Oval Definition:oval:org.opensuse.security:def:59843
Revision Date:2021-02-11Version:1
Title:Security update for the Linux Kernel (Important)
Description:

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.



The following security bugs were fixed:

- CVE-2021-3348: Fixed a use-after-free in nbd_add_socket() that could be triggered by local attackers (with access to the nbd device) via an I/O request (bnc#1181504). - CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349). - CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was found, specifically in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878). - CVE-2020-25211: Fixed a buffer overflow in ctnetlink_parse_tuple_filter() which could be triggered by a local attackers by injecting conntrack netlink configuration (bnc#1176395). - CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl (bnc#1176846). - CVE-2020-29569: Fixed a potential privilege escalation and information leaks related to the PV block backend, as used by Xen (bnc#1179509). - CVE-2020-29568: Fixed a denial of service issue, related to processing watch events (bnc#1179508). - CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027). - CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029). - CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031). - CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666). - CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141). - CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086). - CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107). - CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601). - CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960). - CVE-2020-29371: Fixed uninitialized memory leaks to userspace (bsc#1179429). - CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745). - CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745). - CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589). - CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886). - CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182). - CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service(bsc#1179140). - CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559). - CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372). - CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).

The following non-security bugs were fixed:

- blk-mq: improve heavily contended tag case (bsc#1178198). - debugfs_lookup(): switch to lookup_one_len_unlocked() (bsc#1171979). - epoll: Keep a reference on files added to the check list (bsc#1180031). - fix regression in 'epoll: Keep a reference on files added to the check list' (bsc#1180031, git-fixes). - futex: Do not enable IRQs unconditionally in put_pi_state() (bsc#1149032). - futex: Ensure the correct return value from futex_lock_pi() (bsc#1181349 bsc#1149032). - futex: Fix incorrect should_fail_futex() handling (bsc#1181349). - futex: Handle faults correctly for PI futexes (bsc#1181349 bsc#1149032). - futex: Provide and use pi_state_update_owner() (bsc#1181349 bsc#1149032). - futex: Replace pointless printk in fixup_owner() (bsc#1181349 bsc#1149032). - futex: Simplify fixup_pi_state_owner() (bsc#1181349 bsc#1149032). - futex: Use pi_state_update_owner() in put_pi_state() (bsc#1181349 bsc#1149032). - HID: Fix slab-out-of-bounds read in hid_field_extract (bsc#1180052). - iommu/vt-d: Do not dereference iommu_device if IOMMU_API is not built (bsc#1181001, jsc#ECO-3191). - iommu/vt-d: Gracefully handle DMAR units with no supported address widths (bsc#1181001, jsc#ECO-3191). - kABI: Fix kABI for extended APIC-ID support (bsc#1181001, jsc#ECO-3191). - locking/futex: Allow low-level atomic operations to return -EAGAIN (bsc#1149032). - md/bitmap: fix memory leak of temporary bitmap (bsc#1163727). - md/bitmap: md_bitmap_get_counter returns wrong blocks (bsc#1163727). - md/bitmap: md_bitmap_read_sb uses wrong bitmap blocks (bsc#1163727). - md/cluster: block reshape with remote resync job (bsc#1163727). - md/cluster: fix deadlock when node is doing resync job (bsc#1163727). - md-cluster: Fix potential error pointer dereference in resize_bitmaps() (bsc#1163727). - md-cluster: fix rmmod issue when md_cluster convert bitmap to none (bsc#1163727). - md-cluster: fix safemode_delay value when converting to clustered bitmap (bsc#1163727). - md-cluster: fix wild pointer of unlock_all_bitmaps() (bsc#1163727). - Move upstreamed bt fixes into sorted section - nbd: Fix memory leak in nbd_add_socket (bsc#1181504). - net/x25: prevent a couple of overflows (bsc#1178590). - NFS: mark nfsiod as CPU_INTENSIVE (bsc#1177304). - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (bsc#1181349 bsc#1149032). - s390/dasd: fix hanging device offline processing (bsc#1144912). - scsi: ibmvfc: Avoid link down on FS9100 canister reboot (bsc#1176962 ltc#188304). - scsi: ibmvfc: Use compiler attribute defines instead of __attribute__() (bsc#1176962 ltc#188304). - SUNRPC: cache: ignore timestamp written to 'flush' file (bsc#1178036). - x86/apic: Fix x2apic enablement without interrupt remapping (bsc#1181001, jsc#ECO-3191). - x86/apic: Support 15 bits of APIC ID in IOAPIC/MSI where available (bsc#1181001, jsc#ECO-3191). - x86/ioapic: Handle Extended Destination ID field in RTE (bsc#1181001, jsc#ECO-3191). - x86/kvm: Add KVM_FEATURE_MSI_EXT_DEST_ID (bsc#1181001, jsc#ECO-3191). - x86/kvm: Reserve KVM_FEATURE_MSI_EXT_DEST_ID (bsc#1181001, jsc#ECO-3191). - x86/msi: Only use high bits of MSI address for DMAR unit (bsc#1181001, jsc#ECO-3191). - x86/tracing: Introduce a static key for exception tracing (bsc#1179895). - x86/traps: Simplify pagefault tracing logic (bsc#1179895). - xfrm: Fix memleak on xfrm state destroy (bsc#1158775).
Family:unixClass:patch
Status:Reference(s):1005023
1076696
1092885
1094725
1096223
1097356
1098735
1101591
1101820
1114981
1115518
1119971
1120323
1123156
1128829
1128963
1131291
1132728
1132729
1132732
1132734
1134718
1140747
1144912
1146873
1149032
1149811
1150733
1151021
1153108
1156321
1156331
1158775
1161066
1163018
1163727
1166240
1168630
1170940
1171979
1176012
1176072
1176382
1176395
1176846
1176896
1176931
1176962
1177304
1177666
1177914
1178036
1178182
1178198
1178372
1178589
1178590
1178684
1178886
1179107
1179140
1179141
1179419
1179429
1179508
1179509
1179601
1179616
1179663
1179666
1179745
1179877
1179878
1179895
1179960
1179961
1180008
1180027
1180028
1180029
1180030
1180031
1180032
1180052
1180086
1180559
1180562
1180676
1181001
1181158
1181349
1181504
1181553
1181645
CVE-2009-2625
CVE-2009-3560
CVE-2009-3720
CVE-2012-0876
CVE-2012-1147
CVE-2012-1148
CVE-2012-6702
CVE-2015-1283
CVE-2016-0718
CVE-2016-1000031
CVE-2016-5300
CVE-2018-10903
CVE-2018-11806
CVE-2018-12617
CVE-2018-16864
CVE-2018-16865
CVE-2018-16866
CVE-2018-20856
CVE-2018-3639
CVE-2018-5848
CVE-2019-10220
CVE-2019-10245
CVE-2019-11478
CVE-2019-12068
CVE-2019-13272
CVE-2019-14835
CVE-2019-15890
CVE-2019-20934
CVE-2019-2602
CVE-2019-2684
CVE-2019-2697
CVE-2019-2698
CVE-2019-3689
CVE-2019-6778
CVE-2020-0429
CVE-2020-0431
CVE-2020-0444
CVE-2020-0465
CVE-2020-0466
CVE-2020-14381
CVE-2020-14386
CVE-2020-15436
CVE-2020-15437
CVE-2020-15999
CVE-2020-1711
CVE-2020-1983
CVE-2020-25211
CVE-2020-25212
CVE-2020-25639
CVE-2020-25669
CVE-2020-27068
CVE-2020-27777
CVE-2020-27786
CVE-2020-27825
CVE-2020-27835
CVE-2020-28374
CVE-2020-28915
CVE-2020-28974
CVE-2020-29371
CVE-2020-29568
CVE-2020-29569
CVE-2020-29660
CVE-2020-29661
CVE-2020-36158
CVE-2020-4788
CVE-2020-6819
CVE-2020-6820
CVE-2020-7039
CVE-2020-8608
CVE-2021-3347
CVE-2021-3348
SUSE-SU-2018:3553-1
SUSE-SU-2018:3555-1
SUSE-SU-2019:0135-1
SUSE-SU-2019:1136-1
SUSE-SU-2019:1345-1
SUSE-SU-2019:2781-1
SUSE-SU-2020:0928-1
SUSE-SU-2020:2998-1
SUSE-SU-2021:0434-1
Platform(s):openSUSE Leap 15.0
openSUSE Leap 15.1
SUSE Linux Enterprise Server 12 SP2-ESPOS
SUSE Linux Enterprise Server 12 SP3
SUSE Linux Enterprise Server 12 SP3-BCL
SUSE Linux Enterprise Server 12 SP3-ESPOS
SUSE Linux Enterprise Server 12 SP3-LTSS
SUSE Linux Enterprise Server 12 SP3-TERADATA
SUSE Linux Enterprise Server 12 SP4
SUSE Linux Enterprise Server 12 SP4-LTSS
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud Crowbar 9
Product(s):
Definition Synopsis
  • openSUSE Leap 15.0 is installed
  • AND Package Information
  • kcoreaddons-5.45.0-lp150.1 is installed
  • OR kcoreaddons-lang-5.45.0-lp150.1 is installed
  • OR libKF5CoreAddons5-5.45.0-lp150.1 is installed
    • Definition Synopsis
  • openSUSE Leap 15.1 is installed
  • AND Package Information
  • evolution-3.26.6-lp151.4.3 is installed
  • OR evolution-devel-3.26.6-lp151.4.3 is installed
  • OR evolution-lang-3.26.6-lp151.4.3 is installed
  • OR evolution-plugin-bogofilter-3.26.6-lp151.4.3 is installed
  • OR evolution-plugin-pst-import-3.26.6-lp151.4.3 is installed
  • OR evolution-plugin-spamassassin-3.26.6-lp151.4.3 is installed
  • OR glade-catalog-evolution-3.26.6-lp151.4.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-ESPOS is installed
  • AND Package Information
  • kgraft-patch-4_4_103-92_56-default-12-2 is installed
