CVE-2020-29368

An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: out-of-bounds reads in pinctrl subsystem (CVE-2020-0427)
• kernel: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24502)
• kernel: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24503)
• kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers (CVE-2020-24504)
• kernel: Fragmentation cache not cleared on reconnection (CVE-2020-24586)
• kernel: Reassembling fragments encrypted under different keys (CVE-2020-24587)
• kernel: wifi frame payload being parsed incorrectly as an L2 frame (CVE-2020-24588)
• kernel: Forwarding EAPOL from unauthenticated wifi client (CVE-2020-26139)
• kernel: accepting plaintext data frames in protected networks (CVE-2020-26140)
• kernel: not verifying TKIP MIC of fragmented frames (CVE-2020-26141)
• kernel: accepting fragmented plaintext frames in protected networks (CVE-2020-26143)
• kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header (CVE-2020-26144)
• kernel: accepting plaintext broadcast fragments as full frames (CVE-2020-26145)
• kernel: powerpc: RTAS calls can be used to compromise kernel integrity (CVE-2020-27777)
• kernel: locking inconsistency in tty_io.c and tty_jobctrl.c can lead to a read-after-free (CVE-2020-29660)
• kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function via a long SSID value (CVE-2020-36158)
• kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt() (CVE-2020-36386)
• kernel: Improper access control in BlueZ may allow information disclosure vulnerability. (CVE-2021-0129)
• kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c (CVE-2021-3348)
• kernel: Linux kernel eBPF RINGBUF map oversized allocation (CVE-2021-3489)
• kernel: double free in bluetooth subsystem when the HCI device initialization fails (CVE-2021-3564)
• kernel: use-after-free in function hci_sock_bound_ioctl() (CVE-2021-3573)
• kernel: eBPF 32-bit source register truncation on div/mod (CVE-2021-3600)
• kernel: DoS in rb_per_cpu_empty() (CVE-2021-3679)
• kernel: Mounting overlayfs inside an unprivileged user namespace can reveal files (CVE-2021-3732)
• kernel: heap overflow in __cgroup_bpf_run_filter_getsockopt() (CVE-2021-20194)
• kernel: Race condition in sctp_destroy_sock list_del (CVE-2021-23133)
• kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode (CVE-2021-28950)
• kernel: System crash in intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c (CVE-2021-28971)
• kernel: protection can be bypassed to leak content of kernel memory (CVE-2021-29155)
• kernel: improper input validation in tipc_nl_retrieve_key function in net/tipc/node.c (CVE-2021-29646)
• kernel: lack a full memory barrier may lead to DoS (CVE-2021-29650)
• kernel: local escalation of privileges in handling of eBPF programs (CVE-2021-31440)
• kernel: protection of stack pointer against speculative pointer arithmetic can be bypassed to leak content of kernel memory (CVE-2021-31829)
• kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations by BPF verifier (CVE-2021-33200)
• kernel: reassembling encrypted fragments with non-consecutive packet numbers (CVE-2020-26146)
• kernel: reassembling mixed encrypted/plaintext fragments (CVE-2020-26147)
• kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check (CVE-2020-29368)
• kernel: flowtable list del corruption with kernel BUG at lib/list_debug.c:50 (CVE-2021-3635)
• kernel: NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (CVE-2021-3659)
• kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure (CVE-2021-20239)
• kernel: out of bounds array access in drivers/md/dm-ioctl.c (CVE-2021-31916)

In __split_huge_pmd of huge_memory.c, there is a possible incorrectly mapped page due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

