SUSE-SU-2021:1891-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2021/suse-su-20211891-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:1891-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2021:1891-1

Related

Published

2021-06-08T13:09:12Z

Modified

2021-06-08T13:09:12Z

Summary

Security update for the Linux Kernel

Details

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

CVE-2021-33200: Enforcing incorrect limits for pointer arithmetic operations by the BPF verifier could be abused to perform out-of-bounds reads and writes in kernel memory (bsc#1186484).
CVE-2021-33034: Fixed a use-after-free when destroying an hci_chan. This could lead to writing an arbitrary values. (bsc#1186111)
CVE-2020-26139: Fixed a denial-of-service when an Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. (bnc#1186062)
CVE-2021-23134: A Use After Free vulnerability in nfc sockets allowed local attackers to elevate their privileges. (bnc#1186060)
CVE-2021-23133: Fixed a race condition in SCTP sockets, which could lead to privilege escalation from the context of a network service or an unprivileged process. (bnc#1184675)
CVE-2021-3491: Fixed a potential heap overflow in memrw(). This vulnerability is related to the PROVIDEBUFFERS operation, which allowed the MAXRWCOUNT limit to be bypassed (bsc#1185642).
CVE-2021-32399: Fixed a race condition when removing the HCI controller (bnc#1184611).
CVE-2020-24586: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances this can be abused to inject arbitrary network packets and/or exfiltrate user data (bnc#1185859).
CVE-2020-24587: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed (bnc#1185859 bnc#1185862).
CVE-2020-26147: The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments, even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used (bnc#1185859).
CVE-2020-26145: An issue was discovered with Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. (bnc#1185860)
CVE-2020-26141: An issue was discovered in the ALFA driver for AWUS036H, where the Message Integrity Check (authenticity) of fragmented TKIP frames was not verified. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bnc#1185987)

The following non-security bugs were fixed:

Drivers: hv: vmbus: Increase wait time for VMbus unload (bsc#1185724).
Drivers: hv: vmbus: Initialize unload_event statically (bsc#1185724).
afpacket: fix the tx skb protocol in raw sockets with ETHP_ALL (bsc#1176081).
ibmvfc: Avoid move login if fast fail is enabled (bsc#1185938 ltc#192043).
ibmvfc: Handle move login failure (bsc#1185938 ltc#192043).
ibmvfc: Reinit target retries (bsc#1185938 ltc#192043).
kABI: Fix kABI after modifying struct _callsingle_data (bsc#1180846).
kabi: preserve struct header_ops after bsc#1176081 fix (bsc#1176081).
kernel/smp: Provide CSD lock timeout diagnostics (bsc#1180846).
kernel/smp: add boot parameter for controlling CSD lock debugging (bsc#1180846).
kernel/smp: add more data to CSD lock debugging (bsc#1180846).
kernel/smp: make csdlock timeout depend on boot parameter (bsc#1180846).
kernel/smp: prepare more CSD lock debugging (bsc#1180846).
md/raid1: properly indicate failure when ending a failed write request (bsc#1185680).
net/ethernet: Add parseprotocol headerops support (bsc#1176081).
net/mlx5e: Remove the wrong assumption about transport offset (bsc#1176081).
net/mlx5e: Trust kernel regarding transport offset (bsc#1176081).
net/packet: Ask driver for protocol if not provided by user (bsc#1176081).
net/packet: Remove redundant skb->protocol set (bsc#1176081).
net: Do not set transport offset to invalid value (bsc#1176081).
net: Introduce parseprotocol headerops callback (bsc#1176081).
netfilter: conntrack: add new sysctl to disable RST check (bsc#1183947 bsc#1185950).
netfilter: conntrack: avoid misleading 'invalid' in log message (bsc#1183947 bsc#1185950).
netfilter: conntrack: improve RST handling when tuple is re-used (bsc#1183947 bsc#1185950).
netfilter: conntrack: tcp: only close if RST matches exact sequence (bsc#1183947 bsc#1185950).
s390/entry: save the caller of psw_idle (bsc#1185677).
smp: Add source and destination CPUs to _callsingle_data (bsc#1180846).
video: hyperv_fb: Add ratelimit on error message (bsc#1185724).

References

Affected packages

SUSE:OpenStack Cloud 9 / kernel-default

Package

Name: kernel-default
Purl: purl:rpm/suse/kernel-default&distro=SUSE%20OpenStack%20Cloud%209

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:OpenStack Cloud 9 / kernel-source

Package

Name: kernel-source
Purl: purl:rpm/suse/kernel-source&distro=SUSE%20OpenStack%20Cloud%209

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:OpenStack Cloud 9 / kernel-syms

Package

Name: kernel-syms
Purl: purl:rpm/suse/kernel-syms&distro=SUSE%20OpenStack%20Cloud%209

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:OpenStack Cloud Crowbar 9 / kernel-default

Package

Name: kernel-default
Purl: purl:rpm/suse/kernel-default&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:OpenStack Cloud Crowbar 9 / kernel-source

Package

Name: kernel-source
Purl: purl:rpm/suse/kernel-source&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:OpenStack Cloud Crowbar 9 / kernel-syms

Package

Name: kernel-syms
Purl: purl:rpm/suse/kernel-syms&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise High Availability Extension 12 SP4 / kernel-default

Package

Name: kernel-default
Purl: purl:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "dlm-kmp-default": "4.12.14-95.77.1",
            "gfs2-kmp-default": "4.12.14-95.77.1",
            "ocfs2-kmp-default": "4.12.14-95.77.1",
            "cluster-md-kmp-default": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise Live Patching 12 SP4 / kernel-default

Package

Name: kernel-default
Purl: purl:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kgraft-patch-4_12_14-95_77-default": "1-6.3.1",
            "kernel-default-kgraft": "4.12.14-95.77.1",
            "kernel-default-kgraft-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise Live Patching 12 SP4 / kgraft-patch-SLE12-SP4_Update_21

Package

Name: kgraft-patch-SLE12-SP4_Update_21
Purl: purl:rpm/suse/kgraft-patch-SLE12-SP4_Update_21&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1-6.3.1

Ecosystem specific

{
    "binaries": [
        {
            "kgraft-patch-4_12_14-95_77-default": "1-6.3.1",
            "kernel-default-kgraft": "4.12.14-95.77.1",
            "kernel-default-kgraft-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP4 / kernel-default

Package

Name: kernel-default
Purl: purl:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP4 / kernel-source

Package

Name: kernel-source
Purl: purl:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP4 / kernel-syms

Package

Name: kernel-syms
Purl: purl:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP4-LTSS / kernel-default

Package

Name: kernel-default
Purl: purl:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default-man": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP4-LTSS / kernel-source

Package

Name: kernel-source
Purl: purl:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default-man": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP4-LTSS / kernel-syms

Package

Name: kernel-syms
Purl: purl:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-95.77.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-macros": "4.12.14-95.77.1",
            "kernel-devel": "4.12.14-95.77.1",
            "kernel-default-base": "4.12.14-95.77.1",
            "kernel-default-man": "4.12.14-95.77.1",
            "kernel-default": "4.12.14-95.77.1",
            "kernel-source": "4.12.14-95.77.1",
            "kernel-syms": "4.12.14-95.77.1",
            "kernel-default-devel": "4.12.14-95.77.1"
        }
    ]
}