SUSE-SU-2021:1899-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2021/suse-su-20211899-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:1899-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2021:1899-1

Related

Published

2021-06-08T17:29:39Z

Modified

2021-06-08T17:29:39Z

Summary

Security update for the Linux Kernel

Details

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

CVE-2021-33200: Enforcing incorrect limits for pointer arithmetic operations by the BPF verifier could be abused to perform out-of-bounds reads and writes in kernel memory (bsc#1186484).
CVE-2021-33034: Fixed a use-after-free when destroying an hci_chan. This could lead to writing an arbitrary values. (bsc#1186111)
CVE-2020-26139: Fixed a denial-of-service when an Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. (bnc#1186062)
CVE-2021-23134: A Use After Free vulnerability in nfc sockets allowed local attackers to elevate their privileges. (bnc#1186060)
CVE-2021-3491: Fixed a potential heap overflow in memrw(). This vulnerability is related to the PROVIDEBUFFERS operation, which allowed the MAXRWCOUNT limit to be bypassed (bsc#1185642).
CVE-2021-32399: Fixed a race condition when removing the HCI controller (bnc#1184611).
CVE-2020-24586: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances this can be abused to inject arbitrary network packets and/or exfiltrate user data (bnc#1185859).
CVE-2020-24587: The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed (bnc#1185859 bnc#1185862).
CVE-2020-26147: The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments, even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used (bnc#1185859).
CVE-2020-26145: An issue was discovered with Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. (bnc#1185860)
CVE-2020-26141: An issue was discovered in the ALFA driver for AWUS036H, where the Message Integrity Check (authenticity) of fragmented TKIP frames was not verified. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bnc#1185987)
CVE-2021-23133: Fixed a race condition in SCTP sockets, which could lead to privilege escalation from the context of a network service or an unprivileged process. (bnc#1184675)

The following non-security bugs were fixed:

