CVE-2021-3573

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

The Linux Kernel, the operating system core itself.

Security Fix(es):

there was a null pointer dereference in llcp_sock_getname in net/nfc/llcp_sock.c and reproduced it in linux-5.13.0-rc2. An unprivileged user can trigger this bug and cause denial of service. #Root Cause After creating an nfc socket, bind the address by calling bind(), if LLCP_SAP_MAX was used as SAP, it cause the bind() failed and there would set llcp_sock->service_name as NULL. Although bind() returns an error here, it does not affect calling other socket functions. sock_getname() would invoke llcp_sock_getname(), llcp_sock_getname copied service name from llcp_sock->service_name by memcpy but llcp_sock->service_name is NULL. #Fix the patch for this issue: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=4ac06a1e013c(CVE-2021-3587)

An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.(CVE-2020-36385)

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.(CVE-2020-28097)

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.(CVE-2021-33624)

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.(CVE-2021-35039)

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space(CVE-2021-22555)

A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user detaches bluetooth dongle or other way triggers unregister bluetooth device event. A local user could use this flaw to crash the system or escalate their privileges on the system.(CVE-2021-3573)

Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.(CVE-2021-0129)

net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.(CVE-2021-34693)

An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6d816e088c35.(CVE-2020-36387)

A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges.(CVE-2021-3609)

It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.(CVE-2021-3600)

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: out-of-bounds reads in pinctrl subsystem (CVE-2020-0427)
• kernel: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24502)
• kernel: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24503)
• kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24504)
• kernel: Fragmentation cache not cleared on reconnection (CVE-2020-24586)
• kernel: Reassembling fragments encrypted under different keys (CVE-2020-24587)
• kernel: wifi frame payload being parsed incorrectly as an L2 frame (CVE-2020-24588)
• kernel: Forwarding EAPOL from unauthenticated wifi client (CVE-2020-26139)
• kernel: accepting plaintext data frames in protected networks (CVE-2020-26140)
• kernel: not verifying TKIP MIC of fragmented frames (CVE-2020-26141)
• kernel: accepting fragmented plaintext frames in protected networks (CVE-2020-26143)
• kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header (CVE-2020-26144)
• kernel: accepting plaintext broadcast fragments as full frames (CVE-2020-26145)
• kernel: powerpc: RTAS calls can be used to compromise kernel integrity (CVE-2020-27777)
• kernel: locking inconsistency in tty_io.c and tty_jobctrl.c can lead to a read-after-free (CVE-2020-29660)
• kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function via a long SSID value (CVE-2020-36158)
• kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt() (CVE-2020-36386)
• kernel: Improper access control in BlueZ may allow information disclosure vulnerability. (CVE-2021-0129)
• kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c (CVE-2021-3348)
• kernel: Linux kernel eBPF RINGBUF map oversized allocation (CVE-2021-3489)
• kernel: double free in bluetooth subsystem when the HCI device initialization fails (CVE-2021-3564)
• kernel: use-after-free in function hci_sock_bound_ioctl() (CVE-2021-3573)
• kernel: eBPF 32-bit source register truncation on div/mod (CVE-2021-3600)
• kernel: DoS in rb_per_cpu_empty() (CVE-2021-3679)
• kernel: Mounting overlayfs inside an unprivileged user namespace can reveal files (CVE-2021-3732)
• kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt() (CVE-2021-20194)
• kernel: Race condition in sctp_destroy_sock list_del (CVE-2021-23133)
• kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode (CVE-2021-28950)
• kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c (CVE-2021-28971)
• kernel: protection can be bypassed to leak content of kernel memory (CVE-2021-29155)
• kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c (CVE-2021-29646)
• kernel: lack a full memory barrier may lead to DoS (CVE-2021-29650)
• kernel: local escalation of privileges in handling of eBPF programs (CVE-2021-31440)
• kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak content of kernel memory (CVE-2021-31829)
• kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations by BPF verifier (CVE-2021-33200)
• kernel: reassembling encrypted fragments with non-consecutive packet numbers (CVE-2020-26146)
• kernel: reassembling mixed encrypted/plaintext fragments (CVE-2020-26147)
• kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check (CVE-2020-29368)
• kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50 (CVE-2021-3635)
• kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)
• kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure (CVE-2021-20239)
• kernel: out of bounds array access in drivers/md/dm-ioctl.c (CVE-2021-31916)

• ELSCVE-666: CVE-2021-34693: can: bcm: fix infoleak in struct bcm_msg_head
• ELSCVE-705: CVE-2021-38160: virtio_console: Assure used length from device is limited
• ELSCVE-769: CVE-2014-4508: x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
• ELSCVE-844: CVE-2021-3573: Bluetooth: use correct lock to prevent UAF of hdev object
• ELSCVE-503: CVE-2021-32399: bluetooth: eliminate the potential race condition when removing the HCI controller
• ELSCVE-451: CVE-2021-37159: hso: fix a use after free condition
• ELSCVE-387: CVE-2021-38205: net: xilinx_emaclite: Do not print real IOMEM pointer
• ELSCVE-547: CVE-2021-3178: nfsd4: readdirplus shouldn't return parent of export
• ELSCVE-547: nfsd: fix compose_entry_fh() failure exits
• ELSCVE-547: nfsd: make local functions static
• ELSCVE-682: CVE-2021-20265: af_unix: fix struct pid memory leak
• ELSCVE-531: CVE-2021-20292: drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
• ELSCVE-543: CVE-2021-28972: PCI: rpadlpar: Fix potential drc_name corruption in store functions
• ELSCVE-575: CVE-2021-3612: Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
• ELSCVE-575: Input: joydev - prevent potential read overflow in ioctl
• ELSCVE-575: Input: joydev - fix possible ERR_PTR() dereferencing
• ELSCVE-575: Input: joydev - use memdup_user() to duplicate memory from user-space

• ELSCVE-666: CVE-2021-34693: can: bcm: fix infoleak in struct bcm_msg_head
• ELSCVE-705: CVE-2021-38160: virtio_console: Assure used length from device is limited
• ELSCVE-769: CVE-2014-4508: x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
• ELSCVE-844: CVE-2021-3573: Bluetooth: use correct lock to prevent UAF of hdev object
• ELSCVE-503: CVE-2021-32399: bluetooth: eliminate the potential race condition when removing the HCI controller
• ELSCVE-451: CVE-2021-37159: hso: fix a use after free condition
• ELSCVE-387: CVE-2021-38205: net: xilinx_emaclite: Do not print real IOMEM pointer
• ELSCVE-547: CVE-2021-3178: nfsd4: readdirplus shouldn't return parent of export
• ELSCVE-547: nfsd: fix compose_entry_fh() failure exits
• ELSCVE-547: nfsd: make local functions static
• ELSCVE-682: CVE-2021-20265: af_unix: fix struct pid memory leak
• ELSCVE-531: CVE-2021-20292: drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
• ELSCVE-543: CVE-2021-28972: PCI: rpadlpar: Fix potential drc_name corruption in store functions
• ELSCVE-575: CVE-2021-3612: Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
• ELSCVE-575: Input: joydev - prevent potential read overflow in ioctl
• ELSCVE-575: Input: joydev - fix possible ERR_PTR() dereferencing
• ELSCVE-575: Input: joydev - use memdup_user() to duplicate memory from user-space

• CVE-2021-38198

  • ELSCVE-686: KVM: MMU: return page fault error code from permission_fault
  • ELSCVE-686: kvm: x86: MMU support for EPT accessed/dirty bits
  • ELSCVE-686: KVM: nVMX: fix EPT permissions as reported in exit qualification
  • ELSCVE-686: KVM: X86: MMU: Use the correct inherited permissions to get shadow page

• CVE-2021-3655

  • ELSCVE-715: sctp: add size validation when walking chunks
  • ELSCVE-715: sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
  • ELSCVE-715: sctp: validate chunk size in __rcv_asconf_lookup
  • ELSCVE-715: sctp: validate from_addr_param return
  • ELSCVE-715: sctp: fix return value check in __sctp_rcv_asconf_lookup

• CVE-2021-3428

  • ELSCVE-1704: ext4: don't allow overlapping system zones
  • ELSCVE-1704: ext4: check journal inode extents more carefully

• CVE-2021-38205

  • ELSCVE-389: net: xilinx_emaclite: Do not print real IOMEM pointer

• CVE-2021-28688

  • ELSCVE-670: xen-blkback: don't leak persistent grants from xen_blkbk_map()

• CVE-2021-34693

  • ELSCVE-668: can: bcm: fix infoleak in struct bcm_msg_head

• CVE-2020-25673

  • ELSCVE-819: nfc: Avoid endless loops caused by repeated llcp_sock_connect()

• CVE-2021-23134

  • ELSCVE-620: net/nfc: fix use-after-free llcp_sock_bind/connect

• CVE-2021-3573

  • ELSCVE-846: Bluetooth: use correct lock to prevent UAF of hdev object

• CVE-2021-38204

  • ELSCVE-457: usb: max-3421: Prevent corruption of freed memory

• CVE-2021-42008

  • ELSCVE-1730: net: 6pack: fix slab-out-of-bounds in decode_data

• CVE-2020-36385

  • ELSCVE-1181: RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy

This kernel update is based on upstream 5.10.43 and fixes at least the following security issues:

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data (CVE-2020-24586).

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed (CVE-2020-24587).

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets (CVE-2020-24588).

An issue was discovered in the kernel. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients (CVE-2020-26139).

An issue was discovered in the kernel ath10k driver. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol (CVE-2020-26141).

An issue was discovered in the kernel ath10k driver. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration (CVE-2020-26145).

An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/ or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used (CVE-2020-26147).

A use after free vulnerability has been found in the hci_sock_bound_ioctl() function of the Linux kernel. It can allow attackers to corrupt kernel heaps (kmalloc-8k to be specific) and adopt further exploitations (CVE-2021-3573).

There is a guest triggered use-after-free in Linux xen-netback. A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer. A malicious or buggy frontend driver can trigger a dom0 crash. Privilege escalation and information leaks cannot be ruled out. (CVE-2021-28691 / XSA-374).

There is a null pointer dereference in llcp_sock_getname in net/nfc/ llcp_sock.c of the Linux kernel. An unprivileged user can trigger this bug and cause denial of service (CVE-2021-38208).

Other fixes in this update:

• bpf: Forbid trampoline attach for functions with variable arguments
• bpf: Add deny list of btf ids check for tracing programs -…

This kernel-linus update is based on upstream 5.10.43 and fixes at least the following security issues:

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data (CVE-2020-24586).

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed (CVE-2020-24587).

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets (CVE-2020-24588).

An issue was discovered in the kernel. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients (CVE-2020-26139).

An issue was discovered in the kernel ath10k driver. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol (CVE-2020-26141).

An issue was discovered in the kernel ath10k driver. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration (CVE-2020-26145).

An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/ or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used (CVE-2020-26147).

A double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system (CVE-2021-3564).

A use after free vulnerability has been found in the hci_sock_bound_ioctl() function of the Linux kernel. It can allow attackers to corrupt kernel heaps (kmalloc-8k to be specific) and adopt further exploitations (CVE-2021-3573).

There is a guest triggered use-after-free in Linux xen-netback. A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer. A malicious or buggy frontend driver can trigger a dom0 crash. Privilege escalation and information leaks cannot be ruled out. (CVE-2021-28691 / XSA-374).

There is a null pointer dereference in llcp_sock_getname in net/nfc/ llcp_sock.c of the Linux kernel. An unprivileged…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)

The following non-security bugs were fixed:

• 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• asm-generic/hyperv: Add missing function prototypes per -W1 warnings (bsc#1186071).
• ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
• bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• clocksource/drivers/hyper-v: Handle sched_clock differences inline (bsc#1186071).
• clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts (bsc#1186071).
• clocksource/drivers/hyper-v: Set clocksource rating based on Hyper-V feature (bsc#1186071).
• cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
• cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
• cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
• cxgb4: fix wrong shift (git-fixes).
• cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
• dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
• dax: Add an enum for specifying dax wakup mode (bsc#1187411).
• dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
• dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
• dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
• dmaengine: fsl-dpaa2-qdma: Fix error return code in two…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)

The following non-security bugs were fixed:

• 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
• bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
• cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
• cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
• cxgb4: fix wrong shift (git-fixes).
• cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
• dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
• dax: Add an enum for specifying dax wakup mode (bsc#1187411).
• dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
• dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
• dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
• dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions (git-fixes).
• dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc (git-fixes).
• dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM (git-fixes).
• dmaengine: stedma40: add missing iounmap() on error in d40_probe() (git-fixes).
• drm: Fix use-after-free read in drm_getunique() (git-fixes).
• drm: Lock pointer access in…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)

The following non-security bugs were fixed:

• 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• asm-generic/hyperv: Add missing function prototypes per -W1 warnings (bsc#1186071).
• ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
• bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• clocksource/drivers/hyper-v: Handle sched_clock differences inline (bsc#1186071).
• clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts (bsc#1186071).
• clocksource/drivers/hyper-v: Set clocksource rating based on Hyper-V feature (bsc#1186071).
• cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
• cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
• cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
• cxgb4: fix wrong shift (git-fixes).
• cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
• dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
• dax: Add an enum for specifying dax wakup mode (bsc#1187411).
• dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
• dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
• dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
• dmaengine: fsl-dpaa2-qdma: Fix error return code in two…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling ioremap…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)

The following non-security bugs were fixed:

• 0001-x86-sched-Treat-Intel-SNC-topology-as-default-COD-as.patch: (bsc#1187263).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• ASoC: fsl-asoc-card: Set .owner attribute when registering card (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• block: Discard page cache of zone reset target range (bsc#1187402).
• Bluetooth: Add a new USB ID for RTL8822CE (git-fixes).
• Bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1177028).
• bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• cxgb4: fix endianness when flashing boot image (jsc#SLE-15131).
• cxgb4: fix sleep in atomic when flashing PHY firmware (jsc#SLE-15131).
• cxgb4: fix wrong ethtool n-tuple rule lookup (jsc#SLE-15131).
• cxgb4: fix wrong shift (git-fixes).
• cxgb4: halt chip before flashing PHY firmware image (jsc#SLE-15131).
• dax: Add a wakeup mode parameter to put_unlocked_entry() (bsc#1187411).
• dax: Add an enum for specifying dax wakup mode (bsc#1187411).
• dax: fix ENOMEM handling in grab_mapping_entry() (bsc#1184212).
• dax: Wake up all waiters after invalidating dax entry (bsc#1187411).
• dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM (git-fixes).
• dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions (git-fixes).
• dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc (git-fixes).
• dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM (git-fixes).
• dmaengine: stedma40: add missing iounmap() on error in d40_probe() (git-fixes).
• drm: Fix use-after-free read in drm_getunique() (git-fixes).
• drm: Lock pointer access in…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3573: Fixed an UAF vulnerability in function that can allow attackers to corrupt kernel heaps and adopt further exploitations. (bsc#1186666)
• CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601)
• CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595)
• CVE-2021-33624: Fixed a bug which allows unprivileged BPF program to leak the contents of arbitrary kernel memory (and therefore, of all physical memory) via a side-channel. (bsc#1187554)
• CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452)
• CVE-2021-0129: Fixed improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access (bnc#1186463).
• CVE-2020-36385: Fixed a use-after-free via the ctx_list in some ucma_migrate_id situations where ucma_close is called (bnc#1187050).
• CVE-2020-26558: Fixed Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 (bnc#1179610, bnc#1186463).
• CVE-2020-36386: Fixed an out-of-bounds read issue in hci_extended_inquiry_result_evt (bnc#1187038).

The following non-security bugs were fixed:

• acpica: Clean up context mutex during object deletion (git-fixes).
• alsa: hda/cirrus: Set Initial DMIC volume to -26 dB (git-fixes).
• alsa: hda: Fix for mute key LED for HP Pavilion 15-CK0xx (git-fixes).
• alsa: timer: Fix master timer notification (git-fixes).
• alx: Fix an error handling path in 'alx_probe()' (git-fixes).
• arch: Add arch-dependent support markers in supported.conf (bsc#1186672)
• arch: Add the support for kernel-FLAVOR-optional subpackage (jsc#SLE-11796)
• ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet (git-fixes).
• ASoC: max98088: fix ni clock divider calculation (git-fixes).
• ASoC: rt5659: Fix the lost powers for the HDA header (git-fixes).
• ASoC: sti-sas: add missing MODULE_DEVICE_TABLE (git-fixes).
• ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() (git-fixes).
• batman-adv: Avoid WARN_ON timing related checks (git-fixes).
• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• blk-settings: align max_sectors on 'logical_block_size' boundary (bsc#1185195).
• block: Discard page cache of zone reset target range (bsc#1187402).
• block: return the correct bvec when checking for gaps (bsc#1187143).
• block: return the correct bvec when checking for gaps (bsc#1187144).
• bluetooth: fix the erroneous flush_work() order (git-fixes).
• bluetooth: use correct lock to prevent UAF of hdev object (git-fixes).
• bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Fix TQM fastpath ring backing store computation (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Rediscover PHY capabilities after firmware reset (jsc#SLE-8371 bsc#1153274).
• bpfilter: Specify the log level for the kmsg message (bsc#1155518).
• brcmfmac: properly check for bus register errors (git-fixes).
• btrfs: open device without device_list_mutex (bsc#1176771).
• bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act (git-fixes).
• can: mcba_usb: fix memory leak in mcba_usb (git-fixes).
• ceph: must hold snap_rwsem when filling inode for async create (bsc#1187927).
• cfg80211: avoid double free of PMSR request (git-fixes).
• cfg80211: make certificate generation more robust (git-fixes).
• cgroup1: do not allow '\n' in renaming (bsc#1187972).
• char: hpet: add checks after calling…

This update for the Linux Kernel 5.3.18-57 fixes several issues.

The following security issues were fixed:

• CVE-2021-31440: Fixed a lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. (bsc#1190127).
• CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190118)
• CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local privilege escalation. (bsc#1188613)
• CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to local privilege escalation. (bsc#1187054).

This update for the Linux Kernel 5.3.18-59_19 fixes several issues.

The following security issues were fixed:

• CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local privilege escalation. (bsc#1188613)
• CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to local privilege escalation. (bsc#1187054).

This update for the Linux Kernel 4.12.14-150_72 fixes several issues.

The following security issues were fixed:

• CVE-2021-3715: Fixed a user-after-free in the Linux kernel's Traffic Control networking subsystem which could lead to local privilege escalation. (bsc#1190350).
• CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190118)
• CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local privilege escalation. (bsc#1188613)
• CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to local privilege escalation. (bsc#1187054).

This update for the Linux Kernel 5.3.18-59_5 fixes several issues.

The following security issues were fixed:

• CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190118)
• CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local privilege escalation. (bsc#1188613)
• CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to local privilege escalation. (bsc#1187054).

This update for the Linux Kernel 4.12.14-150_69 fixes several issues.

The following security issues were fixed:

• CVE-2021-3715: Fixed a user-after-free in the Linux kernel's Traffic Control networking subsystem which could lead to local privilege escalation. (bsc#1190350).
• CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190118)
• CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local privilege escalation. (bsc#1188613)
• CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to local privilege escalation. (bsc#1187054).

This update for the Linux Kernel 4.12.14-150_66 fixes several issues.

The following security issues were fixed:

• CVE-2021-3715: Fixed a user-after-free in the Linux kernel's Traffic Control networking subsystem which could lead to local privilege escalation. (bsc#1190350).
• CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190118)
• CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local privilege escalation. (bsc#1188613)
• CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to local privilege escalation. (bsc#1187054).

This update for the Linux Kernel 5.3.18-24_52 fixes several issues.

The following security issues were fixed:

• CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190118)
• CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local privilege escalation. (bsc#1188613)
• CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to local privilege escalation. (bsc#1187054).

This update for the Linux Kernel 4.4.180-94_141 fixes several issues.

The following security issues were fixed:

• CVE-2021-3715: Fixed a user-after-free in the Linux kernel's Traffic Control networking subsystem which could lead to local privilege escalation. (bsc#1190350).
• CVE-2021-38160: Fixed a bug that could lead to a data corruption or loss. This can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190118)
• CVE-2021-3640: Fixed a user-after-free bug in the function sco_sock_sendmsg which could lead to local privilege escalation. (bsc#1188613)
• CVE-2021-3573: Fixed a user-after-free bug in the function hci_sock_bound_ioctl which could lead to local privilege escalation. (bsc#1187054).

It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to signed integer conversion error. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-33909)

Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3564)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3573)

It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service. (CVE-2021-3587)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3564)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3573)

It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service. (CVE-2021-3587)

Norbert Slusarek discovered that the CAN broadcast manger (bcm) protocol implementation in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2021-34693)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3564)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3573)

It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service. (CVE-2021-3587)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access control. An authenticated attacker could possibly use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)

Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3564)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3573)

It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service. (CVE-2021-3587)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access control. An authenticated attacker could possibly use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)

Michael Brown discovered that the Xen netback driver in the Linux kernel did not properly handle malformed packets from a network PV frontend, leading to a use-after-free vulnerability. An attacker in a guest VM could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-28691)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device initialization failure, leading to a double-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3564)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle HCI device detach events, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-3573)

It was discovered that the NFC implementation in the Linux kernel did not properly handle failed connect events leading to a NULL pointer dereference. A local attacker could use this to cause a denial of service. (CVE-2021-38208)

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. (CVE-2022-0492)

It was discovered that the aufs file system in the Linux kernel did not properly restrict mount namespaces, when mounted with the non-default allow_userns option set. A local attacker could use this to gain administrative privileges. (CVE-2016-2853)

It was discovered that the aufs file system in the Linux kernel did not properly maintain POSIX ACL xattr data, when mounted with the non-default allow_userns option. A local attacker could possibly use this to gain elevated privileges. (CVE-2016-2854)

It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use this to construct a malicious f2fs image that, when mounted and operated on, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-19449)

It was discovered that the XFS file system implementation in the Linux kernel did not properly validate meta data in some circumstances. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service. (CVE-2020-12655)

Kiyin (尹亮) discovered that the NFC LLCP protocol implementation in the Linux kernel contained a reference counting error. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-25670)

Kiyin (尹亮) discovered that the NFC LLCP protocol implementation in the Linux kernel did not properly deallocate memory in certain error situations. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2020-25671, CVE-2020-25672)

Kiyin (尹亮) discovered that the NFC LLCP protocol implementation in the Linux kernel did not properly handle error conditions in some situations, leading to an infinite loop. A local attacker could use this to cause a denial of service. (CVE-2020-25673)

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation incorrectly handled EAPOL frames from unauthenticated senders. A physically proximate attacker could inject malicious packets to cause a denial of service (system crash). (CVE-2020-26139)

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation could reassemble mixed encrypted and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets or exfiltrate selected fragments. (CVE-2020-26147)

It was discovered that the BR/EDR pin-code pairing procedure in the Linux kernel was vulnerable to an impersonation attack. A physically proximate attacker could possibly use this to pair to a device without knowledge of the pin-code. (CVE-2020-26555)

It was discovered that the bluetooth subsystem in the Linux kernel did not properly perform access control. An authenticated attacker could possibly use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)

It was discovered that the FUSE user space file system implementation in the Linux kernel did not properly handle bad inodes in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2020-36322)

It was discovered that the Infiniband RDMA userspace connection manager implementation in the Linux kernel contained a race condition leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possible execute arbitrary code. (CVE-2020-36385)

It was discovered that the DRM subsystem in the Linux kernel contained double-free vulnerabilities. A privileged attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-20292)

It was discovered that a race condition existed in the timer implementation in the Linux kernel. A privileged attacker could use…