SUSE Security Update: Security update for the Linux Kernel (Live Patch 16 for SLE 15 SP3)
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:4100-1
Rating:             important
References:         #1202087 #1203613 #1204170 #1204289 #1204381 
                    
Cross-References:   CVE-2021-33655 CVE-2022-2588 CVE-2022-42703
                    CVE-2022-42722
CVSS scores:
                    CVE-2021-33655 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-33655 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-2588 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-42703 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-42703 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-42722 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-42722 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:
                    SUSE Linux Enterprise High Performance Computing 15-SP3
                    SUSE Linux Enterprise Micro 5.1
                    SUSE Linux Enterprise Module for Live Patching 15-SP3
                    SUSE Linux Enterprise Server 15-SP3
                    SUSE Linux Enterprise Server for SAP Applications 15-SP3
______________________________________________________________________________

   An update that solves four vulnerabilities and has one
   errata is now available.

Description:

   This update for the Linux Kernel 5.3.18-150300_59_60 fixes several issues.

   The following security issues were fixed:

   - CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO
     (bnc#1201635).
   - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
   - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf
     anon_vma double reuse (bnc#1204168).
   - CVE-2022-42722: Fixed crash in beacon protection for P2P-device.
     (bsc#1204125)

   - Fixed incorrect handling of empty arguments array in execve()
     (bsc#1200571).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Live Patching 15-SP3:

      zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2022-4099=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4100=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4101=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4102=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4103=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4104=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4105=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4106=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4107=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4108=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4109=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4110=1



Package List:

   - SUSE Linux Enterprise Module for Live Patching 15-SP3 (ppc64le s390x x86_64):

      kernel-livepatch-5_3_18-150300_59_43-default-16-150300.2.2
      kernel-livepatch-5_3_18-150300_59_43-default-debuginfo-16-150300.2.2
      kernel-livepatch-5_3_18-150300_59_46-default-16-150300.2.2
      kernel-livepatch-5_3_18-150300_59_46-default-debuginfo-16-150300.2.2
      kernel-livepatch-5_3_18-150300_59_49-default-15-150300.2.2
      kernel-livepatch-5_3_18-150300_59_54-default-14-150300.2.2
      kernel-livepatch-5_3_18-150300_59_60-default-13-150300.2.2
      kernel-livepatch-5_3_18-150300_59_63-default-10-150300.2.2
      kernel-livepatch-5_3_18-150300_59_68-default-9-150300.2.2
      kernel-livepatch-5_3_18-150300_59_71-default-8-150300.2.1
      kernel-livepatch-5_3_18-150300_59_76-default-7-150300.2.1
      kernel-livepatch-5_3_18-59_34-default-18-150300.2.2
      kernel-livepatch-5_3_18-59_34-default-debuginfo-18-150300.2.2
      kernel-livepatch-5_3_18-59_37-default-17-150300.2.2
      kernel-livepatch-5_3_18-59_37-default-debuginfo-17-150300.2.2
      kernel-livepatch-5_3_18-59_40-default-17-150300.2.2
      kernel-livepatch-SLE15-SP3_Update_10-debugsource-17-150300.2.2
      kernel-livepatch-SLE15-SP3_Update_9-debugsource-18-150300.2.2

   - SUSE Linux Enterprise Module for Live Patching 15-SP3 (ppc64le x86_64):

      kernel-livepatch-5_3_18-59_40-default-debuginfo-17-150300.2.2


References:

   https://www.suse.com/security/cve/CVE-2021-33655.html
   https://www.suse.com/security/cve/CVE-2022-2588.html
   https://www.suse.com/security/cve/CVE-2022-42703.html
   https://www.suse.com/security/cve/CVE-2022-42722.html
   https://bugzilla.suse.com/1202087
   https://bugzilla.suse.com/1203613
   https://bugzilla.suse.com/1204170
   https://bugzilla.suse.com/1204289
   https://bugzilla.suse.com/1204381

SUSE: 2022:4100-1 important: the Linux Kernel (Live Patch 16 for SLE 15 SP3)

November 18, 2022
An update that solves four vulnerabilities and has one errata is now available

