CVE-2021-4001

A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.

This kernel update is based on upstream 5.15.6 and fixes at least the following security issues:

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver) (CVE-2020-27820).

A race condition when the eBPF map is frozen (CVE-2021-4001).

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data (CVE-2021-4002).

In addition to the upstream changes, we also have added the following fixes:

• ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile
• cpufreq: intel_pstate: ITMT support for overclocked system
• Revert "drm/i915: Implement Wa_1508744258"
• drm/i915/adl-n: Enable Alder Lake N platform
• hwmon: (asus_wmi_sensors) Support X370 Asus WMI
• hwmon: (asus_wmi_ec_sensors) Support B550 Asus WMI
• hwmon: (k10temp) Support up to 12 CCDs on AMD Family of processors
• hwmon: (nct6775) Use superio_*() function pointers in sio_data
• hwmon: (nct6775) Use nct6775_*() function pointers in nct6775_data
• hwmon: (nct6775) Support access via Asus WMI
• hwmon: (nct6775) Add additional ASUS motherboards
• hwmon: (nct6775) add Pro WS X570-ACE
• hwmon: (nct6775) add ProArt X570-CREATOR WIFI
• mmc: sdhci-pci: Add PCI ID for Intel ADL
• pinctrl: amd: Fix wakeups when IRQ is shared with SC
• rt2x00: do not mark device gone on EPROTO errors during start
• xhci: Fix commad ring abort, write all 64 bits to CRCR register

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.6 and fixes at least the following security issues:

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver) (CVE-2020-27820).

A race condition when the eBPF map is frozen (CVE-2021-4001).

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data (CVE-2021-4002).

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bnc#1192877)

The following non-security bugs were fixed:

• ACPI: battery: Accept charges over the design capacity as full (git-fixes).
• ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• ACPICA: Avoid evaluating methods too early during system resume (git-fixes).
• ALSA: ctxfi: Fix out-of-range access (git-fixes).
• ALSA: gus: fix null pointer dereference on pointer block (git-fixes).
• ALSA: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• ALSA: ISA: not for M68K (git-fixes).
• ALSA: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• ALSA: timer: Fix use-after-free problem (git-fixes).
• ALSA: timer: Unconditionally unlink slave instances, too (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• ARM: 8970/1: decompressor: increase tag size (git-fixes).
• ARM: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• ARM: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe (git-fixes)
• ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores (git-fixes)
• ARM: 9064/1: hw_breakpoint: Do not directly check the event's (git-fixes)
• ARM: 9071/1: uprobes: Do not hook on thumb…

The SUSE Linux Enterprise 15 SP3 kernel was updated

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573) You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

The following security bugs were fixed:

• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)

The following non-security bugs were fixed:

• ACPI: battery: Accept charges over the design capacity as full (git-fixes).
• ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• ACPICA: Avoid evaluating methods too early during system resume (git-fixes).
• Add SMB 2 support for getting and setting SACLs (bsc#1192606).
• Add to supported.conf: fs/smbfs_common/cifs_arc4 fs/smbfs_common/cifs_md4
• ALSA: ctxfi: Fix out-of-range access (git-fixes).
• ALSA: gus: fix null pointer dereference on pointer block (git-fixes).
• ALSA: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• ALSA: ISA: not for M68K (git-fixes).
• ALSA: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• ALSA: timer: Fix use-after-free problem (git-fixes).
• ALSA: timer: Unconditionally unlink slave instances, too (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• ARM: 8970/1: decompressor: increase tag size (git-fixes).
• ARM: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• ARM: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• ARM: 9019/1:…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bnc#1192877)

The following non-security bugs were fixed:

• ACPI: battery: Accept charges over the design capacity as full (git-fixes).
• ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• ACPICA: Avoid evaluating methods too early during system resume (git-fixes).
• ALSA: ctxfi: Fix out-of-range access (git-fixes).
• ALSA: gus: fix null pointer dereference on pointer block (git-fixes).
• ALSA: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• ALSA: ISA: not for M68K (git-fixes).
• ALSA: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• ALSA: timer: Fix use-after-free problem (git-fixes).
• ALSA: timer: Unconditionally unlink slave instances, too (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• ARM: 8970/1: decompressor: increase tag size (git-fixes).
• ARM: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• ARM: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe (git-fixes)
• ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores (git-fixes)
• ARM: 9064/1: hw_breakpoint: Do not directly check the event's (git-fixes)
• ARM: 9071/1: uprobes: Do not hook on thumb…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that could allow an authenticate user to cause a denial of service (bnc#1192877).
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).

The following non-security bugs were fixed:

• acpi: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• acpi: battery: Accept charges over the design capacity as full (git-fixes).
• acpica: Avoid evaluating methods too early during system resume (git-fixes).
• alsa: ISA: not for M68K (git-fixes).
• alsa: ctxfi: Fix out-of-range access (git-fixes).
• alsa: gus: fix null pointer dereference on pointer block (git-fixes).
• alsa: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• alsa: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• alsa: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• alsa: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• alsa: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• alsa: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• alsa: timer: Fix use-after-free problem (git-fixes).
• alsa: timer: Unconditionally unlink slave instances, too (git-fixes).
• alsa: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• arm: 8970/1: decompressor: increase tag size (git-fixes).
• arm: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• arm: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• arm: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• arm: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe (git-fixes)
• arm: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores (git-fixes)
• arm: 9064/1: hw_breakpoint: Do not directly check…

The SUSE Linux Enterprise 15 SP3 kernel was updated

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573) You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

The following security bugs were fixed:

• CVE-2021-45485: Fixed an information leak because of certain use of a hash table which use IPv6 source addresses. (bsc#1194094)
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c. (bnc#1194087).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2020-24504: Fixed an uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers that may have allowed an authenticated user to potentially enable denial of service via local access. (bnc#1182404)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device. (bnc#1179599)

The following non-security bugs were fixed:

• ACPI: battery: Accept charges over the design capacity as full (git-fixes).
• ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• ACPICA: Avoid evaluating methods too early during system resume (git-fixes).
• Add SMB 2 support for getting and setting SACLs (bsc#1192606).
• Add to supported.conf: fs/smbfs_common/cifs_arc4 fs/smbfs_common/cifs_md4
• ALSA: ctxfi: Fix out-of-range access (git-fixes).
• ALSA: gus: fix null pointer dereference on pointer block (git-fixes).
• ALSA: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• ALSA: ISA: not for M68K (git-fixes).
• ALSA: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• ALSA: timer: Fix use-after-free problem (git-fixes).
• ALSA: timer: Unconditionally unlink slave instances, too (git-fixes).
• ALSA: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• ARM: 8970/1: decompressor: increase tag size (git-fixes).
• ARM: 8974/1: use SPARSMEM_STATIC when SPARSEMEM is enabled (git-fixes)
• ARM: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• ARM: 9019/1:…

The SUSE MicroOS 5.0 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen. (bsc#1192990)
• CVE-2021-4002: Added a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2021-28711: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening blkfront against event channel storms. (bsc#1193440)
• CVE-2021-28712: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening netfront against event channel storms. (bsc#1193440)
• CVE-2021-28713: Fixed a rogue backends that could cause DoS of guests via high frequency events by hardening hvc_xen against event channel storms. (bsc#1193440)
• CVE-2021-28714: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by fixing rx queue stall detection. (bsc#1193442)
• CVE-2021-28715: Fixed an issue where a guest could force Linux netback driver to hog large amounts of kernel memory by do not queueing unlimited number of packages. (bsc#1193442)
• CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that could allow an authenticate user to cause a denial of service (bnc#1192877).
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bnc#1192845)
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)

The following non-security bugs were fixed:

• acpi: battery: Accept charges over the design capacity as full (git-fixes).
• acpi: pmic: Fix intel_pmic_regs_handler() read accesses (git-fixes).
• acpica: Avoid evaluating methods too early during system resume (git-fixes).
• alsa: ISA: not for M68K (git-fixes).
• alsa: ctxfi: Fix out-of-range access (git-fixes).
• alsa: gus: fix null pointer dereference on pointer block (git-fixes).
• alsa: hda/realtek: Add a quirk for Acer Spin SP513-54N (git-fixes).
• alsa: hda/realtek: Add quirk for ASUS UX550VE (git-fixes).
• alsa: hda/realtek: Add quirk for Clevo PC70HS (git-fixes).
• alsa: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED (git-fixes).
• alsa: hda: hdac_ext_stream: fix potential locking issues (git-fixes).
• alsa: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() (git-fixes).
• alsa: synth: missing check for possible NULL after the call to kstrdup (git-fixes).
• alsa: timer: Fix use-after-free problem (git-fixes).
• alsa: timer: Unconditionally unlink slave instances, too (git-fixes).
• alsa: usb-audio: Add registration quirk for JBL Quantum 400 (git-fixes).
• arm: 8986/1: hw_breakpoint: Do not invoke overflow handler on uaccess watchpoints (git-fixes)
• arm: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT (git-fixes)
• arm: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe (git-fixes)
• arm: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores (git-fixes)
• arm: 9064/1: hw_breakpoint: Do not directly check the event's (git-fixes)
• arm: 9071/1: uprobes: Do not hook on thumb instructions (git-fixes)
• arm: 9081/1: fix gcc-10 thumb2-kernel regression (git-fixes)
• arm: 9091/1: Revert 'mm: qsd8x50: Fix incorrect permission faults' (git-fixes)
• arm: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned (git-fixes)
• arm: 9134/1: remove duplicate memcpy() definition (git-fixes)
• arm: 9139/1: kprobes: fix arch_init_kprobes() prototype (git-fixes)
• arm: 9141/1: only warn about XIP address when not compile testing (git-fixes)
• arm: 9155/1: fix early early_iounmap() (git-fixes)
• arm: OMAP2+: Fix legacy mode dss_reset (git-fixes)
• arm: OMAP2+: omap_device: fix idling of devices during probe (git-fixes)
• arm: at91: pm: add missing put_device() call in…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517).
• CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel that occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower privileged ones that could lead to privilege escalation (bsc#1194302).
• CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
• CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free memory corruption (bsc#1194529)
• CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges on the system. (bnc#1193727).
• CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
• CVE-2021-45485: The IPv6 implementation in net/ipv6/output_core.c had an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses (bnc#1194094).
• CVE-2021-45486: The IPv4 implementation in net/ipv4/route.c had an information leak because the hash table is very small (bnc#1194087).
• CVE-2021-4001: A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. (bnc#1192990).
• CVE-2021-28715: Guest can force Linux netback driver to hog large amounts of kernel memory. Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There was a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. ()
• CVE-2021-28714: Guest can force Linux netback driver to hog large amounts of kernel memory. Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There was a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing (bnc#1193442).
• CVE-2021-28713: Rogue backends can cause DoS of guests via high frequency…

This update for the Linux Kernel 5.3.18-59_16 fixes several issues.

The following security issues were fixed:

• CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen (bsc#1192990).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).

This update for the Linux Kernel 5.3.18-59_37 fixes several issues.

The following security issues were fixed:

• CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299).
• CVE-2021-4001: Fixed a race condition when the EBPF map is frozen (bsc#1192990).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

Nadav Amit discovered that the hugetlb implementation in the Linux kernel did not perform TLB flushes under certain conditions. A local attacker could use this to leak or alter data from other processes that use huge pages. (CVE-2021-4002)

It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

Luo Likang discovered that the FireDTV Firewire driver in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-42739)

It was discovered that the TIPC Protocol implementation in the Linux kernel did not properly validate MSG_CRYPTO messages in some situations. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-43267)

Jeremy Cline discovered a use-after-free in the nouveau graphics driver of the Linux kernel during device removal. A privileged or physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-27820)

It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3640)

Likang Luo discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3752)

It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs in some situations. A remote attacker could possibly use this to cause a denial of service (connection disassociation). (CVE-2021-3772)

It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

It was discovered that the NFS server implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4090)

Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly handle exit events from AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES) guest VMs. An attacker in a guest VM could use this to cause a denial of service (host kernel crash) or possibly execute arbitrary code in the host kernel. (CVE-2021-4093)

Lin Ma discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4202)

It was discovered that the AMD Radeon GPU driver in the Linux kernel did not properly validate writes in the debugfs file system. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-42327)

Luo Likang discovered that the FireDTV Firewire driver in the Linux kernel did not properly perform bounds checking in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-42739)

It was discovered that the rlimit tracking for user namespaces in the Linux kernel did not properly perform reference counting, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-24122)

It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in certain situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-23222)

Jeremy Cline discovered a use-after-free in the nouveau graphics driver of the Linux kernel during device removal. A privileged or physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-27820)

It was discovered that the Packet network protocol implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-22600)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28713)

Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service (excessive kernel memory consumption) in the network backend domain. (CVE-2021-28714, CVE-2021-28715)

Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-39685)

It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

It was discovered that the simulated networking device driver for the Linux kernel did not properly initialize memory in certain situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2021-4135)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not perform permission checks correctly in some situations. A local attacker could possibly use this to gain administrative privileges. (CVE-2021-4197)

Brendan Dolan-Gavitt discovered that the aQuantia AQtion Ethernet device driver in the Linux kernel did not properly validate meta-data coming from the device. A local attacker who can control an emulated device can use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-43975)

It was discovered that the ARM Trusted Execution Environment (TEE) subsystem in the Linux kernel contained a race condition leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-44733)

It was discovered that the Phone Network protocol (PhoNet) implementation in the Linux kernel did not properly perform reference counting in some error conditions. A local…

It was discovered that the eBPF implementation in the Linux kernel contained a race condition around read-only maps. A privileged attacker could use this to modify read-only maps. (CVE-2021-4001)

It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash collisions in connection lookup table. A remote attacker could use this to cause a denial of service (excessive CPU consumption). (CVE-2023-1206)

Yang Lan discovered that the GFS2 file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious GFS2 image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-3212)

Davide Ornaghi discovered that the DECnet network protocol implementation in the Linux kernel contained a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Please note that kernel support for the DECnet has been removed to resolve this CVE. (CVE-2023-3338)

It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2023-3863)

It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)