Security update for the Linux Kernel (Live Patch 4 for SLE 12 SP5)

Announcement ID:	SUSE-SU-2021:1365-1
Rating:	important
References:	bsc#1182294 bsc#1183658 bsc#1184171
Cross-References:	CVE-2021-26930 CVE-2021-26931 CVE-2021-28660 CVE-2021-28688 CVE-2021-3444
CVSS scores:	CVE-2021-26930 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-26930 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-26931 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-26931 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28660 ( SUSE ): 8.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-28660 ( NVD ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28688 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-28688 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-3444 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3444 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise Live Patching 15-SP2 SUSE Linux Enterprise Live Patching 15-SP1 SUSE Linux Enterprise Live Patching 12-SP5 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2

An update that solves five vulnerabilities can now be installed.

Description:

This update for the Linux Kernel 4.12.14-122_20 fixes several issues.

The following security issues were fixed:

• CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184171).
• CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183658).
• CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc##1182294, bsc#1183646).
• CVE-2021-26930: Fixed an improper error handling in blkback's grant mapping (XSA-365 bsc#1182294).
• CVE-2021-26931: Fixed an issue where Linux kernel was treating grant mapping errors as bugs (XSA-362 bsc#1183022).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Live Patching 12-SP5
  zypper in -t patch SUSE-SLE-Live-Patching-12-SP5-2021-1348=1 SUSE-SLE-Live-Patching-12-SP5-2021-1349=1 SUSE-SLE-Live-Patching-12-SP5-2021-1350=1 SUSE-SLE-Live-Patching-12-SP5-2021-1351=1 SUSE-SLE-Live-Patching-12-SP5-2021-1352=1 SUSE-SLE-Live-Patching-12-SP5-2021-1353=1 SUSE-SLE-Live-Patching-12-SP5-2021-1354=1 SUSE-SLE-Live-Patching-12-SP5-2021-1355=1 SUSE-SLE-Live-Patching-12-SP5-2021-1356=1 SUSE-SLE-Live-Patching-12-SP5-2021-1357=1 SUSE-SLE-Live-Patching-12-SP5-2021-1358=1 SUSE-SLE-Live-Patching-12-SP5-2021-1359=1 SUSE-SLE-Live-Patching-12-SP5-2021-1375=1
• SUSE Linux Enterprise Live Patching 15-SP1
  zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2021-1365=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1366=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1367=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1368=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1377=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1378=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1379=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1380=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1381=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1382=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1383=1 SUSE-SLE-Module-Live-Patching-15-SP1-2021-1384=1
• SUSE Linux Enterprise Live Patching 15-SP2
  zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2021-1391=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1392=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1393=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1394=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1369=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1370=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1386=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1387=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1388=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1389=1 SUSE-SLE-Module-Live-Patching-15-SP2-2021-1390=1

Package List:

