Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

SUSE: 2022:0295-1 Critical Kernel Updates Addressing DoS Vulnerabilities

suse
Calendar Grey February 2, 2022
Scroller Suse
Crucial SUSE update addresses several kernel vulnerabilities. Urgent patching advised for SLE 15 SP3 systems.
An update that fixes 5 vulnerabilities is now available

Summary

This update for the Linux Kernel 5.3.18-59_13 fixes several issues. The following security issues were fixed: - CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517). - CVE-2021-4154: Fixed option parsing with cgroups version 1 (bsc#1193842). - CVE-2021-4028: Fixed use-after-free in RDMA listen() that could lead to DoS or privilege escalation by a local attacker (bsc#1193167). - CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bsc#1191193) - CVE-2021-42739: The firewire subsystem had a buffer overflow related to

Topics%20covered

Topics Covered

security advisory buffer overflow local privilege escalation DoS attack important kernel fix SUSE

References

#1191529 #1192036 #1193529 #1194461 #1194737

Cross- CVE-2020-3702 CVE-2021-4028 CVE-2021-4154

CVE-2021-42739 CVE-2022-0185

CVSS scores:

CVE-2020-3702 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2020-3702 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2021-4028 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-4154 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2021-42739 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2022-0185 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Module for Live Patching 15-SP3

https://www.suse.com/security/cve/CVE-2020-3702.html

https://www.suse.com/security/cve/CVE-2021-4028.html

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:0295-1
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow local privilege escalation DoS attack important kernel fix SUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.