  • OR kgraft-patch-SLE12-SP2_Update_17-12-2 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3 is installed
  • AND Package Information
  • expat-2.1.0-20 is installed
  • OR libexpat1-2.1.0-20 is installed
  • OR libexpat1-32bit-2.1.0-20 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-BCL is installed
  • AND Package Information
  • dovecot22-2.2.31-19.22 is installed
  • OR dovecot22-backend-mysql-2.2.31-19.22 is installed
  • OR dovecot22-backend-pgsql-2.2.31-19.22 is installed
  • OR dovecot22-backend-sqlite-2.2.31-19.22 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-ESPOS is installed
  • AND Package Information
  • java-1_7_1-ibm-1.7.1_sr4.50-38.41 is installed
  • OR java-1_7_1-ibm-alsa-1.7.1_sr4.50-38.41 is installed
  • OR java-1_7_1-ibm-jdbc-1.7.1_sr4.50-38.41 is installed
  • OR java-1_7_1-ibm-plugin-1.7.1_sr4.50-38.41 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-LTSS is installed
  • AND Package Information
  • libvirglrenderer0-0.5.0-12.3 is installed
  • OR virglrenderer-0.5.0-12.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-TERADATA is installed
  • AND Package Information
  • apache2-2.4.23-29.21 is installed
  • OR apache2-doc-2.4.23-29.21 is installed
  • OR apache2-example-pages-2.4.23-29.21 is installed
  • OR apache2-prefork-2.4.23-29.21 is installed
  • OR apache2-utils-2.4.23-29.21 is installed
  • OR apache2-worker-2.4.23-29.21 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP4 is installed
  • AND Package Information
  • aaa_base-13.2+git20140911.61c1681-38.8 is installed
  • OR aaa_base-extras-13.2+git20140911.61c1681-38.8 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP4-LTSS is installed
  • AND Package Information
  • kernel-default-4.12.14-95.68.1 is installed
  • OR kernel-default-base-4.12.14-95.68.1 is installed
  • OR kernel-default-devel-4.12.14-95.68.1 is installed
  • OR kernel-default-man-4.12.14-95.68.1 is installed
  • OR kernel-devel-4.12.14-95.68.1 is installed
  • OR kernel-macros-4.12.14-95.68.1 is installed
  • OR kernel-source-4.12.14-95.68.1 is installed
  • OR kernel-syms-4.12.14-95.68.1 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 8 is installed
  • AND python-cryptography-2.0.3-3.3 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 8 is installed
  • AND Package Information
  • nfs-client-1.3.0-34.22 is installed
  • OR nfs-doc-1.3.0-34.22 is installed
  • OR nfs-kernel-server-1.3.0-34.22 is installed
  • OR nfs-utils-1.3.0-34.22 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 9 is installed
  • AND Package Information
  • crowbar-core-6.0+git.1571412352.8da4d261f-3.13 is installed
  • OR crowbar-core-branding-upstream-6.0+git.1571412352.8da4d261f-3.13 is installed
  • OR crowbar-openstack-6.0+git.1572264221.3826a58b8-3.13 is installed
  • OR grafana-6.2.5-3.9 is installed
  • OR openstack-cinder-13.0.8~dev8-3.13 is installed
  • OR openstack-cinder-api-13.0.8~dev8-3.13 is installed
  • OR openstack-cinder-backup-13.0.8~dev8-3.13 is installed
  • OR openstack-cinder-scheduler-13.0.8~dev8-3.13 is installed
  • OR openstack-cinder-volume-13.0.8~dev8-3.13 is installed
  • OR openstack-dashboard-14.0.5~dev1-3.9 is installed
  • OR openstack-horizon-plugin-manila-ui-2.16.2~dev2-3.3 is installed
  • OR openstack-keystone-14.1.1~dev26-3.13 is installed
