Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 584
Alerts This Week
Warning Icon 1 584

SUSE: 2021:2846-1 Important: Linux Kernel Live Patch 40 - Memory Corruption

suse
Calendar Grey August 25, 2021
Scroller Suse
Crucial Linux Kernel revision addresses numerous vulnerabilities, enhancing protection. Newest update is relevant for SUSE 12 SP3. Act swiftly.
An update that fixes three vulnerabilities is now available

Summary

This update for the Linux Kernel 4.4.180-94_147 fixes several issues. The following security issues were fixed: - CVE-2021-37576: On the powerpc platform KVM guest OS users could cause host OS memory corruption via rtas_args.nargs (bsc#1188838). - CVE-2021-28688: The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. (bsc#1183646) - CVE-2020-0429: Fixed a potential local privilege escalation in l2tp_session_delete and related functions of l2tp_core.c (bsc#1176724). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods

Topics%20covered

Topics Covered

security advisory local privilege memory corruption kernel patch important threat mitigation SUSE

References

#1176931 #1182294 #1188842

Cross- CVE-2020-0429 CVE-2021-28688 CVE-2021-37576

CVSS scores:

CVE-2020-0429 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE-2020-0429 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-28688 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CVE-2021-28688 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CVE-2021-37576 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Server for SAP 12-SP3

SUSE Linux Enterprise Server 12-SP3-LTSS

https://www.suse.com/security/cve/CVE-2020-0429.html

https://www.suse.com/security/cve/CVE-2021-28688.html

https://www.suse.com/security/cve/CVE-2021-37576.html

https://bugzilla.suse.com/1176931

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:2846-1
Rating: important

Topics%20covered

Topics Covered

security advisory local privilege memory corruption kernel patch important threat mitigation SUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.