CVE-2021-3764

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This kernel update is based on upstream 5.10.75 and fixes at least the following security issues:

A memory leak in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ ccp/ccp-ops.c in the Linux kernel allows malicious users to cause a denial of service (memory consumption) (CVE-2021-3744).

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an malicious user to cause a denial of service (CVE-2021-3764).

A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system (CVE-2021-20321).

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel through 5.14.9 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write (CVE-2021-41864).

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.10.75 and fixes at least the following security issues:

A memory leak in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ ccp/ccp-ops.c in the Linux kernel allows malicious users to cause a denial of service (memory consumption) (CVE-2021-3744).

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an malicious user to cause a denial of service (CVE-2021-3764).

A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system (CVE-2021-20321).

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel through 5.14.9 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write (CVE-2021-41864).

For other upstream fixes, see the referenced changelogs.

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-3702: Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic (bnc#1191193).
• CVE-2021-3669: Fixed a denial of service to replace costly bailout check in sysvipc_find_ipc() (bsc#1159886 bsc#1188986).
• CVE-2021-3752: Fixed a use-after-free uaf bug in bluetooth (bsc#1190023).
• CVE-2021-40490: A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel (bnc#1190159)
• CVE-2021-3744, CVE-2021-3764: Fixed some resource leaks in the ccp driver ccp_run_aes_gcm_cmd() (bsc#1189884 bsc#1190534).

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cuse: fix broken release (bsc#1190596).
• cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• devlink: Break parameter notification sequence to be before/after unload/load driver (bsc#1154353).
• dmaengine: ioat: depends on !UML (git-fixes).
• dmaengine: sprd: Add missing MODULE_DEVICE_TABLE (git-fixes).
• dmaengine: xilinx_dma: Set DMA mask for coherent APIs (git-fixes).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps (git-fixes).
• drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex (git-fixes).
• drm/amd/display: Fix timer_per_pixel unit error (git-fixes).
• drm/amdgpu: Fix BUG_ON assert (git-fixes).
• drm: avoid blocking in drm_clients_info's rcu section (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (git-fixes).
• drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV (git-fixes).
• drm/panfrost: Clamp lock region to Bifrost minimum (git-fixes).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• e1000e: Fix the max snoop/no-snoop latency for 10M (git-fixes).
• EDAC/i10nm: Fix NVDIMM detection (bsc#1152489).
• EDAC/synopsys: Fix wrong…

The SUSE Linux Enterprise 15 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cuse: fix broken release (bsc#1190596).
• cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• devlink: Break parameter notification sequence to be before/after unload/load driver (bsc#1154353).
• dmaengine: ioat: depends on !UML (git-fixes).
• dmaengine: sprd: Add missing MODULE_DEVICE_TABLE (git-fixes).
• dmaengine: xilinx_dma: Set DMA mask for coherent APIs (git-fixes).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps (git-fixes).
• drm: avoid blocking in drm_clients_info's rcu section (git-fixes).
• drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex (git-fixes).
• drm/amd/display: Fix timer_per_pixel unit error (git-fixes).
• drm/amdgpu: Fix BUG_ON assert (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (git-fixes).
• drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV (git-fixes).
• drm/panfrost: Clamp lock region to Bifrost minimum (git-fixes).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• e1000e: Fix the max…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: Intel: Fix platform ID matching (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: rt5682: Implement remove callback (git-fixes).
• ASoC: rt5682: Properly turn off regulators if wrong device ID (git-fixes).
• ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• backlight: pwm_bl: Improve bootloader/kernel device handover (git-fixes).
• bareudp: Fix invalid read beyond skb's linear data (jsc#SLE-15172).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Fix asic.rev in devlink dev info command (jsc#SLE-16649).
• bnxt_en: fix stored FW_PSID version masks (jsc#SLE-16649).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring (git-fixes).
• bpf: Fix ringbuf helper function compatibility (git-fixes).
• bpftool: Add sock_release help info for cgroup attach/prog load command (bsc#1177028).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (bsc#1185550 ltc#192610 git-fixes jsc#SLE-18128).
• cuse: fix broken release (bsc#1190596).
• cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
• debugfs:…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)
• CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks (bsc#1190115).

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: Intel: Fix platform ID matching (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: rt5682: Implement remove callback (git-fixes).
• ASoC: rt5682: Properly turn off regulators if wrong device ID (git-fixes).
• ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• backlight: pwm_bl: Improve bootloader/kernel device handover (git-fixes).
• bareudp: Fix invalid read beyond skb's linear data (jsc#SLE-15172).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Fix asic.rev in devlink dev info command (jsc#SLE-16649).
• bnxt_en: fix stored FW_PSID version masks (jsc#SLE-16649).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring (git-fixes).
• bpf: Fix ringbuf helper function compatibility (git-fixes).
• bpftool: Add sock_release help info for cgroup attach/prog load command (bsc#1177028).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (bsc#1185550 ltc#192610 git-fixes…

The SUSE Linux Enterprise 15 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cuse: fix broken release (bsc#1190596).
• cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• devlink: Break parameter notification sequence to be before/after unload/load driver (bsc#1154353).
• dmaengine: ioat: depends on !UML (git-fixes).
• dmaengine: sprd: Add missing MODULE_DEVICE_TABLE (git-fixes).
• dmaengine: xilinx_dma: Set DMA mask for coherent APIs (git-fixes).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps (git-fixes).
• drm: avoid blocking in drm_clients_info's rcu section (git-fixes).
• drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex (git-fixes).
• drm/amd/display: Fix timer_per_pixel unit error (git-fixes).
• drm/amdgpu: Fix BUG_ON assert (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (git-fixes).
• drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV (git-fixes).
• drm/panfrost: Clamp lock region to Bifrost minimum (git-fixes).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• e1000e: Fix the max…

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

• CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).

• CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read uninitialized memory (bnc#1188563).

• CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value (bnc#1186109 bnc#1186390 bnc#1188876).

• CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).

• CVE-2021-42739: The firewire subsystem in the Linux kernel has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673).

• CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).

• CVE-2018-13405: The inode_init_owner function in fs/inode.c in the Linux kernel allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).

• CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).

• CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack (bnc#1188983).

• CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation did not necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).

• CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel Local attackers able to access the Aspeed LPC control interface could overwrite memory in…

The SUSE Linux Enterprise 15 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• backlight: pwm_bl: Improve bootloader/kernel device handover (git-fixes).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cuse: fix broken release (bsc#1190596).
• cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• devlink: Break parameter notification sequence to be before/after unload/load driver (bsc#1154353).
• dmaengine: ioat: depends on !UML (git-fixes).
• dmaengine: sprd: Add missing MODULE_DEVICE_TABLE (git-fixes).
• dmaengine: xilinx_dma: Set DMA mask for coherent APIs (git-fixes).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps (git-fixes).
• drm: avoid blocking in drm_clients_info's rcu section (git-fixes).
• drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex (git-fixes).
• drm/amd/display: Fix timer_per_pixel unit error (git-fixes).
• drm/amdgpu: Fix BUG_ON assert (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (git-fixes).
• drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV (git-fixes).
• drm/panfrost: Clamp lock region to Bifrost minimum (git-fixes).
• e1000e: Do not take care…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: Intel: Fix platform ID matching (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: rt5682: Implement remove callback (git-fixes).
• ASoC: rt5682: Properly turn off regulators if wrong device ID (git-fixes).
• ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• backlight: pwm_bl: Improve bootloader/kernel device handover (git-fixes).
• bareudp: Fix invalid read beyond skb's linear data (jsc#SLE-15172).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Fix asic.rev in devlink dev info command (jsc#SLE-16649).
• bnxt_en: fix stored FW_PSID version masks (jsc#SLE-16649).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring (git-fixes).
• bpf: Fix ringbuf helper function compatibility (git-fixes).
• bpftool: Add sock_release help info for cgroup attach/prog load command (bsc#1177028).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (bsc#1185550 ltc#192610 git-fixes jsc#SLE-18128).
• cuse: fix broken release (bsc#1190596).
• cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
• debugfs:…

The SUSE Linux Enterprise 15 SP2 kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• backlight: pwm_bl: Improve bootloader/kernel device handover (git-fixes).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cuse: fix broken release (bsc#1190596).
• cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• devlink: Break parameter notification sequence to be before/after unload/load driver (bsc#1154353).
• dmaengine: ioat: depends on !UML (git-fixes).
• dmaengine: sprd: Add missing MODULE_DEVICE_TABLE (git-fixes).
• dmaengine: xilinx_dma: Set DMA mask for coherent APIs (git-fixes).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps (git-fixes).
• drm: avoid blocking in drm_clients_info's rcu section (git-fixes).
• drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex (git-fixes).
• drm/amd/display: Fix timer_per_pixel unit error (git-fixes).
• drm/amdgpu: Fix BUG_ON assert (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (git-fixes).
• drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV (git-fixes).
• drm/panfrost: Clamp lock region to…

The SUSE Linux Enterprise 12 SP56 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)

The following non-security bugs were fixed:

• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt: Add missing DMA memory barriers (git-fixes).
• bnxt: do not disable an already disabled PCI device (git-fixes).
• bnxt: disable napi before canceling DIM (bsc#1104745 ).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: kirkwood: Fix a clocking boot regression (git-fixes).
• crypto: x86/aes-ni-xts - use direct calls to and 4-way stride (bsc#1114648).
• cxgb4: fix IRQ free race during driver unload (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (bsc#1129770) Backporting changes: * refresh
• drm/imx: ipuv3-plane: Remove two unnecessary export symbols (bsc#1129770) Backporting changes: * refreshed
• drm/mediatek: Add AAL output size configuration (bsc#1129770) Backporting changes: * adapted code to use writel() function
• drm/msm: Small msm_gem_purge() fix (bsc#1129770) Backporting changes: * context changes in msm_gem_purge() * remove test for non-existant msm_gem_is_locked()
• drm/msm/dsi: Fix some reference counted resource leaks (bsc#1129770)
• drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() (bsc#1186785).
• drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 (bsc#1129770) Backporting changes * context changes
• dt-bindings: pwm: stm32: Add #pwm-cells (git-fixes).
• e1000e: Do not take care about recovery NVM checksum (bsc#1158533).
• e1000e: Fix an error handling path in 'e1000_probe()' (git-fixes).
• e1000e: Fix the max snoop/no-snoop latency for 10M (git-fixes).
• EDAC/i10nm: Fix NVDIMM detection (bsc#1114648).
• fbmem: add margin check to fb_check_caps() (bsc#1129770) Backporting changes: * context chacnges in fb_set_var()
• fm10k: Fix an error handling path in 'fm10k_probe()' (git-fixes).
• fs/select: avoid clang stack usage warning (git-fixes).
• fuse: truncate pagecache on atomic_o_trunc (bsc#1191051).
• gve: fix the wrong AdminQ buffer overflow check (bsc#1176940).
• hv_netvsc: Make netvsc/VF binding check both MAC and serial number (jsc#SLE-18779, bsc#1185727).
• hv: mana: adjust mana_select_queue to old API (jsc#SLE-18779, bsc#1185727).
• hv: mana: remove netdev_lockdep_set_classes usage (jsc#SLE-18779, bsc#1185727).
• i40e: Add additional info to PHY type error (git-fixes).
• i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
• i40e: Fix error handling in i40e_vsi_open (git-fixes).
• i40e: Fix log TC creation failure when max num of queues is exceeded (bsc#1109837 bsc#1111981).
• i40e: Fix logic of disabling queues (git-fixes).
• iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
• iavf: Set RSS LUT and key in reset handle path (git-fixes).
• ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510).
• ice: Prevent probing virtual functions (bsc#1118661 ). -…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)
• CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks (bsc#1190115).

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: Intel: Fix platform ID matching (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: rt5682: Implement remove callback (git-fixes).
• ASoC: rt5682: Properly turn off regulators if wrong device ID (git-fixes).
• ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• backlight: pwm_bl: Improve bootloader/kernel device handover (git-fixes).
• bareudp: Fix invalid read beyond skb's linear data (jsc#SLE-15172).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Fix asic.rev in devlink dev info command (jsc#SLE-16649).
• bnxt_en: fix stored FW_PSID version masks (jsc#SLE-16649).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring (git-fixes).
• bpf: Fix ringbuf helper function compatibility (git-fixes).
• bpftool: Add sock_release help info for cgroup attach/prog load command (bsc#1177028).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (bsc#1185550 ltc#192610 git-fixes…

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)

The following non-security bugs were fixed:

• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: do not disable an already disabled PCI device (git-fixes).
• bnxt: disable napi before canceling DIM (bsc#1104745 ).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: kirkwood: Fix a clocking boot regression (git-fixes).
• crypto: x86/aes-ni-xts - use direct calls to and 4-way stride (bsc#1114648).
• cxgb4: fix IRQ free race during driver unload (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (bsc#1129770) Backporting changes: * refresh
• drm/imx: ipuv3-plane: Remove two unnecessary export symbols (bsc#1129770) Backporting changes: * refreshed
• drm/mediatek: Add AAL output size configuration (bsc#1129770) Backporting changes: * adapted code to use writel() function
• drm/msm: Small msm_gem_purge() fix (bsc#1129770) Backporting changes: * context changes in msm_gem_purge() * remove test for non-existant msm_gem_is_locked()
• drm/msm/dsi: Fix some reference counted resource leaks (bsc#1129770)
• drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() (bsc#1186785).
• drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 (bsc#1129770) Backporting changes * context changes
• dt-bindings: pwm: stm32: Add #pwm-cells (git-fixes).
• e1000e: Do not take care about recovery NVM checksum (bsc#1158533).
• e1000e: Fix an error handling path in 'e1000_probe()' (git-fixes).
• e1000e: Fix the max snoop/no-snoop latency for 10M (git-fixes).
• EDAC/i10nm: Fix NVDIMM detection (bsc#1114648).
• fbmem: add margin check to fb_check_caps() (bsc#1129770) Backporting changes: * context chacnges in fb_set_var()
• Fix build warnings. Also align code location with later codestreams and improve bisectability.
• fm10k: Fix an error handling path in 'fm10k_probe()' (git-fixes).
• fs/select: avoid clang stack usage warning (git-fixes).
• fuse: truncate pagecache on atomic_o_trunc (bsc#1191051).
• gve: fix the wrong AdminQ buffer overflow check (bsc#1176940).
• hv_netvsc: Make netvsc/VF binding check both MAC and serial number (jsc#SLE-18779, bsc#1185727).
• hv: mana: adjust mana_select_queue to old API (jsc#SLE-18779, bsc#1185727).
• hv: mana: remove netdev_lockdep_set_classes usage (jsc#SLE-18779, bsc#1185727).
• i40e: Add additional info to PHY type error (git-fixes).
• i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
• i40e: Fix error handling in i40e_vsi_open (git-fixes).
• i40e: Fix log TC creation failure when max num of queues is exceeded (bsc#1109837 bsc#1111981).
• i40e: Fix logic of disabling queues (git-fixes).
• iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
• iavf: Set RSS LUT and key in reset handle path (git-fixes).
• ibmvnic: check failover_pending in…

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)

The following non-security bugs were fixed:

• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: do not disable an already disabled PCI device (git-fixes).
• bnxt: disable napi before canceling DIM (bsc#1104745 ).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: kirkwood: Fix a clocking boot regression (git-fixes).
• crypto: x86/aes-ni-xts - use direct calls to and 4-way stride (bsc#1114648).
• cxgb4: fix IRQ free race during driver unload (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (bsc#1129770) Backporting changes: * refresh
• drm/imx: ipuv3-plane: Remove two unnecessary export symbols (bsc#1129770) Backporting changes: * refreshed
• drm/mediatek: Add AAL output size configuration (bsc#1129770) Backporting changes: * adapted code to use writel() function
• drm/msm: Small msm_gem_purge() fix (bsc#1129770) Backporting changes: * context changes in msm_gem_purge() * remove test for non-existant msm_gem_is_locked()
• drm/msm/dsi: Fix some reference counted resource leaks (bsc#1129770)
• drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() (bsc#1186785).
• drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 (bsc#1129770) Backporting changes * context changes
• dt-bindings: pwm: stm32: Add #pwm-cells (git-fixes).
• e1000e: Do not take care about recovery NVM checksum (bsc#1158533).
• e1000e: Fix an error handling path in 'e1000_probe()' (git-fixes).
• e1000e: Fix the max snoop/no-snoop latency for 10M (git-fixes).
• EDAC/i10nm: Fix NVDIMM detection (bsc#1114648).
• fbmem: add margin check to fb_check_caps() (bsc#1129770) Backporting changes: * context chacnges in fb_set_var()
• Fix build warnings. Also align code location with later codestreams and improve bisectability.
• fm10k: Fix an error handling path in 'fm10k_probe()' (git-fixes).
• fs/select: avoid clang stack usage warning (git-fixes).
• fuse: truncate pagecache on atomic_o_trunc (bsc#1191051).
• gve: fix the wrong AdminQ buffer overflow check (bsc#1176940).
• hv_netvsc: Make netvsc/VF binding check both MAC and serial number (jsc#SLE-18779, bsc#1185727).
• hv: mana: adjust mana_select_queue to old API (jsc#SLE-18779, bsc#1185727).
• hv: mana: remove netdev_lockdep_set_classes usage (jsc#SLE-18779, bsc#1185727).
• i40e: Add additional info to PHY type error (git-fixes).
• i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
• i40e: Fix error handling in i40e_vsi_open (git-fixes).
• i40e: Fix log TC creation failure when max num of queues is exceeded (bsc#1109837 bsc#1111981).
• i40e: Fix logic of disabling queues (git-fixes).
• iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
• iavf: Set RSS LUT and key in reset handle path (git-fixes).
• ibmvnic: check failover_pending in…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)
• CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks (bsc#1190115).
• CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program that could have obtain sensitive information from kernel memory (bsc#1188983).
• CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of arbitrary kernel memory (bsc#1188985).
• CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
• CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
• CVE-2021-3743: Fixed OOB Read in qrtr_endpoint_post (bsc#1189883).
• CVE-2021-3739: Fixed a NULL pointer dereference when deleting device by invalid id (bsc#1189832 ).
• CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
• CVE-2021-3653: Missing validation of the int_ctl VMCB field and allows a malicious L1 guest to enable AVIC support for the L2 guest. (bsc#1189399).
• CVE-2021-3656: Missing validation of the the virt_ext VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400).
• CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault (bnc#1189262).
• CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).

The following non-security bugs were fixed:

• ACPI: processor: Clean up acpi_processor_evaluate_cst() (bsc#1175543)
• ACPI: processor: Export acpi_processor_evaluate_cst() (bsc#1175543)
• ACPI: processor: Export function to claim _CST control (bsc#1175543)
• ACPI: processor: Introduce acpi_processor_evaluate_cst() (bsc#1175543)
• ACPI: processor: Make ACPI_PROCESSOR_CSTATE depend on ACPI_PROCESSOR (bsc#1175543)
• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• ALSA: hda - fix the 'Capture Switch' value change notifications (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop (git-fixes).
• ALSA: hda/realtek: Limit mic boost on HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup (git-fixes).
• ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17 (git-fixes).
• ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17 (git-fixes).
• ALSA: hda/via: Apply runtime PM workaround for ASUS B23E (git-fixes).
• ALSA: pcm: fix divide error in snd_pcm_lib_ioctl (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 800 (git-fixes).
• ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: component: Remove misplaced prefix handling in pin control functions…

The SUSE Linux Enterprise 15 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)

The following non-security bugs were fixed:

• ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
• apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
• ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
• ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
• ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
• ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
• ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
• ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
• ath9k: fix sleeping in atomic context (git-fixes).
• blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
• blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
• blk-mq: mark if one queue map uses managed irq (bsc#1185762).
• Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
• bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
• bnxt_en: Store the running firmware version code (git-fixes).
• bnxt: count Tx drops (git-fixes).
• bnxt: disable napi before canceling DIM (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
• console: consume APC, DM, DCS (git-fixes).
• cuse: fix broken release (bsc#1190596).
• cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• devlink: Break parameter notification sequence to be before/after unload/load driver (bsc#1154353).
• dmaengine: ioat: depends on !UML (git-fixes).
• dmaengine: sprd: Add missing MODULE_DEVICE_TABLE (git-fixes).
• dmaengine: xilinx_dma: Set DMA mask for coherent APIs (git-fixes).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps (git-fixes).
• drm: avoid blocking in drm_clients_info's rcu section (git-fixes).
• drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex (git-fixes).
• drm/amd/display: Fix timer_per_pixel unit error (git-fixes).
• drm/amdgpu: Fix BUG_ON assert (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (git-fixes).
• drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV (git-fixes).
• drm/panfrost: Clamp lock region to Bifrost minimum (git-fixes).
• e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
• e1000e: Fix the max…

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

• CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).

• CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read uninitialized memory (bnc#1188563).

• CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value (bnc#1186109 bnc#1186390 bnc#1188876).

• CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).

• CVE-2021-42739: The firewire subsystem in the Linux kernel has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673).

• CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).

• CVE-2018-13405: The inode_init_owner function in fs/inode.c in the Linux kernel allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).

• CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).

• CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack (bnc#1188983).

• CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation did not necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).

• CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel Local attackers able to access the Aspeed LPC control interface could overwrite memory in…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573) You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2018-3639: Fixed a speculative execution that may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. (bsc#1087082)
• CVE-2021-20320: Fix a bug that allows a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem. (bsc#1190601)
• CVE-2021-0941: Fixed A missing sanity check to the current MTU check that may allow a local attacker with special user privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. (bnc#1192045)
• CVE-2021-31916: Fixed a bound check failure that could allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash, a leak of internal kernel information, or a privilege escalation problem. (bnc#1192781)
• CVE-2021-20322: Fixed a bug that provides to an attacker the ability to quickly scan open UDP ports. (bsc#1191790)
• CVE-2021-3772: Fixed an issue that would allow a blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. (bsc#1190351)
• CVE-2021-34981: Fixed an issue that allows an attacker with a local account to escalate privileges when CAPI (ISDN) hardware connection fails. (bsc#1191961)
• CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
• CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace applications (bnc#1129898).
• CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx() (bnc#1133374).
• CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
• CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program that could have obtain sensitive information from kernel memory (bsc#1188983).
• CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of arbitrary kernel memory (bsc#1188985).
• CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth stack (bsc#1188172).
• CVE-2021-3653: Missing validation of the int_ctl VMCB field and allows a malicious L1 guest to enable AVIC support for the L2 guest. (bsc#1189399).
• CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the kernel to read uninitialized memory (bsc#1188563).
• CVE-2021-3656: Missing validation of the the virt_ext VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

The following security bugs were fixed:

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).
• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).
• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)
• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails. (bsc#1191961)
• CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the kernel to read uninitialized memory (bsc#1188563).
• CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
• CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
• CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bsc#1184673).
• CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
• CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute privileges (bnc#1190479).
• CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
• CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead to root access (bsc#1191315).
• CVE-2021-37159: Fixed use-after-free and a double free inside hso_free_net_device in drivers/net/usb/hso.c when unregister_netdev is called without checking for the NETREG_REGISTERED state (bnc#1188601).
• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
• CVE-2021-3772: Fixed a remote denial of service in the SCTP stack, if the attacker can spoof IP addresses and knows the IP-addresses and port numbers being used (bnc#1190351).
• CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
• CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace applications…

Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform size validations on incoming packets in some situations. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2021-3655)

It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)

It was discovered that the NFC subsystem in the Linux kernel contained a use-after-free vulnerability in its NFC Controller Interface (NCI) implementation. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3760)

It was discovered that an integer overflow could be triggered in the eBPF implementation in the Linux kernel when preallocating objects for stack maps. A privileged local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-41864)

It was discovered that the KVM implementation for POWER8 processors in the Linux kernel did not properly keep track if a wakeup event could be resolved by a guest. An attacker in a guest VM could possibly use this to cause a denial of service (host OS crash). (CVE-2021-43056)

It was discovered that the ISDN CAPI implementation in the Linux kernel contained a race condition in certain situations that could trigger an array out-of-bounds bug. A privileged local attacker could possibly use this to cause a denial of service or execute arbitrary code. (CVE-2021-43389)

It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)

It was discovered that an integer overflow could be triggered in the eBPF implementation in the Linux kernel when preallocating objects for stack maps. A privileged local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-41864)

Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform size validations on incoming packets in some situations. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2021-3655)

It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)

It was discovered that the Aspeed Low Pin Count (LPC) Bus Controller implementation in the Linux kernel did not properly perform boundary checks in some situations, allowing out-of-bounds write access. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. In Ubuntu, this issue only affected systems running armhf kernels. (CVE-2021-42252)

Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform size validations on incoming packets in some situations. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2021-3655)

It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)

It was discovered that the Aspeed Low Pin Count (LPC) Bus Controller implementation in the Linux kernel did not properly perform boundary checks in some situations, allowing out-of-bounds write access. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. In Ubuntu, this issue only affected systems running armhf kernels. (CVE-2021-42252)

Jann Horn discovered that the SELinux subsystem in the Linux kernel did not properly handle subjective credentials for tasks in some situations. On systems where SELinux has been enabled, a local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-43057)

Ilja Van Sprundel discovered that the SCTP implementation in the Linux kernel did not properly perform size validations on incoming packets in some situations. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2021-3655)

It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly handle error conditions. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)

It was discovered that the Option USB High Speed Mobile device driver in the Linux kernel did not properly handle error conditions. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-37159)

It was discovered that the AMD Cryptographic Coprocessor (CCP) driver in the Linux kernel did not properly deallocate memory in some error conditions. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3744, CVE-2021-3764)