The openSUSE Linux Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).
• CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).
• CVE-2020-12364: Fixed a null pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).
• CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• ACPICA: Fix exception code class checks (git-fixes).
• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 2) (git-fixes).
• ALSA: hda: Add another CometLake-H PCI ID (git-fixes).
• ALSA: hda/hdmi: Drop bogus check at closing a stream (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• ALSA: pcm: Assure sync with the pending stop operation at suspend (git-fixes).
• ALSA: pcm: Call sync_stop at disconnection (git-fixes).
• ALSA: pcm: Do not call sync_stop if it hasn't been stopped (git-fixes).
• ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 (git-fixes).
• ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() (git-fixes).
• ALSA: usb-audio: Do not avoid stopping the stream at disconnection (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• ALSA: usb-audio: Handle invalid running state at releasing EP (git-fixes).
• ALSA: usb-audio: More strict state change in EP (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• armv7hl: lpae: Update config files. Disable KVM support (bsc#1182697)
• ASoC: cpcap: fix microphone timeslot mask (git-fixes).
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ASoC: simple-card-utils: Fix device module clock (git-fixes).
• ASoC: SOF: debug: Fix a potential issue on string buffer termination (git-fixes).
• ata: ahci_brcm: Add back regulators management (git-fixes).
• ata: sata_nv: Fix retrieving of active qcs (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• bcache: fix overflow in offset_to_stripe() (git-fixes).
• blk-mq: call commit_rqs while list empty but error happen (bsc#1182442).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (bsc#1182443).
• blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (bsc#1182444).
• block: fix inflight statistics of part0 (bsc#1182445).
• block: respect queue limit of max discard segment (bsc#1182441).
• block: virtio_blk: fix handling single range discard request (bsc#1182439).
• Bluetooth: btqcomsmd: Fix…

This update for the Linux Kernel 5.3.18-24_46 fixes several issues.

The following security issues were fixed:

• CVE-2020-29373: Fixed an issue where kernel unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations (bsc#1179779).
• CVE-2020-29569: Fixed a use after free due to a logic error (bsc#1180008).
• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could grant unintended write access because of a race condition in a THP mapcount check (bsc#1179664).

This update for the Linux Kernel 5.3.18-24_24 fixes several issues.

The following security issues were fixed:

• CVE-2020-29373: Fixed an issue where kernel unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations (bsc#1179779).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180562).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180032.
• CVE-2020-29569: Fixed a use after free due to a logic error (bsc#1180008).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bsc#1179877).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179877).
• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could grant unintended write access because of a race condition in a THP mapcount check (bsc#1179664).

This update for the Linux Kernel 5.3.18-22 fixes several issues.

The following security issues were fixed:

• CVE-2020-29373: Fixed an issue where kernel unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations (bsc#1179779).
• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180562).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180030).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180032.
• CVE-2020-29569: Fixed a use after free due to a logic error (bsc#1180008).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bsc#1179877).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179877).
• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could grant unintended write access because of a race condition in a THP mapcount check (bsc#1179664).

This update for the Linux Kernel 4.12.14-197_34 fixes several issues.

The following security issues were fixed:

• CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180562).
• CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180030).
• CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180032.
• CVE-2020-29569: Fixed a use after free due to a logic error (bsc#1180008).
• CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bsc#1179877).
• CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179877).
• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could grant unintended write access because of a race condition in a THP mapcount check (bsc#1179664).

This update for the Linux Kernel 4.12.14-197_78 fixes several issues.

The following security issues were fixed:

• CVE-2020-29569: Fixed a use after free due to a logic error (bsc#1180008).
• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could grant unintended write access because of a race condition in a THP mapcount check (bsc#1179664).

