Security update for the Linux Kernel

Announcement ID: SUSE-SU-2022:4272-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2021-4037 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
  • CVE-2021-4037 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-2153 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
  • CVE-2022-2153 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-2964 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-2964 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3169 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3169 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3424 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3424 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3521 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3521 ( NVD ): 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2022-3524 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3524 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3542 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3542 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3545 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3545 ( NVD ): 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
  • CVE-2022-3565 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3565 ( NVD ): 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
  • CVE-2022-3586 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3586 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3594 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3594 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  • CVE-2022-3621 ( SUSE ): 4.3 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3621 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3629 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2022-3629 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2022-3629 ( NVD ): 2.6 CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2022-3646 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2022-3646 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2022-3649 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  • CVE-2022-3649 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-40307 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-40307 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-40768 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2022-40768 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  • CVE-2022-42703 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-42703 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-43750 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-43750 ( NVD ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise High Availability Extension 12 SP5
  • SUSE Linux Enterprise High Performance Computing 12 SP5
  • SUSE Linux Enterprise Live Patching 12-SP5
  • SUSE Linux Enterprise Server 12 SP5
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5
  • SUSE Linux Enterprise Software Development Kit 12 SP5
  • SUSE Linux Enterprise Workstation Extension 12 12-SP5

An update that solves 20 vulnerabilities and has 11 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
  • CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS (bnc#1200788).
  • CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686).
  • CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET are sent (bnc#1203290).
  • CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
  • CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
  • CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
  • CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
  • CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
  • CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bnc#1204439).
  • CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
  • CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
  • CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
  • CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
  • CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
  • CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c (bnc#1203322).
  • CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bnc#1203514).
  • CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
  • CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bnc#1204653).

The following non-security bugs were fixed:

  • ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems (bnc#1203802).
  • ACPI: processor_idle: Skip dummy wait if kernel is in guest (bnc#1203802).
  • Input: gscps2 - check return value of ioremap() in gscps2_probe() (git-fixes).
  • Input: xpad - add supported devices as contributed on github (git-fixes).
  • KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility (git-fixes).
  • USB: core: Fix RST error in hub.c (git-fixes).
  • USB: serial: ch341: add basis for quirk detection (git-fixes).
  • USB: serial: ch341: fix lockup of devices with limited prescaler (git-fixes).
  • USB: serial: ch341: fix lost character on LCR updates (git-fixes).
  • USB: serial: ch341: fix receiver regression (git-fixes).
  • USB: serial: ch341: reimplement line-speed handling (git-fixes).
  • USB: serial: cp210x: add Decagon UCA device id (git-fixes).
  • USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id (git-fixes).
  • USB: serial: option: add Quectel BG95 0x0203 composition (git-fixes).
  • USB: serial: option: add Quectel EM060K modem (git-fixes).
  • USB: serial: option: add Quectel RM520N (git-fixes).
  • USB: serial: option: add support for OPPO R11 diag port (git-fixes).
  • amd-xgbe: Update DMA coherency values (git-fixes).
  • bnxt: do not lock the tx queue from napi poll (git-fixes).
  • bnxt_en: Fix RX consumer index logic in the error path (git-fixes).
  • bnxt_en: reverse order of TX disable and carrier off (git-fixes).
  • ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() (git-fixes).
  • i40e: Fix flow for IPv6 next header (extension header) (git-fixes).
  • i40e: Fix overwriting flow control settings during driver loading (git-fixes).
  • i40e: improve locking of mac_filter_hash (git-fixes).
  • ip6: fix skb leak in ip6frag_expire_frag_queue (bsc#1202972)
  • locking/csd_lock: Change csdlock_debug from early_param to __setup (git-fixes).
  • memcg, kmem: do not fail __GFP_NOFAIL charges (bsc#1204755).
  • net/mlx4: Fix EEPROM dump support (git-fixes).
  • net/mlx4_core: Add missed mlx4_free_cmd_mailbox() (git-fixes).
  • net/mlx5e: Remove dependency in IPsec initialization flows (git-fixes).
  • net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning (git-fixes).
  • net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP (git-fixes).
  • net: amd-xgbe: Reset link when the link never comes back (git-fixes).
  • net: dsa: mt7530: add the missing RxUnicast MIB counter (git-fixes).
  • net: ethernet: ezchip: fix UAF in nps_enet_remove (git-fixes).
  • net: lapbether: Prevent racing when checking whether the netif is running (git-fixes).
  • net: marvell: fix MVNETA_TX_IN_PRGRS bit number (git-fixes).
  • net: mvpp2: Put fwnode in error case during ->probe() (git-fixes).
  • net: stmmac: fix watchdog timeout during suspend/resume stress test (git-fixes).
  • net: stmmac: stop each tx channel independently (git-fixes).
  • net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 (git-fixes).
  • net: vxge: fix use-after-free in vxge_device_unregister (git-fixes).
  • nvmem: core: Check input parameter for NULL in nvmem_unregister() (bsc#1204241).
  • powerpc/mm/64s: Drop pgd_huge() (bsc#1065729).
  • powerpc/mm: remove pmd_huge/pud_huge stubs and include hugetlb.h (bsc#1065729).
  • powerpc/pci_dn: Add missing of_node_put() (bsc#1065729).
  • powerpc/powernv: add missing of_node_put() in opal_export_attrs() (bsc#1065729).
  • ppp: Fix generating ifname when empty IFLA_IFNAME is specified (git-fixes).
  • ppp: Fix generating ppp unit id when ifname is not specified (git-fixes).
  • quota: widen timestamps for the fs_disk_quota structure (bsc#1203387).
  • r8169: fix jumbo packet handling on RTL8168e (git-fixes).
  • s390/guarded storage: simplify task exit handling (bsc#1203254 LTC#199911).
  • s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages (bsc#1203142 LTC#199883).
  • s390/hypfs: avoid error message under KVM (bsc#1032323).
  • s390/mm: do not trigger write fault when vma does not allow VM_WRITE (bsc#1203198 LTC#199898).
  • s390: fix double free of GS and RI CBs on fork() failure (bsc#1203254 LTC#199911).
  • x86/xen: Remove undefined behavior in setup_features() (git-fixes).
  • xfs: account finobt blocks properly in perag reservation (bsc#1203387).
  • xfs: enable big timestamps (bsc#1203387).
  • xfs: enable new inode btree counters feature (bsc#1203387).
  • xfs: explicitly define inode timestamp range (bsc#1203387).
  • xfs: preserve default grace interval during quotacheck (bsc#1203387).
  • xfs: quota: move to time64_t interfaces (bsc#1203387).
  • xfs: redefine xfs_ictimestamp_t (bsc#1203387).
  • xfs: redefine xfs_timestamp_t (bsc#1203387).
  • xfs: store inode btree block counts in AGI header (bsc#1203387).
  • xfs: use a struct timespec64 for the in-core crtime (bsc#1203387).
  • xfs: use the finobt block counts to speed up mount times (bsc#1203387).
  • xfs: widen ondisk inode timestamps to deal with y2038+ (bsc#1203387).
  • xfs: widen ondisk quota expiration timestamps to handle y2038+ (bsc#1203387).

Special Instructions and Notes:

  • Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Server for SAP Applications 12 SP5
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4272=1 SUSE-SLE-HA-12-SP5-2022-4272=1
  • SUSE Linux Enterprise High Availability Extension 12 SP5
    zypper in -t patch SUSE-SLE-HA-12-SP5-2022-4272=1
  • SUSE Linux Enterprise Live Patching 12-SP5
    zypper in -t patch SUSE-SLE-Live-Patching-12-SP5-2022-4272=1
  • SUSE Linux Enterprise Software Development Kit 12 SP5
    zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-4272=1
  • SUSE Linux Enterprise High Performance Computing 12 SP5
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4272=1
  • SUSE Linux Enterprise Server 12 SP5
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4272=1
  • SUSE Linux Enterprise Workstation Extension 12 12-SP5
    zypper in -t patch SUSE-SLE-WE-12-SP5-2022-4272=1

Package List:

  • SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
    • gfs2-kmp-default-debuginfo-4.12.14-122.139.1
    • cluster-md-kmp-default-4.12.14-122.139.1
    • cluster-md-kmp-default-debuginfo-4.12.14-122.139.1
    • gfs2-kmp-default-4.12.14-122.139.1
    • kernel-default-debuginfo-4.12.14-122.139.1
    • kernel-default-debugsource-4.12.14-122.139.1
    • ocfs2-kmp-default-4.12.14-122.139.1
    • kernel-default-base-4.12.14-122.139.1
    • kernel-default-base-debuginfo-4.12.14-122.139.1
    • ocfs2-kmp-default-debuginfo-4.12.14-122.139.1
    • kernel-default-devel-4.12.14-122.139.1
    • dlm-kmp-default-4.12.14-122.139.1
    • dlm-kmp-default-debuginfo-4.12.14-122.139.1
    • kernel-syms-4.12.14-122.139.1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5 (nosrc ppc64le x86_64)
    • kernel-default-4.12.14-122.139.1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch)
    • kernel-devel-4.12.14-122.139.1
    • kernel-macros-4.12.14-122.139.1
    • kernel-source-4.12.14-122.139.1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64)
    • kernel-default-devel-debuginfo-4.12.14-122.139.1
  • SUSE Linux Enterprise High Availability Extension 12 SP5 (ppc64le s390x x86_64)
    • gfs2-kmp-default-debuginfo-4.12.14-122.139.1
    • cluster-md-kmp-default-4.12.14-122.139.1
    • cluster-md-kmp-default-debuginfo-4.12.14-122.139.1
    • gfs2-kmp-default-4.12.14-122.139.1
    • kernel-default-debuginfo-4.12.14-122.139.1
    • kernel-default-debugsource-4.12.14-122.139.1
    • ocfs2-kmp-default-4.12.14-122.139.1
    • ocfs2-kmp-default-debuginfo-4.12.14-122.139.1
    • dlm-kmp-default-4.12.14-122.139.1
    • dlm-kmp-default-debuginfo-4.12.14-122.139.1
  • SUSE Linux Enterprise High Availability Extension 12 SP5 (nosrc)
    • kernel-default-4.12.14-122.139.1
  • SUSE Linux Enterprise Live Patching 12-SP5 (nosrc)
    • kernel-default-4.12.14-122.139.1
  • SUSE Linux Enterprise Live Patching 12-SP5 (ppc64le s390x x86_64)
    • kernel-default-kgraft-devel-4.12.14-122.139.1
    • kernel-default-debuginfo-4.12.14-122.139.1
    • kernel-default-debugsource-4.12.14-122.139.1
    • kernel-default-kgraft-4.12.14-122.139.1
    • kgraft-patch-4_12_14-122_139-default-1-8.3.1
  • SUSE Linux Enterprise Software Development Kit 12 SP5 (noarch nosrc)
    • kernel-docs-4.12.14-122.139.1
  • SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64)
    • kernel-obs-build-4.12.14-122.139.1
    • kernel-obs-build-debugsource-4.12.14-122.139.1
  • SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 nosrc x86_64)
    • kernel-default-4.12.14-122.139.1
  • SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)
    • kernel-default-base-debuginfo-4.12.14-122.139.1
    • kernel-default-base-4.12.14-122.139.1
    • kernel-default-debuginfo-4.12.14-122.139.1
    • kernel-default-debugsource-4.12.14-122.139.1
    • kernel-default-devel-4.12.14-122.139.1
    • kernel-syms-4.12.14-122.139.1
  • SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch)
    • kernel-devel-4.12.14-122.139.1
    • kernel-macros-4.12.14-122.139.1
    • kernel-source-4.12.14-122.139.1
  • SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64)
    • kernel-default-devel-debuginfo-4.12.14-122.139.1
  • SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64 nosrc)
    • kernel-default-4.12.14-122.139.1
  • SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)
    • kernel-default-base-debuginfo-4.12.14-122.139.1
    • kernel-default-base-4.12.14-122.139.1
    • kernel-default-debuginfo-4.12.14-122.139.1
    • kernel-default-debugsource-4.12.14-122.139.1
    • kernel-default-devel-4.12.14-122.139.1
    • kernel-syms-4.12.14-122.139.1
  • SUSE Linux Enterprise Server 12 SP5 (noarch)
    • kernel-devel-4.12.14-122.139.1
    • kernel-macros-4.12.14-122.139.1
    • kernel-source-4.12.14-122.139.1
  • SUSE Linux Enterprise Server 12 SP5 (s390x)
    • kernel-default-man-4.12.14-122.139.1
  • SUSE Linux Enterprise Server 12 SP5 (x86_64)
    • kernel-default-devel-debuginfo-4.12.14-122.139.1
  • SUSE Linux Enterprise Workstation Extension 12 12-SP5 (nosrc)
    • kernel-default-4.12.14-122.139.1
  • SUSE Linux Enterprise Workstation Extension 12 12-SP5 (x86_64)
    • kernel-default-extra-debuginfo-4.12.14-122.139.1
    • kernel-default-extra-4.12.14-122.139.1
    • kernel-default-debuginfo-4.12.14-122.139.1
    • kernel-default-debugsource-4.12.14-122.139.1

References: