The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
CVE-2021-20177: Fixed a kernel panic related to iptables string matching rules. A privileged user could insert a rule which could lead to denial of service (bnc#1180765).
CVE-2021-0342: In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges required. (bnc#1180812)
CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846).
CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509).
CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508).
CVE-2020-36158: Fixed an issue wich might have allowed a remote attackers to execute arbitrary code via a long SSID value in mwifiex_cmd_802_11_ad_hoc_start() (bnc#1180559).
CVE-2020-28374: Fixed a vulnerability caused by insufficient identifier checking in the LIO SCSI target code. This could have been used by a remote attackers to read or write files via directory traversal in an XCOPY request (bnc#1178372).
The following non-security bugs were fixed:
ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 (git-fixes).
ACPICA: Do not increment operation_region reference counts for field units (git-fixes).
ACPI: PNP: compare the string length in the matching_id() (git-fixes).
ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI (git-fixes).
ACPI: scan: Harden acpi_device_add() against device ID overflows (git-fixes).
ACPI: scan: Make acpi_bus_get_device() clear return pointer on error (git-fixes).
drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check() (bsc#1129770) Backporting changes: * context changes * moved num_mixers from struct dpu_crtc_state to struct dpu_crtc
drm/msm: Fix use-after-free in msm_gem with carveout (bsc#1129770) Backporting changes: * context changes * removed reference to msm_gem_is_locked()
ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() (git-fixes).
fbcon: Fix user font detection test at fbcon_resize(). (bsc#1112178) Backporting changes: * updated path drivers/video/fbcon/core to drivers/video/console
fbcon: Remove the superfluous break (bsc#1129770) Backporting changes: * updated path drivers/video/fbcon/core to drivers/video/console * context changes
firmware: qcom: scm: Ensure 'a0' status code is treated as signed (git-fixes).
floppy: reintroduce O_NDELAY fix (boo#1181018).
futex: Do not enable IRQs unconditionally in put_pi_state() (bsc#1149032).
futex: Ensure the correct return value from futex_lock_pi() (bsc#1181349 bsc#1149032).