ACPI: CPPC: Replace cppcattr with kobjattribute (git-fixes).
ACPICA: Enable sleep button on ACPI legacy wake (bsc#1181383).
ALSA: aloop: Fix initialization of controls (git-fixes).
ALSA: core: remove redundant spinlock pair in sndcard_disconnect (git-fixes).
ALSA: usb-audio: Add error checks for usbdriverclaim_interface() calls (git-fixes).
ALSA: usb: midi: do not return -ENOMEM when usburbeptypecheck fails (git-fixes).
ARM: footbridge: fix PCI interrupt mapping (git-fixes).
ASoC: fsl_esai: Fix TDM slot setup for I2S mode (git-fixes).
ASoC: intel: atom: Stop advertising non working S24LE support (git-fixes).
ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips (git-fixes).
Avoid potentially erroneos RST drop (bsc#1183947).
Do not drop out of segments RST if tcpbeliberal is set (bsc#1183947).
Drivers: hv: vmbus: Increase wait time for VMbus unload (bsc#1185724).
Drivers: hv: vmbus: Initialize unload_event statically (bsc#1185724).
Drivers: hv: vmbus: Use after free in _vmbusopen() (git-fixes).
EDAC/amd64: Gather hardware information early (bsc#1180552).
EDAC/amd64: Make struct amd64familytype global (bsc#1180552).
EDAC/amd64: Save max number of controllers to family type (bsc#1180552).
HID: alps: fix error return code in alpsinputconfigured() (git-fixes).
HID: plantronics: Workaround for double volume key presses (git-fixes).
HID: wacom: Assign boolean values to a bool variable (git-fixes).
HID: wacom: set EVKEY and EVABS only for non-HID_GENERIC type of devices (git-fixes).
Input: i8042 - fix Pegatron C15B ID entry (git-fixes).
Input: nspire-keypad - enable interrupts only when opened (git-fixes).
KVM: s390: fix guarded storage control register handling (bsc#1133021).
NFSv4: Replace closed stateids with the 'invalid special stateid' (bsc#1185481).
PCI: Release OF node in pciscandevice()'s error path (git-fixes).
RDMA/hns: Delete redundant condition judgment related to eq (bsc#1104427).
RDMA/srpt: Fix error return code in srptcmreq_recv() (bsc#1103992).
SUNRPC in case of backlog, hand free slots directly to waiting task (bsc#1185428).
USB: serial: fix return value for unsupported ioctls (git-fixes).
USB: serial: usb_wwan: fix unprivileged TIOCCSERIAL (git-fixes).
afpacket: fix the tx skb protocol in raw sockets with ETHP_ALL (bsc#1176081).
ata: libahci_platform: fix IRQ check (git-fixes).
ath9k: Fix error check in ath9khwread_revisions() for PCI devices (git-fixes).
backlight: journada720: Fix Wmisleading-indentation warning (git-fixes).
batman-adv: Do not always reallocate the fragmentation skb head (git-fixes).
bluetooth: eliminate the potential race condition when removing the HCI controller (git-fixes).
bnxten: fix ternary sign extension bug in bnxtshow_temp() (bsc#1104745).
bpf: Fix masking negation logic upon negative dst register (git-fixes).
btrfs: fix race between transaction aborts and fsyncs leading to use-after-free (bsc#1186441).
btrfs: fix race when picking most recent mod log operation for an old root (bsc#1186439).
bus: qcom: Put child node before return (git-fixes).
cfg80211: remove WARNON() in cfg80211sme_connect (git-fixes).
clk: exynos7: Mark aclkfsys1200 as critical (git-fixes).
clk: fix invalid usage of list cursor in register (git-fixes).
clk: fix invalid usage of list cursor in unregister (git-fixes).
clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz (git-fixes).
clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 (git-fixes).
clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock (git-fixes).
clk: socfpga: fix iomem pointer cast on 64-bit (git-fixes).
clk: uniphier: Fix potential infinite loop (git-fixes).
cpufreq: Kconfig: fix documentation links (git-fixes).
cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (bsc#1185758).
crypto: qat - ADFSTATUSPFRUNNING should be set after adfdev_init (git-fixes).
crypto: qat - Fix a double free in adfcreatering (git-fixes).
crypto: qat - do not release uninitialized resources (git-fixes).
crypto: qat - fix error path in adfisrresource_alloc() (git-fixes).
cxgb4: Fix unintentional sign extension issues (bsc#1064802 bsc#1066129).
dm: fix redundant IO accounting for bios that need splitting (bsc#1183738).
dmaengine: dw: Make it dependent to HAS_IOMEM (git-fixes).
docs: kernel-parameters: Add gpiomockupnamed_lines (git-fixes).
docs: kernel-parameters: Move gpio-mockup for alphabetic order (git-fixes).
drivers: net: fix memory leak in atusb_probe (git-fixes).
drivers: net: fix memory leak in peakusbcreate_dev (git-fixes).
drm/amdkfd: fix build error with AMDIOMMUV2=m (git-fixes).
drm/i915/gvt: Fix error code in intelgvtinit_device() (git-fixes).
drm/imx: imx-ldb: fix out of bounds array access warning (git-fixes).
