SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:2721-1
Rating:             important
References:         #1173514 #1196973 #1198829 #1200598 #1200762 
                    #1200910 #1201251 #1201429 #1201635 #1201636 
                    #1201742 #1201752 #1201930 #1201940 
Cross-References:   CVE-2020-15393 CVE-2020-36557 CVE-2020-36558
                    CVE-2021-33655 CVE-2021-33656 CVE-2021-39713
                    CVE-2022-1462 CVE-2022-20166 CVE-2022-2318
                    CVE-2022-26365 CVE-2022-33740 CVE-2022-33741
                    CVE-2022-33742 CVE-2022-36946
CVSS scores:
                    CVE-2020-15393 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2020-15393 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
                    CVE-2020-36557 (NVD) : 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2020-36557 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2020-36558 (NVD) : 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2020-36558 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-33655 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-33655 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-33656 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-33656 (SUSE): 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
                    CVE-2021-39713 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-39713 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-1462 (NVD) : 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
                    CVE-2022-1462 (SUSE): 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
                    CVE-2022-20166 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-20166 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
                    CVE-2022-2318 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-2318 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-26365 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
                    CVE-2022-26365 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
                    CVE-2022-33740 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
                    CVE-2022-33740 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
                    CVE-2022-33741 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
                    CVE-2022-33741 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
                    CVE-2022-33742 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
                    CVE-2022-33742 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
                    CVE-2022-36946 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-36946 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:
                    SUSE Linux Enterprise Server 12-SP2-BCL
______________________________________________________________________________

   An update that fixes 14 vulnerabilities is now available.

Description:


   The SUSE Linux Enterprise 12 kernel was updated to receive various
   security bugfixes.

   The following security bugs were fixed:

   - CVE-2022-36946: Fixed an incorrect packet trucation operation which
     could lead to denial of service (bnc#1201940).
   - CVE-2022-20166: Fixed several possible memory safety issues due to
     unsafe operations (bsc#1200598).
   - CVE-2020-15393: Fixed a memory leak in the usbtest driver which could
     lead to denial of service (bnc#1173514).
   - CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could
     lead to a NULL pointer dereference and general protection fault
     (bnc#1200910).
   - CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl
     and closing/opening of TTYs could lead to a use-after-free (bnc#1201429).
   - CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd
     PIO_FONT (bnc#1201636).
   - CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO
     (bnc#1201635).
   - CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem
     (bnc#1198829).
   - CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed
     multiple potential data leaks with Block and Network devices when using
     untrusted backends (bsc#1200762).
   - CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler
     in Rose subsystem that allowed unprivileged attackers to crash the
     system (bsc#1201251).
   - CVE-2021-39713: Fixed a race condition in the network scheduling
     subsystem which could lead to a use-after-free (bnc#1196973).

   The following non-security bugs were fixed:

   - kvm: emulate: Do not adjust size of fastop and setcc subroutines
     (bsc#1201930).
   - kvm: emulate: Fix SETcc emulation function offsets with SLS
     (bsc#1201930).


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-SP2-BCL:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-2721=1



Package List:

   - SUSE Linux Enterprise Server 12-SP2-BCL (x86_64):

      kernel-default-4.4.121-92.181.1
      kernel-default-base-4.4.121-92.181.1
      kernel-default-base-debuginfo-4.4.121-92.181.1
      kernel-default-debuginfo-4.4.121-92.181.1
      kernel-default-debugsource-4.4.121-92.181.1
      kernel-default-devel-4.4.121-92.181.1
      kernel-syms-4.4.121-92.181.1

   - SUSE Linux Enterprise Server 12-SP2-BCL (noarch):

      kernel-devel-4.4.121-92.181.1
      kernel-macros-4.4.121-92.181.1
      kernel-source-4.4.121-92.181.1


References:

   https://www.suse.com/security/cve/CVE-2020-15393.html
   https://www.suse.com/security/cve/CVE-2020-36557.html
   https://www.suse.com/security/cve/CVE-2020-36558.html
   https://www.suse.com/security/cve/CVE-2021-33655.html
   https://www.suse.com/security/cve/CVE-2021-33656.html
   https://www.suse.com/security/cve/CVE-2021-39713.html
   https://www.suse.com/security/cve/CVE-2022-1462.html
   https://www.suse.com/security/cve/CVE-2022-20166.html
   https://www.suse.com/security/cve/CVE-2022-2318.html
   https://www.suse.com/security/cve/CVE-2022-26365.html
   https://www.suse.com/security/cve/CVE-2022-33740.html
   https://www.suse.com/security/cve/CVE-2022-33741.html
   https://www.suse.com/security/cve/CVE-2022-33742.html
   https://www.suse.com/security/cve/CVE-2022-36946.html
   https://bugzilla.suse.com/1173514
   https://bugzilla.suse.com/1196973
   https://bugzilla.suse.com/1198829
   https://bugzilla.suse.com/1200598
   https://bugzilla.suse.com/1200762
   https://bugzilla.suse.com/1200910
   https://bugzilla.suse.com/1201251
   https://bugzilla.suse.com/1201429
   https://bugzilla.suse.com/1201635
   https://bugzilla.suse.com/1201636
   https://bugzilla.suse.com/1201742
   https://bugzilla.suse.com/1201752
   https://bugzilla.suse.com/1201930
   https://bugzilla.suse.com/1201940

