Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP2) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:1395-1 Final 1 1 2021-04-28T07:22:38Z current 2021-04-28T07:22:38Z 2021-04-28T07:22:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP2) This update for the Linux Kernel 5.3.18-24_52 fixes several issues. The following security issues were fixed: - CVE-2021-3444: Fixed an issue with the bpf verifier which did not properly handle mod32 destination register truncation when the source register was known to be 0 leading to out of bounds read (bsc#1184171). - CVE-2021-28660: Fixed an out of bounds write in rtw_wx_set_scan (bsc#1183658). - CVE-2021-28688: Fixed an issue introduced by XSA-365 (bsc##1182294, bsc#1183646). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-1395,SUSE-SLE-Module-Live-Patching-15-SP1-2021-1385,SUSE-SLE-Module-Live-Patching-15-SP2-2021-1395 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20211395-1/ Link for SUSE-SU-2021:1395-1 https://lists.suse.com/pipermail/sle-security-updates/2021-April/008686.html E-Mail link for SUSE-SU-2021:1395-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1182294 SUSE Bug 1182294 https://bugzilla.suse.com/1183658 SUSE Bug 1183658 https://bugzilla.suse.com/1184171 SUSE Bug 1184171 https://www.suse.com/security/cve/CVE-2021-28660/ SUSE CVE CVE-2021-28660 page https://www.suse.com/security/cve/CVE-2021-28688/ SUSE CVE CVE-2021-28688 page https://www.suse.com/security/cve/CVE-2021-3444/ SUSE CVE CVE-2021-3444 page SUSE Linux Enterprise Live Patching 15 SP1 SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_52-default-3-2.2 kernel-livepatch-5_3_18-24_52-preempt-3-2.2 kernel-livepatch-4_12_14-197_86-default-3-2.2 kernel-livepatch-4_12_14-197_86-default-3-2.2 as a component of SUSE Linux Enterprise Live Patching 15 SP1 kernel-livepatch-5_3_18-24_52-default-3-2.2 as a component of SUSE Linux Enterprise Live Patching 15 SP2 rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base. CVE-2021-28660 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_86-default-3-2.2 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_52-default-3-2.2 important 8.3 AV:A/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211395-1/ https://www.suse.com/security/cve/CVE-2021-28660.html CVE-2021-28660 https://bugzilla.suse.com/1183593 SUSE Bug 1183593 https://bugzilla.suse.com/1183658 SUSE Bug 1183658 The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11. CVE-2021-28688 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_86-default-3-2.2 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_52-default-3-2.2 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211395-1/ https://www.suse.com/security/cve/CVE-2021-28688.html CVE-2021-28688 https://bugzilla.suse.com/1183646 SUSE Bug 1183646 The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101. CVE-2021-3444 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_86-default-3-2.2 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_52-default-3-2.2 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211395-1/ https://www.suse.com/security/cve/CVE-2021-3444.html CVE-2021-3444 https://bugzilla.suse.com/1184170 SUSE Bug 1184170 https://bugzilla.suse.com/1184171 SUSE Bug 1184171