SUSE: 2021:4090-1 Important: Kernel Live Patch Critical Escalation Issues
suse
December 14, 2021
An update that fixes two vulnerabilities is now available
Summary
This update for the Linux Kernel 5.3.18-24_53_4 fixes several issues. The following security issues were fixed: - CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045). - CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Live Patching 15-SP2:
Topics Covered
References
#1191813 #1192048
Cross- CVE-2021-0941 CVE-2021-20322
CVSS scores:
CVE-2021-0941 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-20322 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products:
SUSE Linux Enterprise Module for Live Patching 15-SP2
https://www.suse.com/security/cve/CVE-2021-0941.html
https://www.suse.com/security/cve/CVE-2021-20322.html
https://bugzilla.suse.com/1191813
https://bugzilla.suse.com/1192048
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Announcement ID: SUSE-SU-2021:4090-1
Rating: important
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!