CVE-2021-21781

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.(CVE-2021-34556)

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.(CVE-2021-35477)

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11(CVE-2021-21781)

In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size.(CVE-2021-38160)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222 4.19.177 5.4.99 5.10.17 5.11

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This kernel update is based on upstream 5.10.19 and fixes at least the following security issues:

There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y, CONFIG_BPF=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation. NOTE! Mageia kernel configs have HARDENED_USERCOPY enabled by default, making this an non-issue when using prebuilt kernels (CVE-2021-20194).

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability (CVE-2021-21781).

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error (CVE-2021-26930).

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though (CVE-2021-26931).

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable (CVE-2021-26932).

It also adds the following fixes:

• enable ACPI_EC_DEBUGFS (mga#28415)
• ALSA: hda: Add another CometLake-H PCI ID
• Revert 'drm/amd/display: Update NV1x SR latency values'
• drm/nouveau/kms: handle mDP connectors
• drm/i915/gt: One more flush for Baytrail clear residuals
• drm/i915/gt: Flush before changing register state
• drm/i915/gt: Correct surface base address for renderclear
• rtw88: 8821c: add RFE type 2 support
• update rtw89 patchset to v3
• tracing: Check length before giving out the filter buffer
• drop "revert 'Bluetooth: btusb: Add Qualcomm Bluetooth SoC WCN6855 support' (mga#27910)"
• Bluetooth: btusb: fix for Qualcomm Bluetooth adapters that stopped working due to not finding (unneeded) ROME firmware (real fix for mga#27910)
• media: uvcvideo: Allow entities with no pads
• mm/vmscan: restore zone_reclaim_mode ABI
• nvme: Add quirks for Lexar 256GB SSD (pterjan, mga#28417)
• nvme: add 48-bit DMA address quirk for Amazon NVMe controllers
• nvme-pci: add the…

This kernel-linus update is based on upstream 5.10.19 and fixes at least the following security issues:

There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y, CONFIG_BPF=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation. NOTE! Mageia kernel configs have HARDENED_USERCOPY enabled by default, making this an non-issue when using prebuilt kernels (CVE-2021-20194).

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability (CVE-2021-21781).

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error (CVE-2021-26930).

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though (CVE-2021-26931).

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable (CVE-2021-26932).

It also adds the following fixes:

• enable ACPI_EC_DEBUGFS (mga#28415)

For other upstream fixes, see the referenced changelogs.

This kernel update is based on upstream 5.10.19 and fixes at least the following security issues:

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability (CVE-2021-21781).

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error (CVE-2021-26930).

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though (CVE-2021-26931).

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable (CVE-2021-26932).

It also adds the following fixes:

• enable ACPI_EC_DEBUGFS (mga#28415)
• drop "revert 'Bluetooth: btusb: Add Qualcomm Bluetooth SoC WCN6855 support' (mga#27910)"
• Bluetooth: btusb: fix for Qualcomm Bluetooth adapters that stopped working due to not finding (unneeded) ROME firmware (real fix for mga#27910)
• media: uvcvideo: Allow entities with no pads
• mm/vmscan: restore zone_reclaim_mode ABI
• nvme: Add quirks for Lexar 256GB SSD (pterjan, mga#28417)
• nvme: add 48-bit DMA address quirk for Amazon NVMe controllers
• nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a SPCC device
• staging/rtl8723bs: sync with 5.12-rc1 (mga#28429)
• x86: fix seq_file iteration for pat/memtype.c

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.10.19 and fixes at least the following security issues:

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process’s memory at a specific offset to trigger this vulnerability (CVE-2021-21781).

An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error (CVE-2021-26930).

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though (CVE-2021-26931).

An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable (CVE-2021-26932).

It also adds the following fixes:

• enable ACPI_EC_DEBUGFS (mga#28415)

For other upstream fixes, see the referenced changelogs.

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3679: A lack of CPU resource in the Linux kernel tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057).
• CVE-2021-3659: Fix general protection fault via NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-37576: arch/powerpc/kvm/book3s_rtas.c on the powerpc platform allowed KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e (bnc#1188838 bnc#1188842).
• CVE-2021-22543: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bnc#1186482).
• CVE-2021-21781: A SIGPAGE information disclosure vulnerability on ARM was fixed (bsc#1188445).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda/realtek: add mic quirk for Acer SF314-42 (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: seq: Fix racy deletion of subscriber (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 600 (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum headsets (git-fixes).
• ALSA: usb-audio: Fix superfluous autosuspend recovery (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions (git-fixes).
• ALSA: usb-audio: scarlett2: Fix data_mutex lock (git-fixes).
• ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values (git-fixes).
• ALSA: usx2y: Do not call free_pages_exact() with NULL address (git-fixes).
• ASoC: img: Fix PM reference leak in img_i2s_in_probe() (git-fixes).
• ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters (git-fixes).
• ASoC: rt5631: Fix regcache sync errors on resume (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• backlight: lm3630a: Fix return code of .update_status() callback (git-fixes).
• bcache: avoid oversized read request in cache missing code path (bsc#1184631).
• bcache: remove bcache device self-defined readahead (bsc#1184631).
• Bluetooth: defer cleanup of resources in hci_unregister_dev() (git-fixes).
• bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Check abort error state in bnxt_half_open_nic() (jsc#SLE-8371 bsc#1153274).
• bnxt_en: do not disable an already disabled PCI device (git-fixes).
• bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe() (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1154353).
• btrfs: factor out create_chunk() (bsc#1189077).
• btrfs: factor out decide_stripe_size() (bsc#1189077).
• btrfs: factor out gather_device_info() (bsc#1189077).
• btrfs: factor out init_alloc_chunk_ctl (bsc#1189077).
• btrfs: fix deadlock with concurrent chunk allocations involving system…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
• ACPI: DPTF: Fix reading of attributes (git-fixes).
• ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
• ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
• ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
• ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
• ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
• ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
• ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
• ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
• ALSA: pcm: Fix mmap capability check (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
• ACPI: DPTF: Fix reading of attributes (git-fixes).
• ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
• ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
• ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
• ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
• ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
• ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
• ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
• ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
• ALSA: pcm: Fix mmap capability check (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes). -…

In get_signal_page of signal.c, there is a possible leak of kernel data due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
• ACPI: DPTF: Fix reading of attributes (git-fixes).
• ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
• ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
• ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
• ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
• ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
• ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
• ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
• ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
• ALSA: pcm: Fix mmap capability check (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum headsets (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions (git-fixes).
• ALSA: usb-audio: scarlett2: Fix data_mutex lock (git-fixes).
• ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values (git-fixes).
• ALSA: usx2y: Do not call free_pages_exact() with NULL address (git-fixes).
• ARM: ensure the signal page contains defined contents (bsc#1188445).
• ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters (git-fixes).
• ASoC: img: Fix PM reference leak in img_i2s_in_probe() (git-fixes).
• ASoC: rt5631: Fix regcache sync errors on resume (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Input: hideep - fix the uninitialized use in hideep_nvm_unlock() (git-fixes).
• Input: ili210x - add missing negation for touch indication on ili210x (git-fixes).
• KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled (bsc#1188771).
• KVM: nVMX: Consult only the 'basic' exit reason when routing nested exit (bsc#1188773).
• KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap (bsc#1188774).
• KVM: nVMX: Preserve exception priority irrespective of exiting behavior (bsc#1188777).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc: Support multi-MSI only on uniprocessor kernel (git-fixes).
• PCI: quirks: fix false kABI positive (git-fixes).
• PCI: tegra: Add…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum headsets (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions (git-fixes).
• ALSA: usb-audio: scarlett2: Fix data_mutex lock (git-fixes).
• ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values (git-fixes).
• ALSA: usx2y: Do not call free_pages_exact() with NULL address (git-fixes).
• ARM: ensure the signal page contains defined contents (bsc#1188445).
• ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters (git-fixes).
• ASoC: img: Fix PM reference leak in img_i2s_in_probe() (git-fixes).
• ASoC: rt5631: Fix regcache sync errors on resume (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Input: hideep - fix the uninitialized use in hideep_nvm_unlock() (git-fixes).
• Input: ili210x - add missing negation for touch indication on ili210x (git-fixes).
• KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled (bsc#1188771).
• KVM: nVMX: Consult only the 'basic' exit reason when routing nested exit (bsc#1188773).
• KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap (bsc#1188774).
• KVM: nVMX: Preserve exception priority irrespective of exiting behavior (bsc#1188777).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc:…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
• ACPI: DPTF: Fix reading of attributes (git-fixes).
• ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
• ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
• ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
• ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
• ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
• ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
• ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
• ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
• ALSA: pcm: Fix mmap capability check (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum headsets (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions (git-fixes).
• ALSA: usb-audio: scarlett2: Fix data_mutex lock (git-fixes).
• ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values (git-fixes).
• ALSA: usx2y: Do not call free_pages_exact() with NULL address (git-fixes).
• ARM: ensure the signal page contains defined contents (bsc#1188445).
• ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters (git-fixes).
• ASoC: img: Fix PM reference leak in img_i2s_in_probe() (git-fixes).
• ASoC: rt5631: Fix regcache sync errors on resume (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Input: hideep - fix the uninitialized use in hideep_nvm_unlock() (git-fixes).
• Input: ili210x - add missing negation for touch indication on ili210x (git-fixes).
• KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled (bsc#1188771).
• KVM: nVMX: Consult only the 'basic' exit reason when routing nested exit (bsc#1188773).
• KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap (bsc#1188774).
• KVM: nVMX: Preserve exception priority irrespective of exiting behavior (bsc#1188777).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc: Support multi-MSI only on uniprocessor kernel (git-fixes).
• PCI: quirks: fix false kABI positive (git-fixes).
• PCI: tegra: Add…