drm/omap: fix misleading indentation in pixinc() (git-fixes).
drm/radeon: fix copy of uninitialized variable back to userspace (git-fixes).
e1000e: Fix duplicate include guard (git-fixes).
e1000e: Fix error handling in e1000setd0lplustate_82571 (git-fixes).
e1000e: add rtnllock() to e1000reset_task (git-fixes).
ethernet:enic: Fix a use after free bug in enichardstart_xmit (bsc#1113431).
ftrace: Handle commands when closing setftracefilter file (git-fixes).
genirq: Reduce irqdebug cacheline bouncing (bsc#1185703 ltc#192641).
gianfar: Handle error code at MAC address change (git-fixes).
i2c: cadence: add IRQ check (git-fixes).
i2c: emev2: add IRQ check (git-fixes).
i2c: jz4780: add IRQ check (git-fixes).
i40e: Added Asym_Pause to supported link modes (git-fixes).
i40e: Fix PHY type identifiers for 2.5G and 5G adapters (jsc#SLE-4797).
i40e: Fix sparse errors in i40e_txrx.c (git-fixes).
i40e: Fix use-after-free in i40eclientsubtask() (bsc#1101816 ).
i40e: fix broken XDP support (git-fixes).
i40e: fix the panic when running bpf in xdpdrv mode (git-fixes).
i40e: fix the restart auto-negotiation after FEC modified (jsc#SLE-4797).
ibmvfc: Avoid move login if fast fail is enabled (bsc#1185938 ltc#192043).
ibmvfc: Handle move login failure (bsc#1185938 ltc#192043).
ibmvfc: Reinit target retries (bsc#1185938 ltc#192043).
ibmvnic: remove default label from to_string switch (bsc#1152457 ltc#174432 git-fixes).
igb: Fix duplicate include guard (git-fixes).
igb: check timestamp validity (git-fixes).
ipmi/watchdog: Stop watchdog timer when the current action is 'none' (bsc#1184855).
ipw2x00: potential buffer overflow in libipwwxset_encodeext() (git-fixes).
kABI: powerpc/64: add back starttb and accumtb to thread_struct.
kabi: preserve struct header_ops after bsc#1176081 fix (bsc#1176081).
liquidio: Fix unintented sign extension of a left shift of a u16 (git-fixes).
mac80211: bail out if cipher schemes are invalid (git-fixes).
mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN (git-fixes).
macvlan: macvlancountrx() needs to be aware of preemption (git-fixes).
md-cluster: fix use-after-free issue when removing rdev (bsc#1184082).
md/raid1: properly indicate failure when ending a failed write request (bsc#1185680).
md: do not flush workqueue unconditionally in md_open (bsc#1184081).
md: factor out a mddevfindlocked helper from mddev_find (bsc#1184081).
md: md_open returns -EBUSY when entering racing area (bsc#1184081).
md: split mddev_find (bsc#1184081).
media: dvbdev: Fix memory leak in dvbmediadevice_free() (git-fixes).
media: m88rs6000t: avoid potential out-of-bounds reads on arrays (git-fixes).
media: omap4iss: return error code when omap4iss_get() failed (git-fixes).
mfd: lpc_sch: Partially revert 'Add support for Intel Quark X1000' (git-fixes).
mfd: stm32-timers: Avoid clearing auto reload register (git-fixes).
misc: lis3lv02d: Fix false-positive WARN on various HP models (git-fixes).
misc: vmwvmci: explicitly initialize vmcidatagram payload (git-fixes).
misc: vmwvmci: explicitly initialize vmcinotifybmset_msg struct (git-fixes).
mlxsw: spectrum_mr: Update egress RIF list before route's action (bsc#1112374).
mm: mempolicy: fix potential pteunmapunlock pte error (bsc#1185906).
mm: mempolicy: make mbind() return -EIO when MPOLMFSTRICT is specified (bsc#1185906).
mmc: core: Correct descriptions in mmcofparse() (git-fixes).
mmc: mmcspi: Drop unused NOIRQ definition (git-fixes).
mt7601u: fix always true expression (git-fixes).
mtd: require write permissions for locking and badblock ioctls (git-fixes).
net, xdp: Update pkt_type if generic XDP changes unicast MAC (bsc#1109837).
net/ethernet: Add parseprotocol headerops support (bsc#1176081).
net/mlx4_en: update moderation when config reset (git-fixes).
net/mlx5e: Fix error path for ethtool set-priv-flag (git-fixes).
net/mlx5e: Remove the wrong assumption about transport offset (bsc#1176081).
net/mlx5e: Trust kernel regarding transport offset (bsc#1176081).
net/packet: Ask driver for protocol if not provided by user (bsc#1176081).
net/packet: Remove redundant skb->protocol set (bsc#1176081).
net/qlcnic: Fix a use after free in qlcnic83xxgetminidumptemplate (git-fixes).
net: Do not set transport offset to invalid value (bsc#1176081).
net: Introduce parseprotocol headerops callback (bsc#1176081).
net: hns3: Fix for geneve tx checksum bug (bsc#1104353 ).
net: hns3: add check for HNS3NICSTATEINITED in hns3resetnotifyup_enet() (bsc#1104353).
net: hns3: disable phy loopback setting in hclgemacstart_phy (bsc#1104353).
net: hns3: fix for vxlan gpe tx checksum bug (bsc#1104353 ).
net: hns3: fix incorrect configuration for igueguhw_err (bsc#1104353).
net: hns3: initialize the message content in hclgegetlink_mode() (bsc#1126390).
net: hns3: use netiftxdisable to stop the transmit queue (bsc#1104353).
net: thunderx: Fix unintentional sign extension issue (git-fixes).
netdevice: Add missing IFFPHONYHEADROOM self-definition (git-fixes).
netfilter: conntrack: add new sysctl to disable RST check (bsc#1183947 bsc#1185950).
netfilter: conntrack: avoid misleading 'invalid' in log message (bsc#1183947 bsc#1185950).
netfilter: conntrack: improve RST handling when tuple is re-used (bsc#1183947 bsc#1185950).
netfilter: conntrack: tcp: only close if RST matches exact sequence (bsc#1183947 bsc#1185950).
nfc: pn533: prevent potential memory corruption (git-fixes).
nvme-fc: clear q_live at beginning of association teardown (git-fixes).
nvme-loop: Introduce no merge flag for biovec (bsc#1174682).
pataarasancf: fix IRQ check (git-fixes).
pataipx4xxcf: fix IRQ check (git-fixes).
pcnet32: Use pciresourcelen to validate PCI resource (git-fixes).
phy: marvell: ARMADA375USBCLUSTERPHY should not default to y, unconditionally (git-fixes).
pinctrl: core: Fix kernel doc string for pingetname() (git-fixes).
pinctrl: lewisburg: Update number of pins in community (git-fixes).
platform/x86: pmcatom: Match all Beckhoff Automation baytrail boards with critclksystems DMI table (git-fixes).
powerpc/64: remove starttb and accumtb from thread_struct (bsc#1186487 ltc#177613).
powerpc/64s: Fix crashes when toggling entry flush barrier (bsc#1177666 git-fixes).
powerpc/64s: Fix crashes when toggling stf barrier (bsc#1087082 git-fixes).
powerpc/pseries: lparcfg calculate PURR on demand (bsc#1186487 ltc#177613).
regulator: bd9571mwv: Fix AVS and DVFS voltage range (git-fixes).
rsxx: remove extraneous 'const' qualifier (git-fixes).
rtc: ds1307: Fix wday settings for rx8130 (git-fixes).
rtlwifi: 8821ae: upgrade PHY and RF parameters (git-fixes).
s390/dasd: fix hanging DASD driver unbind (bsc#1183754 LTC#192081).
s390/dasd: fix hanging IO request during DASD driver unbind (bsc#1183754 LTC#192081).
s390/entry: save the caller of psw_idle (bsc#1185677).
s390/kdump: fix out-of-memory with PCI (bsc#1182256 LTC#191375).
sata_mv: add IRQ checks (git-fixes).
scsi: core: Run queue in case of I/O resource contention failure (bsc#1186416).
scsi: libfc: Avoid invoking response handler twice if ep is already completed (bsc#1186573).
scsi: lpfc: Add a option to enable interlocked ABTS before job completion (bsc#1186452).
scsi: lpfc: Add ndlp kref accounting for resume RPI path (bsc#1186452).
scsi: lpfc: Fix 'Unexpected timeout' error in direct attach topology (bsc#1186452).
scsi: lpfc: Fix Node recovery when driver is handling simultaneous PLOGIs (bsc#1186452).
scsi: lpfc: Fix bad memory access during VPD DUMP mailbox command (bsc#1186452).
scsi: lpfc: Fix crash when lpfcsli4hba_setup() fails to initialize the SGLs (bsc#1186452).
scsi: lpfc: Fix node handling for Fabric Controller and Domain Controller (bsc#1186452).
scsi: lpfc: Fix non-optimized ERSP handling (bsc#1186452).
scsi: lpfc: Fix unreleased RPIs when NPIV ports are created (bsc#1186452).
scsi: lpfc: Ignore GID-FT response that may be received after a link flip (bsc#1186452).
scsi: lpfc: Reregister FPIN types if ELS_RDF is received from fabric controller (bsc#1186452).
scsi: lpfc: Update lpfc version to 12.8.0.10 (bsc#1186452).
scsi: qla2xxx: Prevent PRLI in target mode (git-fixes).
smc: disallow TCPULP in smcsetsockopt() (bsc#1109837).
soc: qcom: mdtloader: Validate that pfilesz < p_memsz (git-fixes).
spi: spi-ti-qspi: Free DMA resources (git-fixes).
staging: rtl8192u: Fix potential infinite loop (git-fixes).
tcp: fix to update snd_wl1 in bulk receiver fast path (bsc#1185827).
thermal/drivers/ti-soc-thermal/bandgap Remove unused variable 'val' (git-fixes).
tracing: Map all PIDs to command lines (git-fixes).
uio: uiohvgeneric: use devm_kzalloc() for private data alloc (git-fixes).
uiohvgeneric: Fix a memory leak in error handling paths (git-fixes).
uiohvgeneric: Fix another memory leak in error handling paths (git-fixes).
uiohvgeneric: add missed sysfsremovebin_file (git-fixes).
usb: core: hub: fix race condition about TRSMRCY of resume (git-fixes).
usb: dwc3: gadget: Fix START_TRANSFER link state check (git-fixes).
usb: typec: tcpci: Check ROLECONTROL while interpreting CCSTATUS (git-fixes).
usb: xhci: Increase timeout for HC halt (git-fixes).
video: hyperv_fb: Add ratelimit on error message (bsc#1185724).
xhci: Do not use GFP_KERNEL in (potentially) atomic context (git-fixes).
xsk: Respect device's headroom and tailroom on generic xmit path (bsc#1109837).