The SUSE Linux Enterprise 15 SP2 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).
• CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).
• CVE-2020-12364: Fixed a null pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).
• CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• ACPICA: Fix exception code class checks (git-fixes).
• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 2) (git-fixes).
• ALSA: hda: Add another CometLake-H PCI ID (git-fixes).
• ALSA: hda/hdmi: Drop bogus check at closing a stream (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• ALSA: pcm: Assure sync with the pending stop operation at suspend (git-fixes).
• ALSA: pcm: Call sync_stop at disconnection (git-fixes).
• ALSA: pcm: Do not call sync_stop if it hasn't been stopped (git-fixes).
• ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 (git-fixes).
• ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() (git-fixes).
• ALSA: usb-audio: Do not avoid stopping the stream at disconnection (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• ALSA: usb-audio: Handle invalid running state at releasing EP (git-fixes).
• ALSA: usb-audio: More strict state change in EP (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• ASoC: cpcap: fix microphone timeslot mask (git-fixes).
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ASoC: simple-card-utils: Fix device module clock (git-fixes).
• ASoC: SOF: debug: Fix a potential issue on string buffer termination (git-fixes).
• ata: ahci_brcm: Add back regulators management (git-fixes).
• ata: sata_nv: Fix retrieving of active qcs (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• bcache: fix overflow in offset_to_stripe() (git-fixes).
• blk-mq: call commit_rqs while list empty but error happen (bsc#1182442).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (bsc#1182443).
• blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (bsc#1182444).
• block: fix inflight statistics of part0 (bsc#1182445).
• block: respect queue limit of max discard segment (bsc#1182441).
• block: virtio_blk: fix handling single range discard request (bsc#1182439).
• Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• cifs: check all path components in resolved dfs target (bsc#1180906).
• cifs: fix check of tcon dfs in smb1 (bsc#1180906).
• cifs: fix nodfs mount option (bsc#1180906).
• cifs: introduce helper for finding referral server (bsc#1180906).
• kernel-{binary,source}.spec.in: do not create loop symlinks (bsc#1179082)
• kernel-binary.spec: Add back initrd and image symlink ghosts to filelist (bsc#1182140). Fixes: 76a9256314c3 ('rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).')
• kernel-source.spec: Fix build with rpm 4.16 (boo#1179015). RPM_BUILD_ROOT is cleared before %%install. Do the unpack into RPM_BUILD_ROOT in %%install
• rpm/kernel-binary.spec.in: avoid using barewords (bsc#1179014)
• rpm/kernel-binary.spec.in: avoid using more barewords (bsc#1179014) %split_extra still contained two.
• rpm/kernel-binary.spec.in: Fix compressed module handling for in-tree KMP (jsc#SLE-10886)
• rpm/kernel-binary.spec.in: use grep -E instead of egrep (bsc#1179045) egrep is only a deprecated bash wrapper for 'grep -E'. So use the latter instead.
• rpm/kernel-module-subpackage: make Group tag optional (bsc#1163592)
• rpm/kernel-obs-build.spec.in: Add -q option to modprobe calls (bsc#1178401)
• rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).
• rpm/mkspec: do not build kernel-obs-build on x86_32 We want to use 64bit kernel due to various bugs (bsc#1178762 to name one). There is: ExportFilter: ^kernel-obs-build.*.x86_64.rpm$ . i586 in Factory's prjconf now. No other actively maintained distro (i.e. merging packaging branch) builds a x86_32 kernel, hence pushing to packaging directly.
• rpm/post.sh: Avoid purge-kernel for the first installed kernel (bsc#1180058)
• scripts/lib/SUSE/MyBS.pm: properly close prjconf Macros: section
• scsi: fc: add FPIN ELS definition (bsc#1181441).
• scsi/fc: kABI fixes for new ELS_FPIN definition (bsc#1181441)
• scsi: fc: Update Descriptor definition and add RDF and Link Integrity FPINs (bsc#1181441).
• scsi: Fix trivial spelling (bsc#1181441).
• scsi: qla2xxx: Add IOCB resource tracking (bsc#1181441).
• scsi: qla2xxx: Add more BUILD_BUG_ON() statements (bsc#1181441).
• scsi: qla2xxx: Address a set of sparse warnings (bsc#1181441).
• scsi: qla2xxx: Add rport fields in debugfs (bsc#1181441).
• scsi: qla2xxx: Add SLER and PI control support (bsc#1181441).
• scsi: qla2xxx: Allow dev_loss_tmo setting for FC-NVMe devices (bsc#1181441).
• scsi: qla2xxx: Allow ql2xextended_error_logging special value 1 to be set anytime (bsc#1181441).
• scsi: qla2xxx: Cast explicitly to uint16_t / uint32_t (bsc#1181441).
• scsi: qla2xxx: Change in PUREX to handle FPIN ELS requests (bsc#1181441).
• scsi: qla2xxx: Change post del message from debug level to log level (bsc#1181441).
• scsi: qla2xxx: Change {RD,WRT}REG*() function names from upper case into lower case (bsc#1181441).
• scsi: qla2xxx: Change two hardcoded constants into offsetof() / sizeof() expressions (bsc#1181441).
• scsi: qla2xxx: Check if FW supports MQ before enabling (bsc#1181441).
• scsi: qla2xxx: Check the size of struct fcp_hdr at compile time (bsc#1181441).
• scsi: qla2xxx: Correct the check for sscanf()…

The SUSE Linux Enterprise 15 SP1 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• btrfs: Cleanup try_flush_qgroup (bsc#1182047).
• btrfs: Do not flush from btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve (bsc#1182130)
• btrfs: Free correct amount of space in btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: Remove btrfs_inode from btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: Simplify code flow in btrfs_delayed_inode_reserve_metadata (bsc#1182047).
• btrfs: Unlock extents in btrfs_zero_range in case of errors (bsc#1182047).
• Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() (git-fixes).
• ibmvnic: fix a race between open and reset (bsc#1176855 ltc#187293).
• kernel-binary.spec: Add back initrd and image symlink ghosts to filelist (bsc#1182140). Fixes: 76a9256314c3 ('rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).')
• libnvdimm/dimm: Avoid race between probe and available_slots_show() (bsc#1170442).
• net: bcmgenet: add support for ethtool rxnfc flows (git-fixes).
• net: bcmgenet: code movement (git-fixes).
• net: bcmgenet: fix mask check in bcmgenet_validate_flow() (git-fixes).
• net: bcmgenet: Fix WoL with password after deep sleep (git-fixes).
• net: bcmgenet: re-remove bcmgenet_hfb_add_filter (git-fixes).
• net: bcmgenet: set Rx mode before starting netif (git-fixes).
• net: bcmgenet: use __be16 for htons(ETH_P_IP) (git-fixes).
• net: bcmgenet: Use correct I/O accessors (git-fixes).
• net: lpc-enet: fix error return code in lpc_mii_init() (git-fixes).
• net/mlx4_en: Handle TX error CQE (bsc#1181854).
• net: moxa: Fix a potential double 'free_irq()' (git-fixes).
• net: sun: fix missing release regions in cas_init_one() (git-fixes).
• nvme-multipath: Early exit if no path is available (bsc#1180964).
• rpm/post.sh: Avoid purge-kernel for the first installed kernel (bsc#1180058)
• scsi: target: fix unmap_zeroes_data boolean initialisation (bsc#1163617).
• usb: dwc2: Abort transaction after errors with unknown reason (bsc#1180262).
• usb: dwc2: Do not update data length if it is 0 on inbound transfers (bsc#1180262).
• usb: dwc2: Make 'trimming xfer length' a debug message (bsc#1180262).
• vmxnet3: Remove buf_info from device accessible structures (bsc#1181671).
• xen/netback: avoid race in xenvif_rx_ring_slots_available() (bsc#1065600).
• xen/netback: fix spurious event detection for common event case (bsc#1182175).

The SUSE Linux Enterprise 15 SP2 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).
• CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).
• CVE-2020-12364: Fixed a null pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).
• CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• ACPICA: Fix exception code class checks (git-fixes).
• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 2) (git-fixes).
• ALSA: hda: Add another CometLake-H PCI ID (git-fixes).
• ALSA: hda/hdmi: Drop bogus check at closing a stream (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• ALSA: pcm: Assure sync with the pending stop operation at suspend (git-fixes).
• ALSA: pcm: Call sync_stop at disconnection (git-fixes).
• ALSA: pcm: Do not call sync_stop if it hasn't been stopped (git-fixes).
• ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 (git-fixes).
• ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() (git-fixes).
• ALSA: usb-audio: Do not avoid stopping the stream at disconnection (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• ALSA: usb-audio: Handle invalid running state at releasing EP (git-fixes).
• ALSA: usb-audio: More strict state change in EP (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• ASoC: cpcap: fix microphone timeslot mask (git-fixes).
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ASoC: simple-card-utils: Fix device module clock (git-fixes).
• ASoC: SOF: debug: Fix a potential issue on string buffer termination (git-fixes).
• ata: ahci_brcm: Add back regulators management (git-fixes).
• ata: sata_nv: Fix retrieving of active qcs (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• bcache: fix overflow in offset_to_stripe() (git-fixes).
• blk-mq: call commit_rqs while list empty but error happen (bsc#1182442).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (bsc#1182443).
• blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (bsc#1182444).
• block: fix inflight statistics of part0 (bsc#1182445).
• block: respect queue limit of max discard segment (bsc#1182441).
• block: virtio_blk: fix handling single range discard request (bsc#1182439).
• Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• kernel-{binary,source}.spec.in: do not create loop symlinks (bsc#1179082)
• kernel-source.spec: Fix build with rpm 4.16 (boo#1179015).
• rpm/kernel-binary.spec.in: avoid using barewords (bsc#1179014)
• rpm/kernel-binary.spec.in: avoid using more barewords (bsc#1179014) %split_extra still contained two.
• rpm/kernel-binary.spec.in: Fix compressed module handling for in-tree KMP (jsc#SLE-10886) The in-tree KMP that is built with SLE kernels have a different scriptlet that is embedded in kernel-binary.spec.in rather than *.sh files.
• rpm/kernel-binary.spec.in: use grep -E instead of egrep (bsc#1179045) egrep is only a deprecated bash wrapper for 'grep -E'. So use the latter instead.
• rpm/kernel-module-subpackage: make Group tag optional (bsc#1163592)
• rpm/kernel-obs-build.spec.in: Add -q option to modprobe calls (bsc#1178401)
• rpm/kernel-{source,binary}.spec: do not include ghost symlinks (boo#1179082).
• rpm/mkspec: do not build kernel-obs-build on x86_32 We want to use 64bit kernel due to various bugs (bsc#1178762 to name one).
• rpm/post.sh: Avoid purge-kernel for the first installed kernel (bsc#1180058)
• xen/netback: avoid race in xenvif_rx_ring_slots_available() (bsc#1065600).
• xen/netback: fix spurious event detection for common event case (bsc#1182175).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747). by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#178372).
• CVE-2020-12362: Fixed an integer overflow in the firmware which may have allowed a privileged user to potentially enable an escalation of privilege via local access (bsc#1181720).
• CVE-2020-12363: Fixed an improper input validation which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181735).
• CVE-2020-12364: Fixed a null pointer reference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181736 ).
• CVE-2020-12373: Fixed an expired pointer dereference which may have allowed a privileged user to potentially enable a denial of service via local access (bsc#1181738).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).

