Security update for the Linux Kernel

SUSE Security Update: Security update for the Linux Kernel
Announcement ID: SUSE-SU-2021:14630-1
Rating: important
References: #1152107 #1168952 #1173659 #1173942 #1174205 #1174247 #1174993 #1175691 #1176011 #1176012 #1176235 #1176253 #1176278 #1176395 #1176423 #1176482 #1176485 #1176722 #1176896 #1177206 #1177226 #1177666 #1177766 #1177906 #1178123 #1178182 #1178589 #1178590 #1178622 #1178886 #1179107 #1179140 #1179141 #1179419 #1179601 #1179616 #1179745 #1179877 #1180029 #1180030 #1180052 #1180086 #1180559 #1180562 #1181158 #1181166 #1181349 #1181553
Cross-References:CVE-2019-16746 CVE-2020-0404 CVE-2020-0431 CVE-2020-0465 CVE-2020-11668 CVE-2020-14331 CVE-2020-14353 CVE-2020-14381 CVE-2020-14390 CVE-2020-15436 CVE-2020-15437 CVE-2020-25211 CVE-2020-25284 CVE-2020-25285 CVE-2020-25643 CVE-2020-25656 CVE-2020-25668 CVE-2020-25669 CVE-2020-27068 CVE-2020-27777 CVE-2020-27786 CVE-2020-28915 CVE-2020-28974 CVE-2020-29660 CVE-2020-29661 CVE-2020-36158 CVE-2020-4788 CVE-2021-3347
Affected Products:
  • SUSE Linux Enterprise Server 11-SP4-LTSS
  • SUSE Linux Enterprise Server 11-EXTRA
  • SUSE Linux Enterprise Debuginfo 11-SP4

An update that solves 28 vulnerabilities and has 20 fixes is now available.


The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel (bnc#1181349).
  • CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).
  • CVE-2020-25211: Fixed a flaw where a local attacker was able to inject conntrack netlink configuration that could cause a denial of service or trigger the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter (bnc#1176395).
  • CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
  • CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
  • CVE-2020-15436: Fixed a use after free vulnerability in fs/block_dev.c which could have allowed local users to gain privileges or cause a denial of service (bsc#1179141).
  • CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).
  • CVE-2020-14353: Fixed an issue where keys - for keyctl prevent creating a different user's keyrings (bsc#1174993).
  • CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
  • CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).
  • CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).
  • CVE-2020-27786: Fixed an out-of-bounds write in the MIDI implementation (bnc#1179601).
  • CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).
  • CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).
  • CVE-2020-28974: Fixed a slab-out-of-bounds read in fbcon which could have been used by local attackers to read privileged information or potentially crash the kernel (bsc#1178589).
  • CVE-2020-28915: Fixed a buffer over-read in the fbcon code which could have been used by local attackers to read kernel memory (bsc#1178886).
  • CVE-2020-25669: Fixed a use-after-free read in sunkbd_reinit() (bsc#1178182).
  • CVE-2020-25285: A race condition between hugetlb sysctl handlers in mm/hugetlb.c could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact (bnc#1176485 ).
  • CVE-2020-15437: Fixed a null pointer dereference which could have allowed local users to cause a denial of service (bsc#1179140).
  • CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).
  • CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).
  • CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).
  • CVE-2020-4788: Fixed an issue with IBM Power9 processors could have allowed a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances (bsc#1177666).
  • CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
  • CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
  • CVE-2019-20934: Fixed a use-after-free in show_numa_stats() because NUMA fault statistics were inappropriately freed (bsc#1179663).
  • CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
  • CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
  • CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).

The following non-security bugs were fixed:
  • HID: Fix slab-out-of-bounds read in hid_field_extract (bsc#1180052).
  • cifs: bugfix for unreclaimed writeback pages in cifs_writev_requeue() (bsc#1177906).
  • mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (bsc#1175691).
  • net/x25: fix a race in x25_bind() (bsc#1178590).
  • net/x25: prevent a couple of overflows (bsc#1178590).
  • tty: fix memleak in alloc_pid (bsc#1179745).
  • xfs: mark all internal workqueues as freezable (bsc#1181166).