References

Affected packages

SUSE:Linux Enterprise Real Time 12 SP5 / kernel-rt

Package

Name: kernel-rt
Purl: purl:rpm/suse/kernel-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-10.46.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-devel-rt": "4.12.14-10.46.1",
            "dlm-kmp-rt": "4.12.14-10.46.1",
            "gfs2-kmp-rt": "4.12.14-10.46.1",
            "kernel-rt_debug": "4.12.14-10.46.1",
            "kernel-rt-devel": "4.12.14-10.46.1",
            "cluster-md-kmp-rt": "4.12.14-10.46.1",
            "kernel-rt_debug-devel": "4.12.14-10.46.1",
            "kernel-source-rt": "4.12.14-10.46.1",
            "kernel-rt": "4.12.14-10.46.1",
            "ocfs2-kmp-rt": "4.12.14-10.46.1",
            "kernel-syms-rt": "4.12.14-10.46.1",
            "kernel-rt-base": "4.12.14-10.46.1"
        }
    ]
}

SUSE:Linux Enterprise Real Time 12 SP5 / kernel-rt_debug

Package

Name: kernel-rt_debug
Purl: purl:rpm/suse/kernel-rt_debug&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-10.46.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-devel-rt": "4.12.14-10.46.1",
            "dlm-kmp-rt": "4.12.14-10.46.1",
            "gfs2-kmp-rt": "4.12.14-10.46.1",
            "kernel-rt_debug": "4.12.14-10.46.1",
            "kernel-rt-devel": "4.12.14-10.46.1",
            "cluster-md-kmp-rt": "4.12.14-10.46.1",
            "kernel-rt_debug-devel": "4.12.14-10.46.1",
            "kernel-source-rt": "4.12.14-10.46.1",
            "kernel-rt": "4.12.14-10.46.1",
            "ocfs2-kmp-rt": "4.12.14-10.46.1",
            "kernel-syms-rt": "4.12.14-10.46.1",
            "kernel-rt-base": "4.12.14-10.46.1"
        }
    ]
}

SUSE:Linux Enterprise Real Time 12 SP5 / kernel-source-rt

Package

Name: kernel-source-rt
Purl: purl:rpm/suse/kernel-source-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-10.46.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-devel-rt": "4.12.14-10.46.1",
            "dlm-kmp-rt": "4.12.14-10.46.1",
            "gfs2-kmp-rt": "4.12.14-10.46.1",
            "kernel-rt_debug": "4.12.14-10.46.1",
            "kernel-rt-devel": "4.12.14-10.46.1",
            "cluster-md-kmp-rt": "4.12.14-10.46.1",
            "kernel-rt_debug-devel": "4.12.14-10.46.1",
            "kernel-source-rt": "4.12.14-10.46.1",
            "kernel-rt": "4.12.14-10.46.1",
            "ocfs2-kmp-rt": "4.12.14-10.46.1",
            "kernel-syms-rt": "4.12.14-10.46.1",
            "kernel-rt-base": "4.12.14-10.46.1"
        }
    ]
}

SUSE:Linux Enterprise Real Time 12 SP5 / kernel-syms-rt

Package

Name: kernel-syms-rt
Purl: purl:rpm/suse/kernel-syms-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.12.14-10.46.1

Ecosystem specific

{
    "binaries": [
        {
            "kernel-devel-rt": "4.12.14-10.46.1",
            "dlm-kmp-rt": "4.12.14-10.46.1",
            "gfs2-kmp-rt": "4.12.14-10.46.1",
            "kernel-rt_debug": "4.12.14-10.46.1",
            "kernel-rt-devel": "4.12.14-10.46.1",
            "cluster-md-kmp-rt": "4.12.14-10.46.1",
            "kernel-rt_debug-devel": "4.12.14-10.46.1",
            "kernel-source-rt": "4.12.14-10.46.1",
            "kernel-rt": "4.12.14-10.46.1",
            "ocfs2-kmp-rt": "4.12.14-10.46.1",
            "kernel-syms-rt": "4.12.14-10.46.1",
            "kernel-rt-base": "4.12.14-10.46.1"
        }
    ]
}