The following non-security bugs were fixed:

• ACPI: configfs: add missing check after configfs_register_default_group() (git-fixes).
• ACPI: property: Fix fwnode string properties matching (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 1) (git-fixes).
• ACPI: property: Satisfy kernel doc validator (part 2) (git-fixes).
• ALSA: hda: Add another CometLake-H PCI ID (git-fixes).
• ALSA: hda/hdmi: Drop bogus check at closing a stream (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• ALSA: pcm: Assure sync with the pending stop operation at suspend (git-fixes).
• ALSA: pcm: Call sync_stop at disconnection (git-fixes).
• ALSA: pcm: Do not call sync_stop if it hasn't been stopped (git-fixes).
• ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 (git-fixes).
• ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() (git-fixes).
• ALSA: usb-audio: Do not avoid stopping the stream at disconnection (git-fixes).
• ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode (git-fixes).
• ALSA: usb-audio: Handle invalid running state at releasing EP (git-fixes).
• ALSA: usb-audio: More strict state change in EP (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• arm64: Update config file. Set CONFIG_WATCHDOG_SYSFS to true (bsc#1182560)
• ASoC: cpcap: fix microphone timeslot mask (git-fixes).
• ASoC: cs42l56: fix up error handling in probe (git-fixes).
• ASoC: simple-card-utils: Fix device module clock (git-fixes).
• ASoC: SOF: debug: Fix a potential issue on string buffer termination (git-fixes).
• ata: ahci_brcm: Add back regulators management (git-fixes).
• ata: sata_nv: Fix retrieving of active qcs (git-fixes).
• ath10k: Fix error handling in case of CE pipe init failure (git-fixes).
• ath9k: fix data bus crash when setting nf_override via debugfs (git-fixes).
• bcache: fix overflow in offset_to_stripe() (git-fixes).
• blk-mq: call commit_rqs while list empty but error happen (bsc#1182442).
• blk-mq: insert request not through ->queue_rq into sw/scheduler queue (bsc#1182443).
• blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (bsc#1182444).
• block: fix inflight statistics of part0 (bsc#1182445).
• block: respect queue limit of max discard segment (bsc#1182441).
• block: virtio_blk: fix handling single range discard request (bsc#1182439).
• Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in the probe function (git-fixes).
• Bluetooth: btusb: Fix memory leak in…

This update for the Linux Kernel 4.12.14-122_60 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).

This update for the Linux Kernel 4.12.14-197_78 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2021-0342: Fixed a potential memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges required (bsc#1180859).

This update for the Linux Kernel 4.12.14-197_75 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).
• CVE-2021-0342: Fixed a potential memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges required (bsc#1180859).

This update for the Linux Kernel 4.12.14-95_54 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• Fixed an issue where NFS client filesystems got unmounted on fail-over (bsc#1182468).
• Fixed an issue where NFS client hanged on write errors (bsc#1182108).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).

This update for the Linux Kernel 4.12.14-95_48 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• Fixed an issue where NFS client filesystems got unmounted on fail-over (bsc#1182468).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).

This update for the Linux Kernel 5.3.18-24_46 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).

This update for the Linux Kernel 5.3.18-24_43 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).

This update for the Linux Kernel 5.3.18-24_9 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• Fixed an issue where NFS client filesystems got unmounted on fail-over (bsc#1182468).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).

This update for the Linux Kernel 5.3.18-22 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• Fixed an issue where NFS client filesystems got unmounted on fail-over (bsc#1182468).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).
• CVE-2021-0342: Fixed a potential memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges required (bsc#1180859).

This update for the Linux Kernel 4.12.14-197_34 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• Fixed an issue where NFS client filesystems got unmounted on fail-over (bsc#1182468).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).
• CVE-2021-0342: Fixed a potential memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges required (bsc#1180859).

This update for the Linux Kernel 4.12.14-197_45 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• Fixed an issue where NFS client filesystems got unmounted on fail-over (bsc#1182468).
• Fixed an issue where NFS client hanged on write errors (bsc#1182108).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).
• CVE-2021-0342: Fixed a potential memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges required (bsc#1180859).

This update for the Linux Kernel 4.12.14-197_83 fixes one issue.

The following security issue was fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).

This update for the Linux Kernel 4.12.14-150_52 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2021-3347: Fixed a use-after-free in the PI futexes during fault handling, allowing local users to execute code in the kernel (bsc#1181553).
• CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation (bsc#1179616).
• CVE-2020-28374: Fixed insufficient identifier checking in the LIO SCSI target code which could have been used by remote attackers to read or write files via directory traversal in an XCOPY request (bsc#1178684).

This update for the Linux Kernel 5.3.18-24_49 fixes several issues.

The following security issues were fixed:

• CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179664).
• CVE-2020-29373: Fixed an issue where kernel unsafely handles the root directory during path lookups, and thus a process inside a mount namespace could escape to unintended filesystem locations (bsc#1179779).

This update for the Linux Kernel 4.12.14-122_63 fixes several issues.

The following security issues were fixed:

• CVE-2021-27365: Fixed an issue where data structures did not have appropriate length constraints or checks, and could exceed the PAGE_SIZE value (bsc#1183491).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1183120).
• CVE-2021-27364: Fixed an issue where an unprivileged user could craft Netlink messages (bsc#1182717).
• CVE-2020-29368: Fixed a race condition in a THP mapcount check (bsc#1179664).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).
• CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).
• CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).
• CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).
• CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).
• CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).
• CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).
• CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).
• CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).
• CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).
• CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).
• CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).
• CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).
• CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).
• CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).
• CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).
• CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).

The following non-security bugs were fixed:

• ACPI: scan: Rearrange memory allocation in acpi_device_add() (git-fixes).
• ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits (git-fixes).
• ALSA: hda: Drop the BATCH workaround for AMD controllers (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886 (git-fixes).
• amba: Fix resource leak for drivers without .remove (git-fixes).
• bfq: Fix kABI for update internal depth state…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).
• CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).
• CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).
• CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).
• CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).
• CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).
• CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).
• CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).
• CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).
• CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).
• CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).
• CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).
• CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).
• CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).
• CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).
• CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check (bsc#1179660, bsc#1179428).
• CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).
• CVE-2020-27673: Fixed a potential denial of service at high rate of events to dom0, aka CID-e99502f76271 (bsc#1177411 ).