Special Instructions and Notes:

Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Server 11-SP4-LTSS:
    zypper in -t patch slessp4-kernel-source-14630=1
  • SUSE Linux Enterprise Server 11-EXTRA:
    zypper in -t patch slexsp3-kernel-source-14630=1
  • SUSE Linux Enterprise Debuginfo 11-SP4:
    zypper in -t patch dbgsp4-kernel-source-14630=1

Package List:

  • SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64):
    • kernel-default-3.0.101-108.120.1
    • kernel-default-base-3.0.101-108.120.1
    • kernel-default-devel-3.0.101-108.120.1
    • kernel-source-3.0.101-108.120.1
    • kernel-syms-3.0.101-108.120.1
    • kernel-trace-3.0.101-108.120.1
    • kernel-trace-base-3.0.101-108.120.1
    • kernel-trace-devel-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-SP4-LTSS (i586 x86_64):
    • kernel-ec2-3.0.101-108.120.1
    • kernel-ec2-base-3.0.101-108.120.1
    • kernel-ec2-devel-3.0.101-108.120.1
    • kernel-xen-3.0.101-108.120.1
    • kernel-xen-base-3.0.101-108.120.1
    • kernel-xen-devel-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-SP4-LTSS (ppc64):
    • kernel-bigmem-3.0.101-108.120.1
    • kernel-bigmem-base-3.0.101-108.120.1
    • kernel-bigmem-devel-3.0.101-108.120.1
    • kernel-ppc64-3.0.101-108.120.1
    • kernel-ppc64-base-3.0.101-108.120.1
    • kernel-ppc64-devel-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-SP4-LTSS (s390x):
    • kernel-default-man-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-SP4-LTSS (i586):
    • kernel-pae-3.0.101-108.120.1
    • kernel-pae-base-3.0.101-108.120.1
    • kernel-pae-devel-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64):
    • kernel-default-extra-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64):
    • kernel-xen-extra-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-EXTRA (x86_64):
    • kernel-trace-extra-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-EXTRA (ppc64):
    • kernel-ppc64-extra-3.0.101-108.120.1
  • SUSE Linux Enterprise Server 11-EXTRA (i586):
    • kernel-pae-extra-3.0.101-108.120.1
  • SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64):
    • kernel-default-debuginfo-3.0.101-108.120.1
    • kernel-default-debugsource-3.0.101-108.120.1
    • kernel-trace-debuginfo-3.0.101-108.120.1
    • kernel-trace-debugsource-3.0.101-108.120.1
  • SUSE Linux Enterprise Debuginfo 11-SP4 (i586 s390x x86_64):
    • kernel-default-devel-debuginfo-3.0.101-108.120.1
    • kernel-trace-devel-debuginfo-3.0.101-108.120.1
  • SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64):
    • kernel-ec2-debuginfo-3.0.101-108.120.1
    • kernel-ec2-debugsource-3.0.101-108.120.1
    • kernel-xen-debuginfo-3.0.101-108.120.1
    • kernel-xen-debugsource-3.0.101-108.120.1
    • kernel-xen-devel-debuginfo-3.0.101-108.120.1
  • SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64):
    • kernel-bigmem-debuginfo-3.0.101-108.120.1
    • kernel-bigmem-debugsource-3.0.101-108.120.1
    • kernel-ppc64-debuginfo-3.0.101-108.120.1
    • kernel-ppc64-debugsource-3.0.101-108.120.1
  • SUSE Linux Enterprise Debuginfo 11-SP4 (i586):
    • kernel-pae-debuginfo-3.0.101-108.120.1
    • kernel-pae-debugsource-3.0.101-108.120.1
    • kernel-pae-devel-debuginfo-3.0.101-108.120.1