Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

SUSE: 2021:1728-1 Critical: Kernel Live Patch 22 for SLE 15 Released

suse
Calendar Grey May 25, 2021
Scroller Suse
Crucial SUSE Security Enhancement for Linux Kernel Live Patch 22 tackling severe vulnerabilities and strengthening operational safeguards.
An update that fixes three vulnerabilities is now available

Summary

This update for the Linux Kernel 4.12.14-150_66 fixes several issues. The following security issues were fixed: - CVE-2020-36322: Fixed an issue inside the FUSE filesystem implementation where fuse_do_getattr() calls make_bad_inode() in inappropriate situations, could have caused a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950 (bsc#1184952). - CVE-2020-0433: Fixed blk_mq_queue_tag_busy_iter of blk-mq-tag.c, where a possible use after free due to improper locking could have happened. This could have led to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1178066). - CVE-2021-29154: Fixed BPF JIT compilers that allowed to execute

Topics%20covered

Topics Covered

security advisory kernel patch SUSE system crash local escalation important update threat fix

References

#1178066 #1184710 #1184952

Cross- CVE-2020-0433 CVE-2020-36322 CVE-2021-29154

CVSS scores:

CVE-2020-0433 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2020-0433 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2020-36322 (SUSE): 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVE-2021-29154 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-29154 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Module for Live Patching 15

https://www.suse.com/security/cve/CVE-2020-0433.html

https://www.suse.com/security/cve/CVE-2020-36322.html

https://www.suse.com/security/cve/CVE-2021-29154.html

https://bugzilla.suse.com/1178066

https://bugzilla.suse.com/1184710

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:1728-1
Rating: important

Topics%20covered

Topics Covered

security advisory kernel patch SUSE system crash local escalation important update threat fix

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.