  • OR openstack-manila-7.3.1~dev15-4.13 is installed
  • OR openstack-manila-api-7.3.1~dev15-4.13 is installed
  • OR openstack-manila-data-7.3.1~dev15-4.13 is installed
  • OR openstack-manila-scheduler-7.3.1~dev15-4.13 is installed
  • OR openstack-manila-share-7.3.1~dev15-4.13 is installed
  • OR openstack-neutron-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-dhcp-agent-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-fwaas-13.0.3~dev2-3.6 is installed
  • OR openstack-neutron-ha-tool-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-l3-agent-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-lbaas-13.0.1~dev15-3.10 is installed
  • OR openstack-neutron-lbaas-agent-13.0.1~dev15-3.10 is installed
  • OR openstack-neutron-linuxbridge-agent-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-macvtap-agent-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-metadata-agent-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-metering-agent-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-openvswitch-agent-13.0.6~dev3-3.13 is installed
  • OR openstack-neutron-server-13.0.6~dev3-3.13 is installed
  • OR openstack-nova-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-api-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-cells-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-compute-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-conductor-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-console-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-novncproxy-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-placement-api-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-scheduler-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-serialproxy-18.2.4~dev18-3.13 is installed
  • OR openstack-nova-vncproxy-18.2.4~dev18-3.13 is installed
  • OR openstack-octavia-3.2.1~dev1-3.13 is installed
  • OR openstack-octavia-amphora-agent-3.2.1~dev1-3.13 is installed
  • OR openstack-octavia-amphora-image-0.1.1-7.3 is installed
  • OR openstack-octavia-amphora-image-x86_64-0.1.1-7.3 is installed
  • OR openstack-octavia-api-3.2.1~dev1-3.13 is installed
  • OR openstack-octavia-health-manager-3.2.1~dev1-3.13 is installed
  • OR openstack-octavia-housekeeping-3.2.1~dev1-3.13 is installed
  • OR openstack-octavia-worker-3.2.1~dev1-3.13 is installed
  • OR python-Django1-1.11.24-3.12 is installed
  • OR python-cinder-13.0.8~dev8-3.13 is installed
  • OR python-horizon-14.0.5~dev1-3.9 is installed
  • OR python-horizon-plugin-manila-ui-2.16.2~dev2-3.3 is installed
  • OR python-keystone-14.1.1~dev26-3.13 is installed
  • OR python-keystonemiddleware-5.2.1-11 is installed
  • OR python-manila-7.3.1~dev15-4.13 is installed
  • OR python-neutron-13.0.6~dev3-3.13 is installed
  • OR python-neutron-fwaas-13.0.3~dev2-3.6 is installed
  • OR python-neutron-lbaas-13.0.1~dev15-3.10 is installed
  • OR python-nova-18.2.4~dev18-3.13 is installed
  • OR python-octavia-3.2.1~dev1-3.13 is installed
  • OR python-octaviaclient-1.6.1-3.3 is installed
  • OR python-openstack_auth-14.0.5~dev1-3.9 is installed
  • OR python-os-brick-2.5.8-3.6 is installed
  • OR python-os-brick-common-2.5.8-3.6 is installed
  • OR python-oslo.cache-1.30.4-3.3 is installed
  • OR python-oslo.messaging-8.1.4-3.3 is installed
    • BACK