SUSE: 2022:2721-1 important: the Linux Kernel

August 9, 2022
An update that fixes 14 vulnerabilities is now available

Summary

The SUSE Linux Enterprise 12 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-36946: Fixed an incorrect packet trucation operation which could lead to denial of service (bnc#1201940). - CVE-2022-20166: Fixed several possible memory safety issues due to unsafe operations (bsc#1200598). - CVE-2020-15393: Fixed a memory leak in the usbtest driver which could lead to denial of service (bnc#1173514). - CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910). - CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of TTYs could lead to a use-after-free (bnc#1201429). - CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636). - CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635). - CVE-2022-1462: Fixed an out-of-bounds read flaw in the TTY subsystem (bnc#1198829). - CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762). - CVE-2022-2318: Fixed a use-after-free vulnerability in the timer handler in Rose subsystem that allowed unprivileged attackers to crash the system (bsc#1201251). - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-after-free (bnc#1196973). The following non-security bugs were fixed: - kvm: emulate: Do not adjust size of fastop and setcc subroutines (bsc#1201930). - kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).

References

#1173514 #1196973 #1198829 #1200598 #1200762

#1200910 #1201251 #1201429 #1201635 #1201636

#1201742 #1201752 #1201930 #1201940

Cross- CVE-2020-15393 CVE-2020-36557 CVE-2020-36558

CVE-2021-33655 CVE-2021-33656 CVE-2021-39713

CVE-2022-1462 CVE-2022-20166 CVE-2022-2318

CVE-2022-26365 CVE-2022-33740 CVE-2022-33741

CVE-2022-33742 CVE-2022-36946

CVSS scores:

CVE-2020-15393 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2020-15393 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CVE-2020-36557 (NVD) : 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2020-36557 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2020-36558 (NVD) : 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2020-36558 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-33655 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-33655 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-33656 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-33656 (SUSE): 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

CVE-2021-39713 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-39713 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2022-1462 (NVD) : 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

CVE-2022-1462 (SUSE): 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

CVE-2022-20166 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE-2022-20166 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CVE-2022-2318 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2022-2318 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2022-26365 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVE-2022-26365 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CVE-2022-33740 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVE-2022-33740 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CVE-2022-33741 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVE-2022-33741 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CVE-2022-33742 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVE-2022-33742 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CVE-2022-36946 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-36946 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

SUSE Linux Enterprise Server 12-SP2-BCL

https://www.suse.com/security/cve/CVE-2020-15393.html

https://www.suse.com/security/cve/CVE-2020-36557.html

https://www.suse.com/security/cve/CVE-2020-36558.html

https://www.suse.com/security/cve/CVE-2021-33655.html

https://www.suse.com/security/cve/CVE-2021-33656.html

https://www.suse.com/security/cve/CVE-2021-39713.html

https://www.suse.com/security/cve/CVE-2022-1462.html

https://www.suse.com/security/cve/CVE-2022-20166.html

https://www.suse.com/security/cve/CVE-2022-2318.html

https://www.suse.com/security/cve/CVE-2022-26365.html

https://www.suse.com/security/cve/CVE-2022-33740.html

https://www.suse.com/security/cve/CVE-2022-33741.html

https://www.suse.com/security/cve/CVE-2022-33742.html

https://www.suse.com/security/cve/CVE-2022-36946.html

https://bugzilla.suse.com/1173514

https://bugzilla.suse.com/1196973

https://bugzilla.suse.com/1198829

https://bugzilla.suse.com/1200598

https://bugzilla.suse.com/1200762

https://bugzilla.suse.com/1200910

https://bugzilla.suse.com/1201251

https://bugzilla.suse.com/1201429

https://bugzilla.suse.com/1201635

https://bugzilla.suse.com/1201636

https://bugzilla.suse.com/1201742

https://bugzilla.suse.com/1201752

https://bugzilla.suse.com/1201930

https://bugzilla.suse.com/1201940

Severity
Announcement ID: SUSE-SU-2022:2721-1
Rating: important

Related News

Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered
Open Source Strategies for Enhancing Security in Digital Business Operations
5 - 9 min read
Digital transformation, powered by the principles of open-source security , is vital for businesses looking to excel in today's technology-driven
Microsoft Update Mayhem: Rescuing Linux Dual-Boot Systems from Secure Boot Woes
2 - 4 min read
Microsoft's recent patch, intended to strengthen Secure Boot defenses, has resulted in an unexpected setback for Linux-Windows dual-boot setups

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved