CVE-2021-22543

The Linux Kernel, the operating system core itself.

Security Fix(es):

A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.(CVE-2021-40490)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.(CVE-2021-3653)

An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation.(CVE-2021-22543)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: race condition in net/can/bcm.c leads to local privilege escalation (CVE-2021-3609)

• kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks (CVE-2021-22543)

• kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c (CVE-2021-22555)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Urgent: Missing dptf_power.ko module in Rocky Linux8 (BZ#1968381)

• [mlx5] kdump over NFS fails: mlx5 driver gives error "Stop room 95 is bigger than the SQ size 64" (BZ#1969909)

• BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 in bluetooth hci_error_reset on intel-tigerlake-h01 (BZ#1972564)

• Update CIFS to kernel 5.10 (BZ#1973637)

• Backport "tick/nohz: Conditionally restart tick on idle exit" to Rocky Linux 8.5 (BZ#1978710)

• Significant performance drop starting on kernel-4.18.0-277 visible on mmap benchmark (BZ#1980314)

• Inaccessible NFS server overloads clients (native_queued_spin_lock_slowpath connotation?) (BZ#1980613)

• [Rocky Linux8.4 BUG],RialtoMLK, I915 graphic driver failed to boot with one new 120HZ panel (BZ#1981250)

• act_ct: subject to DNAT tuple collision (BZ#1982494)

Enhancement(s):

• [Lenovo 8.5 FEAT] drivers/nvme - Update to the latest upstream (BZ#1965415)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: race condition in net/can/bcm.c leads to local privilege escalation (CVE-2021-3609)

• kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks (CVE-2021-22543)

• kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c (CVE-2021-22555)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update RT source tree to the Rocky Linux-8.4.z source tree (BZ#1985050)

• kernel-rt: Merge mm/memcg: Fix kmem_cache_alloc() performance regression (BZ#1987102)

An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: race condition in net/can/bcm.c leads to local privilege escalation (CVE-2021-3609)

• kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks (CVE-2021-22543)

• kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c (CVE-2021-22555)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Urgent: Missing dptf_power.ko module in AlmaLinux8 (BZ#1968381)

• [mlx5] kdump over NFS fails: mlx5 driver gives error "Stop room 95 is bigger than the SQ size 64" (BZ#1969909)

• BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 in bluetooth hci_error_reset on intel-tigerlake-h01 (BZ#1972564)

• Update CIFS to kernel 5.10 (BZ#1973637)

• Backport "tick/nohz: Conditionally restart tick on idle exit" to AlmaLinux 8.5 (BZ#1978710)

• Significant performance drop starting on kernel-4.18.0-277 visible on mmap benchmark (BZ#1980314)

• Inaccessible NFS server overloads clients (native_queued_spin_lock_slowpath connotation?) (BZ#1980613)

• [AlmaLinux8.4 BUG],RialtoMLK, I915 graphic driver failed to boot with one new 120HZ panel (BZ#1981250)

• act_ct: subject to DNAT tuple collision (BZ#1982494)

Enhancement(s):

• [Lenovo 8.5 FEAT] drivers/nvme - Update to the latest upstream (BZ#1965415)

• KVM: do not allow mapping valid but non-reference-counted pages {CVE-2021-22543}

• KVM: do not allow mapping valid but non-reference-counted pages {CVE-2021-22543}

• KVM: do not allow mapping valid but non-reference-counted pages {CVE-2021-22543}

• KVM: do not allow mapping valid but non-reference-counted pages {CVE-2021-22543}

This kernel update is based on upstream 5.10.48 and fixes at least the following security issues:

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541).

An issue was discovered in Linux: KVM through Improper handling of VM_IO| VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543).

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument (CVE-2021-35039).

Other fixes in this update:

• ahci: Add support for Dell S140 and later controllers
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445/450/630 G8
• drm/amdgpu: fix bad address translation for sienna_cichlid
• drm/sched: Avoid data corruptions
• net: ip: avoid OOM kills with large UDP sends over loopback
• iwlwifi: Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
• virtio_net: Remove BUG() to avoid machine dead

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.10.48 and fixes at least the following security issues:

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541).

An issue was discovered in Linux: KVM through Improper handling of VM_IO| VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543).

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument (CVE-2021-35039).

For other upstream fixes, see the referenced changelogs.