Summary

This update for the Linux Kernel 5.3.18-150300_59_60 fixes several issues. The following security issues were fixed: - CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUT_VSCREENINFO (bnc#1201635). - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096). - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168). - CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125) - Fixed incorrect handling of empty arguments array in execve() (bsc#1200571). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Live Patching 15-SP3: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2022-4099=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4100=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4101=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4102=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4103=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4104=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4105=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4106=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4107=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4108=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4109=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4110=1 Package List: - SUSE Linux Enterprise Module for Live Patching 15-SP3 (ppc64le s390x x86_64): kernel-livepatch-5_3_18-150300_59_43-default-16-150300.2.2 kernel-livepatch-5_3_18-150300_59_43-default-debuginfo-16-150300.2.2 kernel-livepatch-5_3_18-150300_59_46-default-16-150300.2.2 kernel-livepatch-5_3_18-150300_59_46-default-debuginfo-16-150300.2.2 kernel-livepatch-5_3_18-150300_59_49-default-15-150300.2.2 kernel-livepatch-5_3_18-150300_59_54-default-14-150300.2.2 kernel-livepatch-5_3_18-150300_59_60-default-13-150300.2.2 kernel-livepatch-5_3_18-150300_59_63-default-10-150300.2.2 kernel-livepatch-5_3_18-150300_59_68-default-9-150300.2.2 kernel-livepatch-5_3_18-150300_59_71-default-8-150300.2.1 kernel-livepatch-5_3_18-150300_59_76-default-7-150300.2.1 kernel-livepatch-5_3_18-59_34-default-18-150300.2.2 kernel-livepatch-5_3_18-59_34-default-debuginfo-18-150300.2.2 kernel-livepatch-5_3_18-59_37-default-17-150300.2.2 kernel-livepatch-5_3_18-59_37-default-debuginfo-17-150300.2.2 kernel-livepatch-5_3_18-59_40-default-17-150300.2.2 kernel-livepatch-SLE15-SP3_Update_10-debugsource-17-150300.2.2 kernel-livepatch-SLE15-SP3_Update_9-debugsource-18-150300.2.2 - SUSE Linux Enterprise Module for Live Patching 15-SP3 (ppc64le x86_64): kernel-livepatch-5_3_18-59_40-default-debuginfo-17-150300.2.2

References

#1202087 #1203613 #1204170 #1204289 #1204381

Cross- CVE-2021-33655 CVE-2022-2588 CVE-2022-42703

CVE-2022-42722

CVSS scores:

CVE-2021-33655 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE-2021-33655 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-2588 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-42703 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2022-42703 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-42722 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2022-42722 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

SUSE Linux Enterprise High Performance Computing 15-SP3

SUSE Linux Enterprise Micro 5.1

SUSE Linux Enterprise Module for Live Patching 15-SP3

SUSE Linux Enterprise Server 15-SP3

SUSE Linux Enterprise Server for SAP Applications 15-SP3

https://www.suse.com/security/cve/CVE-2021-33655.html

https://www.suse.com/security/cve/CVE-2022-2588.html

https://www.suse.com/security/cve/CVE-2022-42703.html

https://www.suse.com/security/cve/CVE-2022-42722.html

https://bugzilla.suse.com/1202087

https://bugzilla.suse.com/1203613

https://bugzilla.suse.com/1204170

https://bugzilla.suse.com/1204289

https://bugzilla.suse.com/1204381

Severity
Announcement ID: SUSE-SU-2022:4100-1
Rating: important

Related News

Linux Mint 22: Elevating Security and Usability for Admins
3 - 5 min read
Linux Mint has has long been recognized as a versatile and user-friendly distribution and has earned great popularity among administrators and
Exim 4.98 Addresses Critical Vulnerabilities, Bolsters Email Server Security
2 - 4 min read
Exim is one of Unix-like systems' most widely used mail transfer agents. It's essential for email delivery and handling and is a significant part of
Recent OpenSSH RCE Bug Explained: Impact & Mitigations
2 - 4 min read
In an era where cybersecurity threats loom larger than ever, the discovery of a Remote Code Execution (RCE) vulnerability in OpenSSH by Qualys’
CVE-2024-4577: A Swiftly Weaponized Vulnerability for Ransomware Distribution
2 - 4 min read
Security researchers recently issued an update detailing how attackers are exploiting a PHP code execution vulnerability to spread TellYouThePass
Play Ransomware Group Unleashes New Threat on ESXi Environments: Analysis & Mitigation Strategies
3 - 5 min read
The Play ransomware group, well-known for its double-extortion tactics, recently unveiled a Linux variant targeting ESXi environments. This
Critical Linux Kernel Vulnerabilities Patched in Ubuntu Azure Systems
2 - 4 min read
Canonical has fixed several recently identified critical Linux kernel vulnerabilities in July 2024. These vulnerabilities primarily affect Microsoft
The Urgent Need for Secure Software Development: New Report Serves as a Wake-Up Call for the Industry
3 - 5 min read
The Linux Foundation and Open Source Security Foundation recently published a report entitled "Secure Software Development Education 2024
Severe Linux Kernel Privilege Escalation Bugs Could Compromise Entire Systems
2 - 4 min read
The Cybersecurity and Infrastructure Security Agency (CISA) recently added a new Linux kernel privilege escalation bug ( CVE-2024-1086 ) to its

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved