sgid_attr after device is released (bsc#1103992).
• RDMA/core: Ensure security pkey modify is not lost (bsc#1046306 ).
• RDMA/core: Fix pkey and port assignment in get_new_pps (bsc#1046306).
• RDMA/core: Fix protection fault in get_pkey_idx_qp_list (bsc#1046306).
• RDMA/core: Fix reported speed and width (bsc#1046306 ).
• RDMA/core: Fix return error value in _ib_modify_qp() to negative (bsc#1103992).
• RDMA/core: Fix use of logical OR in get_new_pps (bsc#1046306 ).
• RDMA/hns: Bugfix for memory window mtpt configuration (bsc#1104427).
• RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver (bsc#1104427).
• RDMA/hns: Fix cmdq parameter of querying pf timer resource (bsc#1104427 bsc#1126206).
• RDMA/hns: Fix missing sq_sig_type when querying QP (bsc#1104427 ).
• RDMA/hns: bugfix for slab-out-of-bounds when…

The SUSE Linux Enterprise 12 SP5 kernel Azure was updated to receive various security and bugfixes.

The following security bugs was fixed:

• CVE-2021-3348: Fixed a use-after-free read in nbd_queue_rq (bsc#1181504).

The following non-security bugs were fixed:

• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• block: fix use-after-free in disk_part_iter_next (bsc#1182610).
• Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function (git-fixes).
• Bluetooth: drop HCI device reference before return (git-fixes).
• Bluetooth: Fix initializing response id after clearing struct (git-fixes).
• Bluetooth: Put HCI device if inquiry procedure interrupts (git-fixes).
• bonding: Fix reference count leak in bond_sysfs_slave_add (git-fixes).
• bonding: wait for sysfs kobject destruction before freeing struct slave (git-fixes).
• btrfs: Cleanup try_flush_qgroup (bsc#1182047).
• btrfs: correctly calculate item size used when item key collision happens (bsc#1181996).
• btrfs: correctly validate compression type (bsc#1182269).
• btrfs: delete the ordered isize update code (bsc#1181998).
• btrfs: Do not flush from btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: do not set path->leave_spinning for truncate (bsc#1181998).
• btrfs: factor out extent dropping code from hole punch handler (bsc#1182038).
• btrfs: fix cloning range with a hole when using the NO_HOLES feature (bsc#1182038).
• btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve (bsc#1182130)
• btrfs: fix ENOSPC errors, leading to transaction aborts, when cloning extents (bsc#1182038).
• btrfs: fix hole extent items with a zero size after range cloning (bsc#1182038).
• btrfs: fix lost i_size update after cloning inline extent (bsc#1181998).
• btrfs: fix mount failure caused by race with umount (bsc#1182248).
• btrfs: Fix race between extent freeing/allocation when using bitmaps (bsc#1181574).
• btrfs: fix unexpected cow in run_delalloc_nocow (bsc#1181987).
• btrfs: fix unexpected failure of nocow buffered writes after snapshotting when low on space (bsc#1181987).
• btrfs: Free correct amount of space in btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: incremental send, fix file corruption when no-holes feature is enabled (bsc#1182184).
• btrfs: Introduce extent_io_tree::owner to distinguish different io_trees (bsc#1181998).
• btrfs: introduce per-inode file extent tree (bsc#1181998).
• btrfs: prepare for extensions in compression options (bsc#1182269).
• btrfs: prop: fix vanished compression property after failed set (bsc#1182269).
• btrfs: prop: fix zstd compression parameter validation (bsc#1182269).
• btrfs: Remove btrfs_inode from btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: replace all uses of btrfs_ordered_update_i_size (bsc#1181998).
• btrfs: send, allow clone operations within the same file (bsc#1182173)
• btrfs: send, do not issue unnecessary truncate operations (bsc#1182173)
• btrfs: send, fix emission of invalid clone operations within the same file (bsc#1182173)
• btrfs: send, fix incorrect file layout after hole punching beyond eof (bsc#1182173).
• btrfs: send: fix invalid clone operations when cloning from the same file and root (bsc#1182173)
• btrfs: send, fix missing truncate for inode with prealloc extent past eof (bsc#1182173).
• btrfs: send, orphanize first all conflicting inodes when processing references (bsc#1182243 bsc#1182242).
• btrfs: send, recompute reference path after orphanization of a…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bug was fixed:

• CVE-2021-3348: Fixed a use-after-free read in nbd_queue_rq (bsc#1181504).

The following non-security bugs were fixed:

• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• block: fix use-after-free in disk_part_iter_next (bsc#1182610).
• Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function (git-fixes).
• Bluetooth: drop HCI device reference before return (git-fixes).
• Bluetooth: Fix initializing response id after clearing struct (git-fixes).
• Bluetooth: Put HCI device if inquiry procedure interrupts (git-fixes).
• bonding: Fix reference count leak in bond_sysfs_slave_add (git-fixes).
• bonding: wait for sysfs kobject destruction before freeing struct slave (git-fixes).
• BTRFS: Cleanup try_flush_qgroup (bsc#1182047).
• BTRFS: correctly calculate item size used when item key collision happens (bsc#1181996).
• BTRFS: correctly validate compression type (bsc#1182269).
• BTRFS: delete the ordered isize update code (bsc#1181998).
• BTRFS: Do not flush from btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• BTRFS: do not set path->leave_spinning for truncate (bsc#1181998).
• BTRFS: factor out extent dropping code from hole punch handler (bsc#1182038).
• BTRFS: fix cloning range with a hole when using the NO_HOLES feature (bsc#1182038).
• BTRFS: fix data bytes_may_use underflow with fallocate due to failed quota reserve (bsc#1182130)
• BTRFS: fix ENOSPC errors, leading to transaction aborts, when cloning extents (bsc#1182038).
• BTRFS: fix hole extent items with a zero size after range cloning (bsc#1182038).
• BTRFS: fix lost i_size update after cloning inline extent (bsc#1181998).
• BTRFS: fix mount failure caused by race with umount (bsc#1182248).
• BTRFS: Fix race between extent freeing/allocation when using bitmaps (bsc#1181574).
• BTRFS: fix unexpected cow in run_delalloc_nocow (bsc#1181987).
• BTRFS: fix unexpected failure of nocow buffered writes after snapshotting when low on space (bsc#1181987).
• BTRFS: Free correct amount of space in btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• BTRFS: incremental send, fix file corruption when no-holes feature is enabled (bsc#1182184).
• BTRFS: Introduce extent_io_tree::owner to distinguish different io_trees (bsc#1181998).
• BTRFS: introduce per-inode file extent tree (bsc#1181998).
• BTRFS: prepare for extensions in compression options (bsc#1182269).
• BTRFS: prop: fix vanished compression property after failed set (bsc#1182269).
• BTRFS: prop: fix zstd compression parameter validation (bsc#1182269).
• BTRFS: Remove btrfs_inode from btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• BTRFS: replace all uses of btrfs_ordered_update_i_size (bsc#1181998).
• BTRFS: send, allow clone operations within the same file (bsc#1182173)
• BTRFS: send, do not issue unnecessary truncate operations (bsc#1182173)
• BTRFS: send, fix emission of invalid clone operations within the same file (bsc#1182173)
• BTRFS: send, fix incorrect file layout after hole punching beyond eof (bsc#1182173).
• BTRFS: send: fix invalid clone operations when cloning from the same file and root (bsc#1182173)
• BTRFS: send, fix missing truncate for inode with prealloc extent past eof (bsc#1182173).
• BTRFS: send, orphanize first all conflicting inodes when processing references (bsc#1182243 bsc#1182242).
• BTRFS: send, recompute reference path after orphanization of a directory…

Loris Reiff discovered that the BPF implementation in the Linux kernel did not properly validate attributes in the getsockopt BPF hook. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-20194)

It was discovered that the priority inheritance futex implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3347)

It was discovered that the network block device (nbd) driver in the Linux kernel contained a use-after-free vulnerability during device setup. A local attacker with access to the nbd device could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3348)

Wen Xu discovered that the xfs file system implementation in the Linux kernel did not properly validate the number of extents in an inode. An attacker could use this to construct a malicious xfs image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13095)

It was discovered that the priority inheritance futex implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3347)

It was discovered that the network block device (nbd) driver in the Linux kernel contained a use-after-free vulnerability during device setup. A local attacker with access to the nbd device could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3348)

Loris Reiff discovered that the BPF implementation in the Linux kernel did not properly validate attributes in the getsockopt BPF hook. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-20194)

Olivier Benjamin, Norbert Manthey, Martin Mazein, and Jan H. Schönherr discovered that the Xen paravirtualization backend in the Linux kernel did not properly propagate errors to frontend drivers in some situations. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26930)

Jan Beulich discovered that multiple Xen backends in the Linux kernel did not properly handle certain error conditions under paravirtualization. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2021-26931)

It was discovered that the network block device (nbd) driver in the Linux kernel contained a use-after-free vulnerability during device setup. A local attacker with access to the nbd device could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3348)

Ryota Shiga discovered that the sockopt BPF hooks in the Linux kernel could allow a user space program to probe for valid kernel addresses. A local attacker could use this to ease exploitation of another kernel vulnerability. (CVE-2021-20239)

It was discovered that the BPF verifier in the Linux kernel did not properly handle signed add32 and sub integer overflows. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-20268)

It was discovered that the priority inheritance futex implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3347)

It was discovered that the network block device (nbd) driver in the Linux kernel contained a use-after-free vulnerability during device setup. A local attacker with access to the nbd device could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3348)

吴异 discovered that the NFS implementation in the Linux kernel did not properly prevent access outside of an NFS export that is a subdirectory of a file system. An attacker could possibly use this to bypass NFS access restrictions. (CVE-2021-3178)