CVE-2021-34981

The Linux Kernel, the operating system core itself.

Security Fix(es):

An improper validation of an array index and out of bounds memory read in the Linux kernel s Integrated Services Digital Network (ISDN) functionality was found in the way users call ioctl CMTPCONNADD. A local user could use this flaw to crash the system or starve the resources causing denial of service.(CVE-2021-3896)

A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.(CVE-2021-3760)

A flaw was found in the Linux kernel s CAPI over Bluetooth connection code. An attacker with a local account can escalate privileges when CAPI (ISDN) hardware connection fails.(CVE-2021-34981)

Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150(CVE-2020-3702)

UAF in Android ION memory allocator.(CVE-2021-0929)

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.(CVE-2021-20322)

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.(CVE-2021-20320)

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c.(CVE-2021-43389)

Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released.(CVE-2020-16119)

Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the CMTP module. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11977.

• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-34981
  • Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
• CVE-url: https://ubuntu.com/security/CVE-2025-37797
  • net_sched: hfsc: Fix a UAF vulnerability in class handling
• CVE-url: https://ubuntu.com/security/CVE-2024-57996 // CVE-url: https://ubuntu.com/security/CVE-2025-37752
  • net_sched: sch_sfq: move the limit validation
• Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-50202 // CVE-url: https://ubuntu.com/security/CVE-2024-50202
  • nilfs2: propagate directory read errors from nilfs_find_entry()
• Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-50202
  • nilfs2: Remove check for PageError
  • nilfs2: return the mapped address from nilfs_get_page()
• CVE-url: https://ubuntu.com/security/CVE-2024-50202
  • make ext2_get_page() and friends work without external serialization
• Bionic update: upstream stable patchset 2021-08-03 (LP: #1938824) // CVE- url: https://ubuntu.com/security/CVE-2021-47345
  • RDMA/cma: Fix rdma_resolve_route() memory leak
• Focal update: v5.4.287 upstream stable release (LP: #2095145) // CVE-url: https://ubuntu.com/security/CVE-2024-53131
  • nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
• Focal update: v5.4.287 upstream stable release (LP: #2095145) // CVE-url: https://ubuntu.com/security/CVE-2024-53130
  • nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
• CVE-url: https://ubuntu.com/security/CVE-2025-37798
  • codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
• CVE-url: https://ubuntu.com/security/CVE-2025-21640
  • sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
• CVE-url: https://ubuntu.com/security/CVE-2024-57913
  • usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
• CVE-url: https://ubuntu.com/security/CVE-2025-21638
  • sctp: sysctl: auth_enable: avoid using current->nsproxy
• CVE-url: https://ubuntu.com/security/CVE-2024-50195
  • posix-clock: Fix missing timespec64 check in pc_clock_settime()
• CVE-url: https://ubuntu.com/security/CVE-2024-50299
  • sctp: properly validate chunk size in sctp_sf_ootb()
• CVE-url: https://ubuntu.com/security/CVE-2024-41016
  • ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
• CVE-url: https://ubuntu.com/security/CVE-2024-50287
  • media: v4l2-tpg: prevent the risk of a division by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-49965
  • ocfs2: remove unreasonable unlock in ocfs2_read_blocks
• CVE-url: https://ubuntu.com/security/CVE-2024-50179
  • ceph: remove the incorrect Fw reference check when dirtying pages
• CVE-url: https://ubuntu.com/security/CVE-2024-40953
  • KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
• CVE-url: https://ubuntu.com/security/CVE-2024-50290
  • media: cx24116: prevent overflows on SNR calculus
• CVE-url: https://ubuntu.com/security/CVE-2024-49877
  • ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-50008
  • wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
• CVE-url: https://ubuntu.com/security/CVE-2024-49959
  • jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
• CVE-url: https://ubuntu.com/security/CVE-2024-49963
  • mailbox: bcm2835: Fix timeout during suspend mode
• CVE-url: https://ubuntu.com/security/CVE-2024-47709
  • can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
• CVE-url: https://ubuntu.com/security/CVE-2025-21699
  • gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
• CVE-url: https://ubuntu.com/security/CVE-2025-21689
  • USB:…