The following non-security bugs were fixed:

• ACPI: scan: Rearrange memory allocation in acpi_device_add() (git-fixes).
• ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits (git-fixes).
• ALSA: hda: Drop the BATCH workaround for AMD controllers (git-fixes).
• ALSA: hda/realtek: modify EAPD in the ALC886…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184170).
• CVE-2021-3428: Fixed an integer overflow in ext4_es_cache_extent (bsc#1173485).
• CVE-2021-29647: Fixed an issue in qrtr_recvmsg which could have allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bsc#1184192 ).
• CVE-2021-29265: Fixed an issue in usbip_sockfd_store which could have allowed attackers to cause a denial of service due to race conditions during an update of the local and shared status (bsc#1184167).
• CVE-2021-29264: Fixed an issue in the Freescale Gianfar Ethernet driver which could have allowed attackers to cause a system crash due to a calculation of negative fragment size (bsc#1184168).
• CVE-2021-28972: Fixed a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly (bsc#1184198).
• CVE-2021-28971: Fixed an issue in intel_pmu_drain_pebs_nhm which could have caused a system crash because the PEBS status in a PEBS record was mishandled (bsc#1184196 ).
• CVE-2021-28964: Fixed a race condition in get_old_root which could have allowed attackers to cause a denial of service (bsc#1184193).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc#1183646).
• CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183593 ).
• CVE-2021-28038: Fixed an issue with the netback driver which was lacking necessary treatment of errors such as failed memory allocations (bsc#1183022).
• CVE-2021-27365: Fixed an issue where an unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bsc#1182715).
• CVE-2021-27364: Fixed an issue where an attacker could craft Netlink messages (bsc#1182717).
• CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1182716).
• CVE-2021-26932: Fixed improper error handling issues in Linux grant mapping (XSA-361 bsc#1181747).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1181753).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1181843).
• CVE-2020-35519: Fixed an out-of-bounds memory access was found in x25_bind (bsc#1183696).
• CVE-2020-29368,CVE-2020-29374: Fixed an issue in copy-on-write implementation which could have granted unintended write access (bsc#1179660, bsc#1179428).
• CVE-2020-27815: Fixed an issue in JFS filesystem where could have allowed an attacker to execute code (bsc#1179454).
• CVE-2020-27171: Fixed an off-by-one error affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183775).
• CVE-2020-27170: Fixed potential side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bsc#1183686).
• CVE-2020-0433: Fixed a use after free due to improper locking which could have led to local escalation of privilege (bsc#1176720).
• CVE-2021-3483: Fixed a use-after-free in nosy.c (bsc#1184393).
• CVE-2021-30002: Fixed a memory leak for large arguments in video_usercopy (bsc#1184120).
• CVE-2021-29154: Fixed incorrect computation of branch displacements, allowing arbitrary code execution (bsc#1184391).
• CVE-2021-20219: Fixed a denial of service in n_tty_receive_char_special (bsc#1184397).
• CVE-2020-36311: Fixed a denial of service (soft lockup) by triggering destruction of a large SEV VM (bsc#1184511).
• CVE-2020-25670,…

Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. (CVE-2020-10135)

Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-14314)

It was discovered that the block layer implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2020-15436)

It was discovered that the serial port driver in the Linux kernel did not properly initialize a pointer in some situations. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2020-15437)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

It was discovered that the NFS client implementation in the Linux kernel did not properly perform bounds checking before copying security labels in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)

It was discovered that the Rados block device (rbd) driver in the Linux kernel did not properly perform privilege checks for access to rbd devices in some situations. A local attacker could use this to map or unmap rbd block devices. (CVE-2020-25284)

It was discovered that the block layer subsystem in the Linux kernel did not properly handle zero-length requests. A local attacker could use this to cause a denial of service. (CVE-2020-25641)

It was discovered that the HDLC PPP implementation in the Linux kernel did not properly validate input in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25643)

Kiyin (尹亮) discovered that the perf subsystem in the Linux kernel did not properly deallocate memory in some situations. A privileged attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2020-25704)

It was discovered that the KVM hypervisor in the Linux kernel did not properly handle interrupts in certain situations. A local attacker in a guest VM could possibly use this to cause a denial of service (host system crash). (CVE-2020-27152)

It was discovered that the jfs file system implementation in the Linux kernel contained an out-of-bounds read vulnerability. A local attacker could use this to possibly cause a denial of service (system crash). (CVE-2020-27815)

It was discovered that an information leak existed in the syscall implementation in the Linux kernel on 32 bit systems. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28588)

It was discovered that the framebuffer implementation in the Linux kernel did not properly perform range checks in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2020-28915)

Jann Horn discovered a race condition in the copy-on-write implementation in the Linux kernel when handling hugepages. A local attacker could use this to gain unintended write access to read-only memory pages. (CVE-2020-29368)

Jann Horn discovered that the mmap implementation in the Linux kernel contained a race…