Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 414
Alerts This Week
Warning Icon 1 414

SUSE: 2021:2560-1 Critical: Linux Kernel Live Patch for SLE 15 SP1

suse
Calendar Grey July 29, 2021
Dist Suse Esm H88
The latest security patch for the Linux Kernel Live Patch 22 within SLE 15 SP1 addresses flaws that could facilitate unauthorized privilege escalation.
An update that fixes three vulnerabilities is now available

Summary

This update for the Linux Kernel 4.12.14-197_83 fixes several issues. The following security issues were fixed: - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to andobtain full root privileges. (bsc#1188062) - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116) - CVE-2020-36385: Fixed a use-after-free vulnerability reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called. (bnc#1187050) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Live Patching 15-SP1:

Topics%20covered

Topics Covered

security advisory privilege escalation kernel patch SUSE live patch

References

#1187052 #1188117 #1188257

Cross- CVE-2020-36385 CVE-2021-22555 CVE-2021-33909

CVSS scores:

CVE-2020-36385 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2020-36385 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-22555 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-22555 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-33909 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Module for Live Patching 15-SP1

https://www.suse.com/security/cve/CVE-2020-36385.html

https://www.suse.com/security/cve/CVE-2021-22555.html

https://www.suse.com/security/cve/CVE-2021-33909.html

https://bugzilla.suse.com/1187052

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:2560-1
Rating: important

Topics%20covered

Topics Covered

security advisory privilege escalation kernel patch SUSE live patch

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.