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: Reduce udelay() at SKL+ position reporting (git-fixes).
• ALSA: ua101: fix division by zero at probe (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ASoC: cs42l42: Correct some register default values (git-fixes).
• ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER (git-fixes).
• ASoC: cs42l42: Do not set defaults for volatile registers (git-fixes).
• ASoC: dt-bindings: cs42l42: Correct description of ts-inv (git-fixes).
• ASoC: mediatek: mt8195: Remove unsued irqs_lock (git-fixes).
• ASoC: rockchip: Use generic dmaengine code (git-fixes).
• ata: sata_mv: Fix the error handling of mv_chip_id() (git-fixes).
• ath10k: fix control-message timeout (git-fixes).
• ath10k: fix division by zero in send path (git-fixes).
• ath10k: fix max antenna gain unit (git-fixes).
• ath10k: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
• ath6kl: fix control-message timeout (git-fixes).
• ath6kl: fix division by zero in send path (git-fixes).
• ath9k: Fix potential interrupt storm on queue reset (git-fixes).
• auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
• auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes).
• auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (git-fixes).
• b43: fix a lower bounds test (git-fixes).
• b43legacy: fix a lower bounds test (git-fixes).
• Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync (git-fixes).
• Bluetooth: fix init and cleanup of sco_conn.timeout_work (git-fixes).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22573)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22573).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• btrfs: block-group: Rework documentation of check_system_chunk function (bsc#1192896).
• btrfs: fix deadlock between chunk allocation and chunk btree modifications (bsc#1192896).
• btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
• btrfs: update comments for chunk allocation -ENOSPC cases (bsc#1192896).
• cgroup/cpuset: Change…

The SUSE Linux Enterprise 15 SP3 kernel for Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: fix general protection fault in azx_runtime_idle (git-fixes).
• ALSA: hda: Free card instance properly at probe errors (git-fixes).
• ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14 (git-fixes).
• ALSA: hda: Reduce udelay() at SKL+ position reporting (git-fixes).
• ALSA: hda: Use position buffer for SKL+ again (git-fixes).
• ALSA: ua101: fix division by zero at probe (git-fixes).
• ALSA: uapi: Fix a C++ style comment in asound.h (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add minimal-mute notion in dB mapping table (bsc#1192375).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Fix dB level of Bose Revolve+ SoundLink (bsc#1192375).
• ALSA: usb-audio: Use int for dB map values (bsc#1192375).
• ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (bsc#1192473).
• ASoC: cs42l42: Correct some register default values (git-fixes).
• ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER (git-fixes).
• ASoC: cs42l42: Do not set defaults for volatile registers (git-fixes).
• ASoC: dt-bindings: cs42l42: Correct description of ts-inv (git-fixes).
• ASoC: mediatek: mt8195: Remove unsued irqs_lock (git-fixes).
• ASoC: rockchip: Use generic dmaengine code (git-fixes).
• ASoC: SOF: topology: do not power down primary core during topology removal (git-fixes).
• ASoC: topology: Fix stub for snd_soc_tplg_component_remove() (git-fixes).
• ata: sata_mv: Fix the error handling of mv_chip_id() (git-fixes).
• ath10k: fix control-message timeout (git-fixes).
• ath10k: fix division by zero in send path (git-fixes).
• ath10k: fix max antenna gain unit (git-fixes).
• ath10k: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
• ath10k: sdio: Add missing BH locking around napi_schdule() (git-fixes).
• ath6kl: fix control-message timeout (git-fixes).
• ath6kl: fix division by zero in send path (git-fixes).
• ath9k: Fix potential interrupt storm on queue reset (git-fixes).
• auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
• auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes). -…

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

• CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).

• CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read uninitialized memory (bnc#1188563).

• CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value (bnc#1186109 bnc#1186390 bnc#1188876).

• CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).

• CVE-2021-42739: The firewire subsystem in the Linux kernel has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673).

• CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).

• CVE-2018-13405: The inode_init_owner function in fs/inode.c in the Linux kernel allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).

• CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).

• CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack (bnc#1188983).

• CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation did not necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).

• CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel Local attackers able to access the Aspeed LPC control interface could overwrite memory in…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045 ).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: fix general protection fault in azx_runtime_idle (git-fixes).
• ALSA: hda: Free card instance properly at probe errors (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add minimal-mute notion in dB mapping table (bsc#1192375).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Fix dB level of Bose Revolve+ SoundLink (bsc#1192375).
• ALSA: usb-audio: Use int for dB map values (bsc#1192375).
• ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (bsc#1192473).
• auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
• auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes).
• auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (git-fixes).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22573)
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22574)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22573).
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22574).
• bpf: Fix BPF_JIT kconfig symbol dependency (git-fixes jsc#SLE-22574).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• bpf, kconfig: Add consolidated menu entry for bpf with core options (jsc#SLE-22574).
• btrfs: block-group: Rework documentation of check_system_chunk function (bsc#1192896).
• btrfs: fix deadlock between chunk allocation and chunk btree modifications (bsc#1192896).
• btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
• btrfs: update comments for chunk allocation -ENOSPC cases (bsc#1192896).
• cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem (git-fixes).
• config: disable unprivileged BPF by default (jsc#SLE-22573) Backport of mainline commit 8a03e56b253e ('bpf: Disallow unprivileged bpf by default') only changes kconfig default, used e.g. for 'make oldconfig' when the config option is missing, but does not update our kernel configs used for build. Update also these to make sure unprivileged BPF is really disabled by default.
• crypto: caam - disable pkc for non-E SoCs (git-fixes).
• crypto: qat - detect PFVF collision after ACK (git-fixes).
• crypto: qat - disregard spurious PFVF interrupts (git-fixes).
• drm/i915: Introduce intel_hpd_hotplug_irqs() (bsc#1192758).
• drm: prevent spectre issue in vmw_execbuf_ioctl (bsc#1192802).
• EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1152489).
• Eradicate Patch-mainline: No The…

The SUSE Linux Enterprise 15 SP3 kernel for Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: fix general protection fault in azx_runtime_idle (git-fixes).
• ALSA: hda: Free card instance properly at probe errors (git-fixes).
• ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14 (git-fixes).
• ALSA: hda: Reduce udelay() at SKL+ position reporting (git-fixes).
• ALSA: hda: Use position buffer for SKL+ again (git-fixes).
• ALSA: ua101: fix division by zero at probe (git-fixes).
• ALSA: uapi: Fix a C++ style comment in asound.h (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add minimal-mute notion in dB mapping table (bsc#1192375).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Fix dB level of Bose Revolve+ SoundLink (bsc#1192375).
• ALSA: usb-audio: Use int for dB map values (bsc#1192375).
• ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (bsc#1192473).
• ASoC: cs42l42: Correct some register default values (git-fixes).
• ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER (git-fixes).
• ASoC: cs42l42: Do not set defaults for volatile registers (git-fixes).
• ASoC: dt-bindings: cs42l42: Correct description of ts-inv (git-fixes).
• ASoC: mediatek: mt8195: Remove unsued irqs_lock (git-fixes).
• ASoC: rockchip: Use generic dmaengine code (git-fixes).
• ASoC: SOF: topology: do not power down primary core during topology removal (git-fixes).
• ASoC: topology: Fix stub for snd_soc_tplg_component_remove() (git-fixes).
• ata: sata_mv: Fix the error handling of mv_chip_id() (git-fixes).
• ath10k: fix control-message timeout (git-fixes).
• ath10k: fix division by zero in send path (git-fixes).
• ath10k: fix max antenna gain unit (git-fixes).
• ath10k: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
• ath10k: sdio: Add missing BH locking around napi_schdule() (git-fixes).
• ath6kl: fix control-message timeout (git-fixes).
• ath6kl: fix division by zero in send path (git-fixes).
• ath9k: Fix potential interrupt storm on queue reset (git-fixes).
• auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
• auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes). -…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: Reduce udelay() at SKL+ position reporting (git-fixes).
• ALSA: ua101: fix division by zero at probe (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ASoC: cs42l42: Correct some register default values (git-fixes).
• ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER (git-fixes).
• ASoC: cs42l42: Do not set defaults for volatile registers (git-fixes).
• ASoC: dt-bindings: cs42l42: Correct description of ts-inv (git-fixes).
• ASoC: mediatek: mt8195: Remove unsued irqs_lock (git-fixes).
• ASoC: rockchip: Use generic dmaengine code (git-fixes).
• Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync (git-fixes).
• Bluetooth: fix init and cleanup of sco_conn.timeout_work (git-fixes).
• EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1152489).
• Eradicate Patch-mainline: No The pre-commit check can reject this deprecated tag then.
• Fix problem with missing installkernel on Tumbleweed.
• HID: u2fzero: clarify error check and length calculations (git-fixes).
• HID: u2fzero: properly handle timeouts in usb_submit_urb (git-fixes).
• Input: elantench - fix misreporting trackpoint coordinates (bsc#1192918).
• Input: i8042 - Add quirk for Fujitsu Lifebook T725 (bsc#1191980).
• PCI/ACPI: Check for _OSC support in acpi_pci_osc_control_set() (bsc#1169263).
• PCI/ACPI: Clarify message about _OSC failure (bsc#1169263).
• PCI/ACPI: Move _OSC query checks to separate function (bsc#1169263).
• PCI/ACPI: Move supported and control calculations to separate functions (bsc#1169263).
• PCI/ACPI: Remove OSC_PCI_SUPPORT_MASKS and OSC_PCI_CONTROL_MASKS (bsc#1169263).
• PCI/ACPI: Remove unnecessary osc_lock (bsc#1169263).
• PCI: aardvark: Do not clear status bits of masked interrupts (git-fixes).
• PCI: aardvark: Do not spam about PIO Response Status (git-fixes).
• PCI: aardvark: Do not unmask unused interrupts (git-fixes).
• PCI: aardvark: Fix checking for link up via LTSSM state (git-fixes).
• PCI: aardvark: Fix reporting Data Link Layer Link Active (git-fixes).
• PCI: aardvark: Fix return value of…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

• CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).

The following non-security bugs were fixed:

• EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1114648).
• Revert 'ibmvnic: check failover_pending in login response' (bsc#1190523 ltc#194510).
• Revert 'x86/kvm: fix vcpu-id indexed array sizes' (git-fixes).
• USB: iowarrior: fix control-message timeouts (git-fixes).
• USB: serial: keyspan: fix memleak on probe errors (git-fixes).
• arm64/sve: Use correct size when reinitialising SVE state (git-fixes).
• arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions (git-fixes).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• bpf: Move owner type, jited info into array auxiliary data (bsc#1141655).
• bpf: Use kvmalloc for map values in syscall (stable-5.14.16).
• btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
• ceph: take snap_empty_lock atomically with snaprealm refcount change (bsc#1191888).
• config.sh: Build cve/linux-4.12 against SLE15-SP1. SLE15 is no longer updated and we will need recent update to suse-module-tools to continue building the kernel.
• crypto: qat - detect PFVF collision after ACK (git-fixes).
• crypto: qat - disregard spurious PFVF interrupts (git-fixes).
• crypto: s5p-sss - Add error handling in s5p_aes_probe() (git-fixes).
• drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() (git-fixes).
• drm: fix spectre issue in vmw_execbuf_ioctl (bsc#1192802).
• ethernet: dwmac-stm32: Fix copyright (git-fixes).
• ftrace: Fix scripts/recordmcount.pl due to new binutils (bsc#1192267).
• fuse: fix page stealing (bsc#1192718).
• gigaset: fix spectre issue in do_data_b3_req (bsc#1192802).
• hisax: fix spectre issues (bsc#1192802).
• hrtimer: Move copyout of remaining time to do_nanosleep() (bsc#1191713).
• hrtimer_nanosleep(): Pass rmtp in restart_block (bsc#1191713).
• hysdn: fix spectre issue in hycapi_send_message (bsc#1192802).
• i2c: synquacer: fix deferred probing (git-fixes).
• ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
• ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510).
• ibmvnic: delay complete() (bsc#1094840 ltc#167098 git-fixes).
• ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
• infiniband: fix spectre issue in ib_uverbs_write (bsc#1192802).
• ipv4: fix…

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

• CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).

• CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read uninitialized memory (bnc#1188563).

• CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value (bnc#1186109 bnc#1186390 bnc#1188876).

• CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).

• CVE-2021-42739: The firewire subsystem in the Linux kernel has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673).

• CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).

• CVE-2018-13405: The inode_init_owner function in fs/inode.c in the Linux kernel allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).

• CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).

• CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack (bnc#1188983).

• CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation did not necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).

• CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel Local attackers able to access the Aspeed LPC control interface could overwrite memory in…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails. (bsc#1191961)

The following non-security bugs were fixed:

• arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions (git-fixes).
• arm64/sve: Use correct size when reinitialising SVE state (git-fixes).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22913)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22913).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• bpf: Move owner type, jited info into array auxiliary data (bsc#1141655).
• bpf: Use kvmalloc for map values in syscall (stable-5.14.16).
• btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
• config: disable unprivileged BPF by default (jsc#SLE-22913)
• drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() (git-fixes).
• drm: fix spectre issue in vmw_execbuf_ioctl (bsc#1192802).
• EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1114648).
• fuse: fix page stealing (bsc#1192718).
• gigaset: fix spectre issue in do_data_b3_req (bsc#1192802).
• hisax: fix spectre issues (bsc#1192802).
• hysdn: fix spectre issue in hycapi_send_message (bsc#1192802).
• i2c: synquacer: fix deferred probing (git-fixes).
• ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510).
• ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
• ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
• infiniband: fix spectre issue in ib_uverbs_write (bsc#1192802).
• iwlwifi: fix spectre issue in iwl_dbgfs_update_pm (bsc#1192802).
• media: dvb_ca_en50221: prevent using slot_info for Spectre attacs (bsc#1192802).
• media: dvb_ca_en50221: sanity check slot number from userspace (bsc#1192802).
• media: wl128x: get rid of a potential spectre issue (bsc#1192802).
• mm/hugetlb: initialize hugetlb_usage in mm_init (bsc#1192906).
• mpt3sas: fix spectre issues (bsc#1192802).
• net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() (bsc#1192802).
• osst: fix spectre issue in osst_verify_frame (bsc#1192802).
• prctl: allow to setup brk for et_dyn executables (git-fixes).
• printk/console: Allow to disable console output by using console='' or console=null (bsc#1192753).
• printk: handle blank console arguments passed in (bsc#1192753).
• printk: Remove printk.h inclusion in percpu.h (bsc#1192987).
• Revert 'ibmvnic: check failover_pending in login response' (bsc#1190523 ltc#194510).
• Revert 'x86/kvm: fix vcpu-id indexed array sizes' (git-fixes).
• scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() (git-fixes).
• scsi: BusLogic: Fix missing pr_cont() use (git-fixes).
• scsi: core: Fix error handling…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032). Additional spectrev1 fixes were added to the eBPF code.

• CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1087082 bnc#1100416 bnc#1129735).

• CVE-2018-16882: A use-after-free issue was found in the way the KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions and are vulnerable (bnc#1119934).

• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1176724).

• CVE-2020-12655: An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767 (bnc#1171217).

• CVE-2020-14305: An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allowed an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability (bnc#1173346).

• CVE-2020-3702: Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic (bnc#1191193).

• CVE-2021-20265: A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allowed an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability (bnc#1183089).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: Reduce udelay() at SKL+ position reporting (git-fixes).
• ALSA: ua101: fix division by zero at probe (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ASoC: cs42l42: Correct some register default values (git-fixes).
• ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER (git-fixes).
• ASoC: cs42l42: Do not set defaults for volatile registers (git-fixes).
• ASoC: dt-bindings: cs42l42: Correct description of ts-inv (git-fixes).
• ASoC: mediatek: mt8195: Remove unsued irqs_lock (git-fixes).
• ASoC: rockchip: Use generic dmaengine code (git-fixes).
• ata: sata_mv: Fix the error handling of mv_chip_id() (git-fixes).
• ath10k: fix control-message timeout (git-fixes).
• ath10k: fix division by zero in send path (git-fixes).
• ath10k: fix max antenna gain unit (git-fixes).
• ath10k: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
• ath6kl: fix control-message timeout (git-fixes).
• ath6kl: fix division by zero in send path (git-fixes).
• ath9k: Fix potential interrupt storm on queue reset (git-fixes).
• auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
• auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes).
• auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (git-fixes).
• b43: fix a lower bounds test (git-fixes).
• b43legacy: fix a lower bounds test (git-fixes).
• Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync (git-fixes).
• Bluetooth: fix init and cleanup of sco_conn.timeout_work (git-fixes).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22573)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22573).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• btrfs: block-group: Rework documentation of check_system_chunk function (bsc#1192896).
• btrfs: fix deadlock between chunk allocation and chunk btree modifications (bsc#1192896).
• btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
• btrfs: update comments for chunk allocation -ENOSPC cases (bsc#1192896).
• cgroup/cpuset:…

The SUSE Linux Enterprise 12 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2020-12655: An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767 (bnc#1171217).

• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

• CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack (bnc#1188983).

• CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation did not necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).

• CVE-2017-17862: kernel/bpf/verifier.c in the Linux kernel ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service (bnc#1073928).

• CVE-2017-17864: kernel/bpf/verifier.c in the Linux kernel mishandled states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allowed local users to obtain potentially sensitive address information, aka a 'pointer leak (bnc#1073928).

• CVE-2021-20265: A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allowed an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability (bnc#1183089).

• CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).

• CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read uninitialized memory (bnc#1188563).

• CVE-2018-13405: The inode_init_owner function in fs/inode.c in the Linux kernel allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).

• CVE-2021-3760: Fixed a use-after-free…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045 ).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: fix general protection fault in azx_runtime_idle (git-fixes).
• ALSA: hda: Free card instance properly at probe errors (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add minimal-mute notion in dB mapping table (bsc#1192375).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Fix dB level of Bose Revolve+ SoundLink (bsc#1192375).
• ALSA: usb-audio: Use int for dB map values (bsc#1192375).
• ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (bsc#1192473).
• auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
• auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes).
• auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (git-fixes).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22573)
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22574)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22573).
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22574).
• bpf: Fix BPF_JIT kconfig symbol dependency (git-fixes jsc#SLE-22574).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• bpf, kconfig: Add consolidated menu entry for bpf with core options (jsc#SLE-22574).
• btrfs: block-group: Rework documentation of check_system_chunk function (bsc#1192896).
• btrfs: fix deadlock between chunk allocation and chunk btree modifications (bsc#1192896).
• btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
• btrfs: update comments for chunk allocation -ENOSPC cases (bsc#1192896).
• cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem (git-fixes).
• config: disable unprivileged BPF by default (jsc#SLE-22573) Backport of mainline commit 8a03e56b253e ('bpf: Disallow unprivileged bpf by default') only changes kconfig default, used e.g. for 'make oldconfig' when the config option is missing, but does not update our kernel configs used for build. Update also these to make sure unprivileged BPF is really disabled by default.
• crypto: caam - disable pkc for non-E SoCs (git-fixes).
• crypto: qat - detect PFVF collision after ACK (git-fixes).
• crypto: qat - disregard spurious PFVF interrupts (git-fixes).
• drm/i915: Introduce intel_hpd_hotplug_irqs() (bsc#1192758).
• drm: prevent spectre issue in vmw_execbuf_ioctl (bsc#1192802).
• EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1152489).
• Eradicate Patch-mainline: No The…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573) You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2018-3639: Fixed a speculative execution that may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. (bsc#1087082)
• CVE-2021-20320: Fix a bug that allows a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem. (bsc#1190601)
• CVE-2021-0941: Fixed A missing sanity check to the current MTU check that may allow a local attacker with special user privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. (bnc#1192045)
• CVE-2021-31916: Fixed a bound check failure that could allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash, a leak of internal kernel information, or a privilege escalation problem. (bnc#1192781)
• CVE-2021-20322: Fixed a bug that provides to an attacker the ability to quickly scan open UDP ports. (bsc#1191790)
• CVE-2021-3772: Fixed an issue that would allow a blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. (bsc#1190351)
• CVE-2021-34981: Fixed an issue that allows an attacker with a local account to escalate privileges when CAPI (ISDN) hardware connection fails. (bsc#1191961)
• CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
• CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace applications (bnc#1129898).
• CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx() (bnc#1133374).
• CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
• CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program that could have obtain sensitive information from kernel memory (bsc#1188983).
• CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of arbitrary kernel memory (bsc#1188985).
• CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth stack (bsc#1188172).
• CVE-2021-3653: Missing validation of the int_ctl VMCB field and allows a malicious L1 guest to enable AVIC support for the L2 guest. (bsc#1189399).
• CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the kernel to read uninitialized memory (bsc#1188563).
• CVE-2021-3656: Missing validation of the the virt_ext VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

The following security bugs were fixed:

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).
• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).
• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)
• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails. (bsc#1191961)
• CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the kernel to read uninitialized memory (bsc#1188563).
• CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
• CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
• CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bsc#1184673).
• CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
• CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute privileges (bnc#1190479).
• CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
• CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead to root access (bsc#1191315).
• CVE-2021-37159: Fixed use-after-free and a double free inside hso_free_net_device in drivers/net/usb/hso.c when unregister_netdev is called without checking for the NETREG_REGISTERED state (bnc#1188601).
• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3772: Fixed a remote denial of service in the SCTP stack, if the attacker can spoof IP addresses and knows the IP-addresses and port numbers being used (bnc#1190351).
• CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
• CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace applications…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