• SUSE Linux Enterprise Live Patching 12-SP5 (ppc64le s390x x86_64)
  • kgraft-patch-4_12_14-122_63-default-3-2.2
  • kgraft-patch-4_12_14-122_26-default-11-2.2
  • kgraft-patch-4_12_14-122_46-default-7-2.2
  • kgraft-patch-4_12_14-122_37-default-10-2.2
  • kgraft-patch-4_12_14-122_20-default-12-2.2
  • kgraft-patch-4_12_14-122_51-default-7-2.2
  • kgraft-patch-4_12_14-122_23-default-11-2.2
  • kgraft-patch-4_12_14-122_57-default-5-2.2
  • kgraft-patch-4_12_14-122_29-default-11-2.2
  • kgraft-patch-4_12_14-122_41-default-9-2.2
  • kgraft-patch-4_12_14-122_32-default-11-2.2
  • kgraft-patch-4_12_14-122_60-default-4-2.2
  • kgraft-patch-4_12_14-122_54-default-5-2.2
• SUSE Linux Enterprise Live Patching 15-SP1 (ppc64le x86_64)
  • kernel-livepatch-4_12_14-197_56-default-8-2.2
  • kernel-livepatch-4_12_14-197_45-default-9-2.2
  • kernel-livepatch-4_12_14-197_51-default-9-2.2
  • kernel-livepatch-4_12_14-197_64-default-6-2.2
  • kernel-livepatch-4_12_14-197_72-default-5-2.2
  • kernel-livepatch-4_12_14-197_78-default-5-2.2
  • kernel-livepatch-4_12_14-197_75-default-5-2.2
  • kernel-livepatch-4_12_14-197_83-default-4-2.2
  • kernel-livepatch-4_12_14-197_61-default-7-2.2
  • kernel-livepatch-4_12_14-197_40-default-11-2.2
  • kernel-livepatch-4_12_14-197_48-default-9-2.2
  • kernel-livepatch-4_12_14-197_67-default-6-2.2
• SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le s390x x86_64)
  • kernel-livepatch-SLE15-SP2_Update_10-debugsource-4-2.2
  • kernel-livepatch-5_3_18-24_12-default-debuginfo-8-2.2
  • kernel-livepatch-5_3_18-22-default-10-5.2
  • kernel-livepatch-5_3_18-24_37-default-debuginfo-6-2.2
  • kernel-livepatch-5_3_18-24_43-default-debuginfo-5-2.2
  • kernel-livepatch-SLE15-SP2_Update_0-debugsource-10-5.2
  • kernel-livepatch-5_3_18-24_9-default-9-2.2
  • kernel-livepatch-SLE15-SP2_Update_3-debugsource-8-2.2
  • kernel-livepatch-SLE15-SP2_Update_9-debugsource-5-2.2
  • kernel-livepatch-5_3_18-24_9-default-debuginfo-9-2.2
  • kernel-livepatch-5_3_18-24_49-default-4-2.2
  • kernel-livepatch-5_3_18-24_29-default-debuginfo-6-2.2
  • kernel-livepatch-5_3_18-24_49-default-debuginfo-4-2.2
  • kernel-livepatch-5_3_18-24_34-default-debuginfo-6-2.2
  • kernel-livepatch-5_3_18-24_43-default-5-2.2
  • kernel-livepatch-5_3_18-24_15-default-debuginfo-8-2.2
  • kernel-livepatch-5_3_18-22-default-debuginfo-10-5.2
  • kernel-livepatch-SLE15-SP2_Update_5-debugsource-6-2.2
  • kernel-livepatch-SLE15-SP2_Update_8-debugsource-5-2.2
  • kernel-livepatch-5_3_18-24_34-default-6-2.2
  • kernel-livepatch-SLE15-SP2_Update_4-debugsource-8-2.2
  • kernel-livepatch-SLE15-SP2_Update_2-debugsource-8-2.2
  • kernel-livepatch-5_3_18-24_24-default-debuginfo-8-2.2
  • kernel-livepatch-5_3_18-24_15-default-8-2.2
  • kernel-livepatch-5_3_18-24_12-default-8-2.2
  • kernel-livepatch-5_3_18-24_24-default-8-2.2
  • kernel-livepatch-SLE15-SP2_Update_6-debugsource-6-2.2
  • kernel-livepatch-SLE15-SP2_Update_1-debugsource-9-2.2
  • kernel-livepatch-5_3_18-24_37-default-6-2.2
  • kernel-livepatch-5_3_18-24_46-default-5-2.2
  • kernel-livepatch-5_3_18-24_46-default-debuginfo-5-2.2
  • kernel-livepatch-SLE15-SP2_Update_7-debugsource-6-2.2
  • kernel-livepatch-5_3_18-24_29-default-6-2.2

References:

• https://www.suse.com/security/cve/CVE-2021-26930.html
• https://www.suse.com/security/cve/CVE-2021-26931.html
• https://www.suse.com/security/cve/CVE-2021-28660.html
• https://www.suse.com/security/cve/CVE-2021-28688.html
• https://www.suse.com/security/cve/CVE-2021-3444.html
• https://bugzilla.suse.com/show_bug.cgi?id=1182294
• https://bugzilla.suse.com/show_bug.cgi?id=1183658
• https://bugzilla.suse.com/show_bug.cgi?id=1184171