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3679: A lack of CPU resource in the Linux kernel tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057).
• CVE-2021-3659: Fix general protection fault via NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-37576: arch/powerpc/kvm/book3s_rtas.c on the powerpc platform allowed KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e (bnc#1188838 bnc#1188842).
• CVE-2021-22543: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bnc#1186482).
• CVE-2021-21781: A SIGPAGE information disclosure vulnerability on ARM was fixed (bsc#1188445).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda/realtek: add mic quirk for Acer SF314-42 (git-fixes).
• ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: seq: Fix racy deletion of subscriber (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 600 (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum headsets (git-fixes).
• ALSA: usb-audio: Fix superfluous autosuspend recovery (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions (git-fixes).
• ALSA: usb-audio: scarlett2: Fix data_mutex lock (git-fixes).
• ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values (git-fixes).
• ALSA: usx2y: Do not call free_pages_exact() with NULL address (git-fixes).
• ASoC: img: Fix PM reference leak in img_i2s_in_probe() (git-fixes).
• ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters (git-fixes).
• ASoC: rt5631: Fix regcache sync errors on resume (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• backlight: lm3630a: Fix return code of .update_status() callback (git-fixes).
• bcache: avoid oversized read request in cache missing code path (bsc#1184631).
• bcache: remove bcache device self-defined readahead (bsc#1184631).
• Bluetooth: defer cleanup of resources in hci_unregister_dev() (git-fixes).
• bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
• bnxt_en: Check abort error state in bnxt_half_open_nic() (jsc#SLE-8371 bsc#1153274).
• bnxt_en: do not disable an already disabled PCI device (git-fixes).
• bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe() (jsc#SLE-8371 bsc#1153274).
• bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc (bsc#1154353).
• btrfs: factor out create_chunk() (bsc#1189077).
• btrfs: factor out decide_stripe_size() (bsc#1189077).
• btrfs: factor out gather_device_info() (bsc#1189077).
• btrfs: factor out init_alloc_chunk_ctl (bsc#1189077).
• btrfs: fix deadlock with concurrent chunk allocations involving system…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
• ACPI: DPTF: Fix reading of attributes (git-fixes).
• ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
• ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
• ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
• ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
• ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
• ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
• ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
• ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
• ALSA: pcm: Fix mmap capability check (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
• ACPI: DPTF: Fix reading of attributes (git-fixes).
• ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
• ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
• ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
• ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
• ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
• ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
• ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
• ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
• ALSA: pcm: Fix mmap capability check (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes). -…

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

  You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).

• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).

• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)

• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).

• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

• CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb (bsc#1190351).

• CVE-2021-3655: Missing size validations on inbound SCTP packets may have allowed the kernel to read uninitialized memory (bnc#1188563).

• CVE-2021-33033: The Linux kernel has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value (bnc#1186109 bnc#1186390 bnc#1188876).

• CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).

• CVE-2021-42739: The firewire subsystem in the Linux kernel has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bnc#1184673).

• CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).

• CVE-2018-13405: The inode_init_owner function in fs/inode.c in the Linux kernel allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416 bnc#1129735).

• CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).

• CVE-2021-34556: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack (bnc#1188983).

• CVE-2021-35477: An unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation did not necessarily occur before a store operation that has an attacker-controlled value (bnc#1188985).

• CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel Local attackers able to access the Aspeed LPC control interface could overwrite memory in…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bsc#1187038).
• CVE-2021-22543: Fixed an improper handling of VM_IO|VM_PFNMAP vmas in KVM that allows users to start and control a VM to read/write random pages of memory and can result in local privilege escalation. (bnc#1186482)
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)
• CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116)
• CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215)
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw which could allows a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050)

