Security vulnerability: CVE-2022-25636, a heap out of bounds write in the Linux kernel.
This document (000020615) is provided subject to the disclaimer at the end of this document.
zypper lp -a --cve=CVE-2022-25636
After a kernel update a restart is required. Unless using SUSE Linux Enterprise Live Patching extension, for which SUSE provides the live patch to fix this vulnerability allowing to patch the kernel without shutting down the system and reducing the need for planned downtime and increasing service availability.
Please note that user namespaces are required to run Linux containers. If containers are in use, the following workaround is not suitable.
The workaround can be implemented by deny unprivileged users to run unshare(CLONE_NEWUSER) or unshare(CLONE_NEWNET):
echo 0 > /proc/sys/user/max_user_namespaces
this change will be lost as soon as the operating system is rebooted. To make a permanent change, set the following value in the "/etc/sysctl.d/" directory:
echo "user.max_user_namespaces = 0" > /etc/sysctl.d/disable_user_namespaces.conf
then the system configuration files need to be reloaded:
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000020615
- Creation Date: 16-Mar-2022
- Modified Date:16-Mar-2022
- SUSE Linux Enterprise Desktop
- SUSE Linux Enterprise Real Time
- SUSE Linux Enterprise Server
- SUSE Linux Enterprise Server for SAP Applications
- SUSE Open Stack Cloud
- SUSE Manager
- SUSE Linux Enterprise Micro
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com