• CVE-2020-27820: Fixed a use-after-free in nouveau's postclose() handler that could have happened during device or driver removal (bnc#1179599).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: Reduce udelay() at SKL+ position reporting (git-fixes).
• ALSA: ua101: fix division by zero at probe (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ASoC: cs42l42: Correct some register default values (git-fixes).
• ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER (git-fixes).
• ASoC: cs42l42: Do not set defaults for volatile registers (git-fixes).
• ASoC: dt-bindings: cs42l42: Correct description of ts-inv (git-fixes).
• ASoC: mediatek: mt8195: Remove unsued irqs_lock (git-fixes).
• ASoC: rockchip: Use generic dmaengine code (git-fixes).
• ata: sata_mv: Fix the error handling of mv_chip_id() (git-fixes).
• ath10k: fix control-message timeout (git-fixes).
• ath10k: fix division by zero in send path (git-fixes).
• ath10k: fix max antenna gain unit (git-fixes).
• ath10k: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
• ath6kl: fix control-message timeout (git-fixes).
• ath6kl: fix division by zero in send path (git-fixes).
• ath9k: Fix potential interrupt storm on queue reset (git-fixes).
• auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
• auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes).
• auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (git-fixes).
• b43: fix a lower bounds test (git-fixes).
• b43legacy: fix a lower bounds test (git-fixes).
• Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync (git-fixes).
• Bluetooth: fix init and cleanup of sco_conn.timeout_work (git-fixes).
• bnxt_en: reject indirect blk offload when hw-tc-offload is off (jsc#SLE-8372 bsc#1153275).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22573)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22573).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• btrfs: block-group: Rework documentation of check_system_chunk function (bsc#1192896).
• btrfs: do not ignore error…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045 ).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: fix general protection fault in azx_runtime_idle (git-fixes).
• ALSA: hda: Free card instance properly at probe errors (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add minimal-mute notion in dB mapping table (bsc#1192375).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Fix dB level of Bose Revolve+ SoundLink (bsc#1192375).
• ALSA: usb-audio: Use int for dB map values (bsc#1192375).
• ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (bsc#1192473).
• auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
• auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes).
• auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (git-fixes).
• bpf, kconfig: Add consolidated menu entry for bpf with core options (jsc#SLE-22574).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22573)
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22574)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22573).
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22574).
• bpf: Fix BPF_JIT kconfig symbol dependency (git-fixes jsc#SLE-22574).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• btrfs: block-group: Rework documentation of check_system_chunk function (bsc#1192896).
• btrfs: fix deadlock between chunk allocation and chunk btree modifications (bsc#1192896).
• btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
• btrfs: update comments for chunk allocation -ENOSPC cases (bsc#1192896).
• cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem (git-fixes).
• config: disable unprivileged BPF by default (jsc#SLE-22573) Backport of mainline commit 8a03e56b253e ('bpf: Disallow unprivileged bpf by default') only changes kconfig default, used e.g. for 'make oldconfig' when the config option is missing, but does not update our kernel configs used for build. Update also these to make sure unprivileged BPF is really disabled by default.
• crypto: caam - disable pkc for non-E SoCs (git-fixes).
• crypto: qat - detect PFVF collision after ACK (git-fixes).
• crypto: qat - disregard spurious PFVF interrupts (git-fixes).
• drm/i915: Introduce intel_hpd_hotplug_irqs() (bsc#1192758).
• drm: prevent spectre issue in vmw_execbuf_ioctl (bsc#1192802).
• e1000e: Separate TGP board type from SPT (bsc#1192874).
• EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell…

The SUSE Linux Enterprise 12 SP5 Real Time kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails. (bsc#1191961)

The following non-security bugs were fixed:

• arm64/sve: Use correct size when reinitialising SVE state (git-fixes).
• arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions (git-fixes).
• bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22913)
• bpf: Disallow unprivileged bpf by default (jsc#SLE-22913).
• bpf: Fix potential race in tail call compatibility check (git-fixes).
• bpf: Move owner type, jited info into array auxiliary data (bsc#1141655).
• bpf: Use kvmalloc for map values in syscall (stable-5.14.16).
• btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
• cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1190317).
• cifs: for compound requests, use open handle if possible (bsc#1190317).
• cifs: release lock earlier in dequeue_mid error case (bsc#1190317).
• config: disable unprivileged BPF by default (jsc#SLE-22913)
• drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() (git-fixes).
• drm: fix spectre issue in vmw_execbuf_ioctl (bsc#1192802).
• EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1114648).
• elfcore: fix building with clang (bsc#1169514).
• fuse: fix page stealing (bsc#1192718).
• gigaset: fix spectre issue in do_data_b3_req (bsc#1192802).
• hisax: fix spectre issues (bsc#1192802).
• hysdn: fix spectre issue in hycapi_send_message (bsc#1192802).
• i2c: synquacer: fix deferred probing (git-fixes).
• ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510).
• ibmvnic: do not stop queue in xmit (bsc#1192273 ltc#194629).
• ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629).
• infiniband: fix spectre issue in ib_uverbs_write (bsc#1192802).
• iwlwifi: fix spectre issue in iwl_dbgfs_update_pm (bsc#1192802).
• media: dvb_ca_en50221: prevent using slot_info for Spectre attacs (bsc#1192802).
• media: dvb_ca_en50221: sanity check slot number from userspace (bsc#1192802).
• media: wl128x: get rid of a potential spectre issue (bsc#1192802).
• mm/hugetlb: initialize hugetlb_usage in mm_init (bsc#1192906).
• mpt3sas: fix spectre issues (bsc#1192802).
• net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() (bsc#1192802).
• objtool: Support Clang non-section symbols in ORC generation (bsc#1169514).
• osst: fix spectre issue in osst_verify_frame (bsc#1192802).
• prctl: allow to setup brk for et_dyn executables (git-fixes).
• printk/console: Allow to disable console output by using console='' or console=null (bsc#1192753).
• printk: handle blank console arguments passed in (bsc#1192753).
• printk: Remove printk.h…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-13695: Fixed fix acpi operand cache leak in nseval.c (bsc#1055710).
• CVE-2018-7755: Fixed bypass of kernel security protections such as KASLR using fd_locked_ioctl function in drivers/block/floppy.c (bnc#1084513).
• CVE-2019-3837: Fixed memory leak due to thread-unsafe implementation of the net_dma code in tcp_recvmsg() (bnc#1131430).
• CVE-2019-3900: Fixed infinite loop while receiving packets in vhost_net (bnc#1133374).
• CVE-2020-15393: Fixed memory leak in usbtest_disconnect in drivers/usb/misc/usbtest.c (bnc#1173514).
• CVE-2020-16119: Fixed use-after-free exploitable by a local attacker due to reuse of a DCCP socket (bnc#1177471).
• CVE-2020-36557: Fixed race condition in the VT_DISALLOCATE ioctl and closing/opening of ttys which could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition in VT_RESIZEX (bsc#1200910).
• CVE-2021-26341: Fixed vulnerablity where some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bnc#1201050).
• CVE-2021-33655: When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write when setting font with malicous data by ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-34981: Fixed file refcounter in bluetooth cmtp when cmtp_attach_device fails (bsc#1191961).
• CVE-2021-39713: Fixed race condition in the network scheduling subsystem which could lead to a use-after-free (bsc#1196973).
• CVE-2021-45868: Fixed use-after-free in fs/quota/quota_tree.c (bnc#1197366).
• CVE-2022-1011: Fixed UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (bsc#1197343).
• CVE-2022-1048: Fixed potential AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331).
• CVE-2022-1353: Fixed denial of service in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1462: Fixed out-of-bounds read in the TeleTYpe subsystem allowing local user to crash the system or read unauthorized random data from memory (bnc#1198829).
• CVE-2022-1652: Fixed use after free in floppy (bsc#1199063).
• CVE-2022-1679: Fixed use-after-free in the atheros wireless adapter driver (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read in lg_probe and related functions of hid-lg.c and other USB HID files (bnc#1200619).
• CVE-2022-20166: Fixed out of bounds write due to a heap buffer overflow which could lead to local escalation of privilege with System execution privileges needed (bnc#1200598).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bnc#1202346).
• CVE-2022-20369: Fixed out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21166, CVE-2022-21127, CVE-2022-21123, CVE-2022-21125, CVE-2022-21180: Fixed stale MMIO data transient information leaks (INTEL-TA-00615) (bnc#1199650).
• CVE-2022-21385: Fixed warn in rds_message_alloc_sgs (bnc#1202897).
• CVE-2022-21499: Fixed issue where it was trivial to break out of lockdown using kgdb (bsc#1199426).
• CVE-2022-2318: Fixed use-after-free caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges (bnc#1201251).
• CVE-2022-2663: Fixed possible firewall bypass when users are using unencrypted IRC due to message handling confusion in nf_conntrack_irc (bnc#1202097).
• CVE-2022-28356: Fixed refcount leak bug in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-29900: Fixed mis-trained branch predictions for return instructions that may have allowed arbitrary speculative code execution under certain microarchitecture-dependent conditions (bnc#1199657).
• CVE-2022-29901: Fixed vulnerability where an attacker with unprivileged user access can hijack return instructions to…