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
• ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes).
• ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes).
• HID: Add BUS_VIRTUAL to hid_connect logging (git-fixes).
• HID: gt683r: add missing MODULE_DEVICE_TABLE (git-fixes).
• HID: hid-sensor-hub: Return error for hid_set_field() failure (git-fixes).
• HID: usbhid: fix info leak in hid_submit_ctrl (git-fixes).
• HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes).
• Input: hil_kbd - fix error return code in hil_dev_connect() (git-fixes).
• Input: usbtouchscreen - fix control-request directions (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Mark TI C667X to avoid bus reset (git-fixes).
• PCI: Mark some NVIDIA GPUs to avoid bus reset…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bsc#1187038).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: quirks: fix false kABI positive (git-fixes).
• Revert 'USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem' (git-fixes).
• USB: cdc-acm: blacklist Heimann USB Appset device (git-fixes).
• USB: move many drivers to use DEVICE_ATTR_WO (git-fixes).
• USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: option: add support for u-blox LARA-R6 family (git-fixes).
• USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS (git-fixes).
• ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
• can: ems_usb: fix memory leak (git-fixes).
• can: esd_usb2: fix memory leak (git-fixes).
• can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
• can: mcba_usb_start(): add missing urb->transfer_dma initialization (git-fixes).
• can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF (git-fixes).
• can: sja1000: sja1000_err(): do not count arbitration lose as an error (git-fixes).
• can: sun4i_can: sun4i_can_err(): do not count arbitration lose as an error (git-fixes).
• can: ti_hecc: Fix memleak in ti_hecc_probe (git-fixes).
• can: usb_8dev: fix memory leak (git-fixes).
• ceph: do not WARN if we're still opening a session to an MDS (bsc#1188750).
• cifs: Fix preauth hash corruption (git-fixes).
• cifs: Return correct error code from…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
• ACPI: DPTF: Fix reading of attributes (git-fixes).
• ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
• ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
• ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
• ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
• ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
• ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
• ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
• ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
• ALSA: pcm: Fix mmap capability check (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).…

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum headsets (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions (git-fixes).
• ALSA: usb-audio: scarlett2: Fix data_mutex lock (git-fixes).
• ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values (git-fixes).
• ALSA: usx2y: Do not call free_pages_exact() with NULL address (git-fixes).
• ARM: ensure the signal page contains defined contents (bsc#1188445).
• ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters (git-fixes).
• ASoC: img: Fix PM reference leak in img_i2s_in_probe() (git-fixes).
• ASoC: rt5631: Fix regcache sync errors on resume (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Input: hideep - fix the uninitialized use in hideep_nvm_unlock() (git-fixes).
• Input: ili210x - add missing negation for touch indication on ili210x (git-fixes).
• KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled (bsc#1188771).
• KVM: nVMX: Consult only the 'basic' exit reason when routing nested exit (bsc#1188773).
• KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap (bsc#1188774).
• KVM: nVMX: Preserve exception priority irrespective of exiting behavior (bsc#1188777).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc: Support multi-MSI only on uniprocessor kernel (git-fixes).
• PCI: quirks: fix false kABI positive (git-fixes).
• PCI: tegra: Add…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).
• CVE-2020-36386: Fixed a slab out-of-bounds read in hci_extended_inquiry_result_evt (bsc#1187038 ).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Add ACS quirk for Broadcom BCM57414 NIC (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: quirks: fix false kABI positive (git-fixes).
• USB: cdc-acm: blacklist Heimann USB Appset device (git-fixes).
• USB: move many drivers to use DEVICE_ATTR_WO (git-fixes).
• USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: cp210x: fix comments for GE CS1000 (git-fixes).
• USB: serial: option: add support for u-blox LARA-R6 family (git-fixes).
• USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS (git-fixes).
• ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes).
• can: ems_usb: fix memory leak (git-fixes).
• can: esd_usb2: fix memory leak (git-fixes).
• can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
• can: mcba_usb_start(): add missing urb->transfer_dma initialization (git-fixes).
• can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF (git-fixes).
• can: sja1000: sja1000_err(): do not count arbitration lose as an error (git-fixes).
• can: sun4i_can: sun4i_can_err(): do not count arbitration lose as an error (git-fixes).
• can: ti_hecc: Fix memleak in ti_hecc_probe (git-fixes).
• can: usb_8dev: fix memory leak (git-fixes).
• ceph: do not WARN if we're still opening a session to an MDS (bsc#1188750).
• cifs: Fix preauth hash corruption (git-fixes).
• cifs: Return correct error code from smb2_get_enc_key (git-fixes).
• cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath (git-fixes).
• cifs: fix interrupted close commands (git-fixes).
• cifs: fix…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062)

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes).
• ALSA: sb: Fix potential ABBA deadlock in CSP driver (git-fixes).
• ALSA: sb: Fix potential double-free of CSP mixer elements (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum headsets (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count (git-fixes).
• ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions (git-fixes).
• ALSA: usb-audio: scarlett2: Fix data_mutex lock (git-fixes).
• ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values (git-fixes).
• ALSA: usx2y: Do not call free_pages_exact() with NULL address (git-fixes).
• ARM: ensure the signal page contains defined contents (bsc#1188445).
• ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters (git-fixes).
• ASoC: img: Fix PM reference leak in img_i2s_in_probe() (git-fixes).
• ASoC: rt5631: Fix regcache sync errors on resume (git-fixes).
• ASoC: soc-core: Fix the error return code in snd_soc_of_parse_audio_routing() (git-fixes).
• ASoC: tegra: Set driver_name=tegra for all machine drivers (git-fixes).
• Bluetooth: Fix the HCI to MGMT status conversion table (git-fixes).
• Bluetooth: Shutdown controller after workqueues are flushed or cancelled (git-fixes).
• Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip (git-fixes).
• Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc (git-fixes).
• Input: hideep - fix the uninitialized use in hideep_nvm_unlock() (git-fixes).
• Input: ili210x - add missing negation for touch indication on ili210x (git-fixes).
• KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled (bsc#1188771).
• KVM: nVMX: Consult only the 'basic' exit reason when routing nested exit (bsc#1188773).
• KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap (bsc#1188774).
• KVM: nVMX: Preserve exception priority irrespective of exiting behavior (bsc#1188777).
• PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: Leave Apple Thunderbolt controllers on for s2idle or standby (git-fixes).
• PCI: aardvark: Fix checking for PIO Non-posted Request (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: aardvark: Implement workaround for the readback value of VEND_ID (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc: Fix multi-MSI base vector number allocation (git-fixes).
• PCI: iproc:…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
• CVE-2021-21781: Fixed a information disclosure vulnerability in the ARM SIGPAGE (bsc#1188445).
• CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a potential local privilege escalation in the CAN BCM networking protocol (bsc#1187215).
• CVE-2021-3612: Fixed an out-of-bounds memory write flaw in the joystick devices subsystem. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. (bsc#1187585)
• CVE-2021-35039: Fixed mishandling of signature verification. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bsc#1188080).

The following non-security bugs were fixed:

• ACPI: AMBA: Fix resource name in /proc/iomem (git-fixes).
• ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes).
• ACPI: DPTF: Fix reading of attributes (git-fixes).
• ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes).
• ACPI: PM / fan: Put fan device IDs into separate header file (git-fixes).
• ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes).
• ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes).
• ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes).
• ACPI: resources: Add checks for ACPI IRQ override (git-fixes).
• ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes).
• ACPI: video: Add quirk for the Dell Vostro 3350 (git-fixes).
• ACPICA: Fix memory leak caused by _CID repair function (git-fixes).
• ALSA: ac97: fix PM reference leak in ac97_bus_remove() (git-fixes).
• ALSA: bebob: add support for ToneWeal FW66 (git-fixes).
• ALSA: firewire-motu: fix detection for S/PDIF source on optical interface in v2 protocol (git-fixes).
• ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire (git-fixes).
• ALSA: hda/realtek: Add another ALC236 variant support (git-fixes).
• ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too (git-fixes).
• ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes).
• ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine (git-fixes).
• ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 (git-fixes).
• ALSA: hda: Add IRQ check for platform_get_irq() (git-fixes).
• ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID (git-fixes).
• ALSA: hdmi: Expose all pins on MSI MS-7C94 board (git-fixes).
• ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes).
• ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes).
• ALSA: pcm - fix mmap capability check for the snd-dummy driver (git-fixes).
• ALSA: pcm: Call substream ack() method upon compat mmap commit (git-fixes).
• ALSA: pcm: Fix mmap capability check (git-fixes).
• ALSA: ppc: fix error return code in snd_pmac_probe() (git-fixes). -…

This update for the Linux Kernel 5.3.18-24_75 fixes several issues.

The following security issues were fixed:

• CVE-2021-22543: Fixed an issue with KVM, related to the handling of VM_IO|VM_PFNMAP vmas, which allowed users with the ability to start and control a VM to read/write random pages of memory and could result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: On the powerpc platform KVM guest OS users could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).

This update for the Linux Kernel 5.3.18-57 fixes several issues.

The following security issues were fixed:

• CVE-2021-22543: Fixed an issue with KVM, related to the handling of VM_IO|VM_PFNMAP vmas, which allowed users with the ability to start and control a VM to read/write random pages of memory and could result in local privilege escalation (bsc#1186482).
• CVE-2021-37576: On the powerpc platform KVM guest OS users could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
• CVE-2021-3609: Fixed a local privilege escalation via a race condition in net/can/bcm.c (bsc#1187215).