Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2438-1 Final 1 1 2021-07-21T11:46:47Z current 2021-07-21T11:46:47Z 2021-07-21T11:46:47Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-22555: A heap out-of-bounds write was discovered in net/netfilter/x_tables.c (bnc#1188116). - CVE-2021-33909: Extremely large seq buffer allocations in seq_file could lead to buffer underruns and code execution (bsc#1188062). - CVE-2021-3609: A use-after-free in can/bcm could have led to privilege escalation (bsc#1187215). - CVE-2021-3612: An out-of-bounds memory write flaw was found in the joystick devices subsystem in the way the user calls ioctl JSIOCSBTNMAP. This flaw allowed a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability (bnc#1187585 ). - CVE-2021-35039: kernel/module.c mishandled Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, did not occur for a module.sig_enforce=1 command-line argument (bnc#1188080). NOTE that SUSE kernels are configured with CONFIG_MODULE_SIG=y, so are not affected. The following non-security bugs were fixed: - ACPI: APEI: fix synchronous external aborts in user-mode (git-fixes). - ACPI: bus: Call kobject_put() in acpi_init() error path (git-fixes). - ACPICA: Fix memory leak caused by _CID repair function (git-fixes). - ACPI: EC: Make more Asus laptops use ECDT _GPE (git-fixes). - ACPI: processor idle: Fix up C-state latency if not ordered (git-fixes). - ACPI: property: Constify stubs for CONFIG_ACPI=n case (git-fixes). - ACPI: resources: Add checks for ACPI IRQ override (git-fixes). - ACPI: sysfs: Fix a buffer overrun problem with description_show() (git-fixes). - ALSA: hda/realtek: Add another ALC236 variant support (git-fixes). - ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D (git-fixes). - ALSA: intel8x0: Fix breakage at ac97 clock measurement (git-fixes). - ALSA: isa: Fix error return code in snd_cmi8330_probe() (git-fixes). - ALSA: usb-audio: fix rate on Ozone Z90 USB headset (git-fixes). - ALSA: usb-audio: scarlett2: Fix wrong resume call (git-fixes). - ALSA: usb-audio: scarlett2: Read mixer volumes at init time (git-fixes). - ALSA: usb-audio: scarlett2: Read mux at init time (git-fixes). - amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create (bsc#1152472) - ASoC: atmel-i2s: Fix usage of capture and playback at the same time (git-fixes). - ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK (git-fixes). - ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() (git-fixes). - ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' (git-fixes). - ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() (git-fixes). - ata: ahci_sunxi: Disable DIPM (git-fixes). - ath10k: add missing error return code in ath10k_pci_probe() (git-fixes). - ath10k: Fix an error code in ath10k_add_interface() (git-fixes). - ath10k: go to path err_unsupported when chip id is not supported (git-fixes). - ath10k: remove unused more_frags variable (git-fixes). - ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() (git-fixes). - backlight: lm3630a_bl: Put fwnode in error case during ->probe() (git-fixes). - Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event (git-fixes). - Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (git-fixes). - brcmfmac: correctly report average RSSI in station info (git-fixes). - brcmfmac: fix setting of station info chains bitmask (git-fixes). - brcmsmac: mac80211_if: Fix a resource leak in an error handling path (git-fixes). - can: gw: synchronize rcu operations before removing gw job entry (git-fixes). - can: hi311x: hi3110_can_probe(): silence clang warning (git-fixes). - can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path (git-fixes). - cfg80211: call cfg80211_leave_ocb when switching away from OCB (git-fixes). - char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() (git-fixes). - clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC (git-fixes). - clk: actions: Fix SD clocks factor table on Owl S500 SoC (git-fixes). - clk: actions: Fix UART clock dividers on Owl S500 SoC (git-fixes). - clk: meson: g12a: fix gp0 and hifi ranges (git-fixes). - clk: renesas: rcar-gen3: Update Z clock rate formula in comments (git-fixes). - clk: si5341: Avoid divide errors due to bogus register contents (git-fixes). - clk: si5341: Update initialization magic (git-fixes). - clk: zynqmp: pll: Remove some dead code (git-fixes). - clocksource: Retry clock read if long delays detected (git-fixes). - cpufreq: sc520_freq: add 'fallthrough' to one case (git-fixes). - crypto: ccp - Fix a resource leak in an error handling path (git-fixes). - crypto: ixp4xx - dma_unmap the correct address (git-fixes). - crypto: nitrox - fix unchecked variable in nitrox_register_interrupts (git-fixes). - crypto: nx - add missing MODULE_DEVICE_TABLE (git-fixes). - crypto: omap-sham - Fix PM reference leak in omap sham ops (git-fixes). - crypto: qat - check return code of qat_hal_rd_rel_reg() (git-fixes). - crypto: qat - remove unused macro in FW loader (git-fixes). - crypto: ux500 - Fix error return code in hash_hw_final() (git-fixes). - dmaengine: mediatek: do not issue a new desc if one is still current (git-fixes). - dmaengine: mediatek: free the proper desc in desc_free handler (git-fixes). - dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma (git-fixes). - dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe() (git-fixes). - dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc() (git-fixes). - docs: admin-guide: update description for kernel.hotplug sysctl (git-fixes). - dpaa2-eth: fix memory leak in XDP_REDIRECT (git-fixes). - drm/amdgpu: Do not query CE and UE errors (bsc#1152472) - drm: bridge/panel: Cleanup connector on bridge detach (bsc#1152489) - drm/mcde/panel: Inverse misunderstood flag (bsc#1152472) - drm/msm/dpu: Fix error return code in dpu_mdss_init() (git-fixes). - drm/msm: Small msm_gem_purge() fix (bsc#1152489) - drm/nouveau: wait for moving fence after pinning v2 (git-fixes). - drm: qxl: ensure surf.data is ininitialized (git-fixes). - drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() (bsc#1152489) - drm/radeon: wait for moving fence after pinning (git-fixes). - drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write() (git-fixes). - drm/rockchip: dsi: move all lane config except LCDC mux to bind() (git-fixes). - drm/rockchip: dsi: remove extra component_del() call (git-fixes). - drm/stm: Fix bus_flags handling (bsc#1152472) - drm/vc4: hdmi: Make sure the controller is powered in detect (bsc#1152489) - extcon: extcon-max8997: Fix IRQ freeing at error path (git-fixes). - extcon: intel-mrfld: Sync hardware and software state on init (git-fixes). - extcon: max8997: Add missing modalias string (git-fixes). - extcon: sm5502: Drop invalid register write in sm5502_reg_data (git-fixes). - firmware: tegra: Fix error return code in tegra210_bpmp_init() (git-fixes). - Fix meta data in lpfc-decouple-port_template-and-vport_template.patch - fix patches metadata - fm10k: Fix an error handling path in 'fm10k_probe()' (git-fixes). - fpga: machxo2-spi: Address warning about unused variable (git-fixes). - fpga: stratix10-soc: Add missing fpga_mgr_free() call (git-fixes). - fuse: check connected before queueing on fpq->io (bsc#1188267). - fuse: ignore PG_workingset after stealing (bsc#1188268). - fuse: reject internal errno (bsc#1188269). - gpio: AMD8111 and TQMX86 require HAS_IOPORT_MAP (git-fixes). - gve: Fix an error handling path in 'gve_probe()' (git-fixes). - gve: Fix swapped vars when fetching max queues (git-fixes). - HID: do not use down_interruptible() when unbinding devices (git-fixes). - HID: wacom: Correct base usage for capacitive ExpressKey status bits (git-fixes). - hwmon: (max31722) Remove non-standard ACPI device IDs (git-fixes). - hwmon: (max31790) Fix fan speed reporting for fan7..12 (git-fixes). - hwmon: (max31790) Fix pwmX_enable attributes (git-fixes). - hwmon: (max31790) Report correct current pwm duty cycles (git-fixes). - hwrng: exynos - Fix runtime PM imbalance on error (git-fixes). - i2c: dev: Add __user annotation (git-fixes). - i2c: robotfuzz-osif: fix control-request directions (git-fixes). - ibmvnic: account for bufs already saved in indir_buf (jsc#SLE-17268 jsc#SLE-17043 bsc#1179243 ltc#189290). - ibmvnic: Allow device probe if the device is not ready at boot (bsc#1184114 ltc#192237). - ibmvnic: clean pending indirect buffs during reset (jsc#SLE-17268 jsc#SLE-17043 bsc#1179243 ltc#189290). - ibmvnic: fix kernel build warning (bsc#1184114 ltc#192237). - ibmvnic: fix kernel build warning in strncpy (bsc#1184114 ltc#192237). - ibmvnic: fix kernel build warnings in build_hdr_descs_arr (bsc#1184114 ltc#192237). - ibmvnic: fix send_request_map incompatible argument (bsc#1184114 ltc#192237). - ibmvnic: free tx_pool if tso_pool alloc fails (bsc#1085224 ltc#164363). - ibmvnic: parenthesize a check (bsc#1184114 ltc#192237 bsc#1183871 ltc#192139 git-fixes). - ibmvnic: set ltb->buff to NULL after freeing (bsc#1094840 ltc#167098). - ibmvnic: Use list_for_each_entry() to simplify code in ibmvnic.c (bsc#1184114 ltc#192237). - ibmvnic: Use 'skb_frag_address()' instead of hand coding it (bsc#1184114 ltc#192237). - ibmvnic: Use strscpy() instead of strncpy() (bsc#1184114 ltc#192237). - iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: accel: bma220: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: accel: hid: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: accel: kxcjk-1013: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio:accel:mxc4005: Drop unnecessary explicit casts in regmap_bulk_read calls (git-fixes). - iio: accel: mxc4005: Fix overread of data and alignment issue (git-fixes). - iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adc: at91-sama5d2: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adc: hx711: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adc: mxs-lradc: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adc: ti-ads1015: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adc: ti-ads8688: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adc: vf610: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: adis16400: do not return ints in irq handlers (git-fixes). - iio: adis_buffer: do not return ints in irq handlers (git-fixes). - iio: at91-sama5d2_adc: remove usage of iio_priv_to_dev() helper (git-fixes). - iio: gyro: bmg160: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: humidity: am2315: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: light: isl29125: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: light: tcs3472: do not free unallocated IRQ (git-fixes). - iio: light: tcs3472: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: ltr501: ltr501_read_ps(): add missing endianness conversion (git-fixes). - iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR (git-fixes). - iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too (git-fixes). - iio: magn: bmc150: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: magn: hmc5843: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: magn: rm3100: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: potentiostat: lmp91000: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: prox: as3935: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: prox: pulsed-light: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: prox: srf08: Fix buffer alignment in iio_push_to_buffers_with_timestamp() (git-fixes). - iio: si1133: fix format string warnings (git-fixes). - Input: hil_kbd - fix error return code in hil_dev_connect() (git-fixes). - Input: usbtouchscreen - fix control-request directions (git-fixes). - kABI: restore struct tcpc_config definition (git-fixes). - kernel-binary.spec: Exctract s390 decompression code (jsc#SLE-17042). - leds: as3645a: Fix error return code in as3645a_parse_node() (git-fixes). - leds: ktd2692: Fix an error handling path (git-fixes). - leds: lm3532: select regmap I2C API (git-fixes). - lib/decompressors: remove set but not used variabled 'level' (git-fixes). - lib: vsprintf: Fix handling of number field widths in vsscanf (git-fixes). - mac80211_hwsim: drop pending frames on stop (git-fixes). - mac80211: remove iwlwifi specific workaround NDPs of null_response (git-fixes). - mac80211: remove iwlwifi specific workaround that broke sta NDP tx (git-fixes). - mac80211: remove warning in ieee80211_get_sband() (git-fixes). - math: Export mul_u64_u64_div_u64 (git-fixes). - media: au0828: fix a NULL vs IS_ERR() check (git-fixes). - media: bt8xx: Fix a missing check bug in bt878_probe (git-fixes). - media: cobalt: fix race condition in setting HPD (git-fixes). - media: cpia2: fix memory leak in cpia2_usb_probe (git-fixes). - media: dtv5100: fix control-request directions (git-fixes). - media: dvb_net: avoid speculation from net slot (git-fixes). - media: dvb-usb: fix wrong definition (git-fixes). - media: dvd_usb: memory leak in cinergyt2_fe_attach (git-fixes). - media: em28xx: Fix possible memory leak of em28xx struct (git-fixes). - media: exynos4-is: Fix a use after free in isp_video_release (git-fixes). - media: exynos-gsc: fix pm_runtime_get_sync() usage count (git-fixes). - media: Fix Media Controller API config checks (git-fixes). - media: gspca/gl860: fix zero-length control requests (git-fixes). - media: gspca/sq905: fix control-request direction (git-fixes). - media: gspca/sunplus: fix zero-length control requests (git-fixes). - media: I2C: change 'RST' to 'RSET' to fix multiple build errors (git-fixes). - media: imx-csi: Skip first few frames from a BT.656 source (git-fixes). - media: imx: imx7_mipi_csis: Fix logging of only error event counters (git-fixes). - media: mdk-mdp: fix pm_runtime_get_sync() usage count (git-fixes). - media: mtk-vcodec: fix PM runtime get logic (git-fixes). - media: pvrusb2: fix warning in pvr2_i2c_core_done (git-fixes). - media: rc: i2c: Fix an error message (git-fixes). - media: rtl28xxu: fix zero-length control request (git-fixes). - media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx (git-fixes). - media: s5p-jpeg: fix pm_runtime_get_sync() usage count (git-fixes). - media: sh_vou: fix pm_runtime_get_sync() usage count (git-fixes). - media: siano: fix device register error path (git-fixes). - media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2() (git-fixes). - media: st-hva: Fix potential NULL pointer dereferences (git-fixes). - media: sti/bdisp: fix pm_runtime_get_sync() usage count (git-fixes). - media: sti: fix obj-$(config) targets (git-fixes). - media: tc358743: Fix error return code in tc358743_probe_of() (git-fixes). - media: v4l2-async: Fix trivial documentation typo (git-fixes). - media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release (git-fixes). - media: zr364xx: fix memory leak in zr364xx_start_readpipe (git-fixes). - memory: atmel-ebi: add missing of_node_put for loop iteration (git-fixes). - memory: fsl_ifc: fix leak of IO mapping on probe failure (git-fixes). - memory: fsl_ifc: fix leak of private memory on probe failure (git-fixes). - memory: pl353: Fix error return code in pl353_smc_probe() (git-fixes). - memstick: rtsx_usb_ms: fix UAF (git-fixes). - mmc: block: Disable CMDQ on the ioctl path (git-fixes). - mmc: core: clear flags before allowing to retune (git-fixes). - mmc: sdhci-esdhc-imx: remove unused is_imx6q_usdhc (git-fixes). - mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode (git-fixes). - mmc: sdhci-sprd: use sdhci_sprd_writew (git-fixes). - mmc: usdhi6rol0: fix error return code in usdhi6_probe() (git-fixes). - mmc: via-sdmmc: add a check against NULL pointer dereference (git-fixes). - mmc: vub3000: fix control-request direction (git-fixes). - mm, futex: fix shared futex pgoff on shmem huge page (git fixes (kernel/futex)). - mt76: fix possible NULL pointer dereference in mt76_tx (git-fixes). - mtd: partitions: redboot: seek fis-index-block in the right node (git-fixes). - mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume() (git-fixes). - mwifiex: re-fix for unaligned accesses (git-fixes). - nvme-rdma: fix in-casule data send for chained sgls (git-fixes). - nvme-rdma: introduce nvme_rdma_sgl structure (git-fixes). - nvme-tcp: rerun io_work if req_list is not empty (git-fixes). - nvme: verify MNAN value if ANA is enabled (bsc#1185791). - PCI: Add AMD RS690 quirk to enable 64-bit DMA (git-fixes). - pinctrl: stm32: fix the reported number of GPIO lines per bank (git-fixes). - platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() (git-fixes). - ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation (git-fixes). - r8152: Avoid memcpy() over-reading of ETH_SS_STATS (git-fixes). - r8169: Avoid memcpy() over-reading of ETH_SS_STATS (git-fixes). - random32: Fix implicit truncation warning in prandom_seed_state() (git-fixes). - regulator: da9052: Ensure enough delay time for .set_voltage_time_sel (git-fixes). - regulator: hi655x: Fix pass wrong pointer to config.driver_data (git-fixes). - regulator: uniphier: Add missing MODULE_DEVICE_TABLE (git-fixes). - reset: a10sr: add missing of_match_table reference (git-fixes). - reset: bail if try_module_get() fails (git-fixes). - reset: brcmstb: Add missing MODULE_DEVICE_TABLE (git-fixes). - Revert 'ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro' (git-fixes). - Revert 'ibmvnic: remove duplicate napi_schedule call in open function' (bsc#1065729). - rpm/kernel-binary.spec.in: Remove zdebug define used only once. - rsi: Assign beacon rate settings to the correct rate_info descriptor field (git-fixes). - rtc: fix snprintf() checking in is_rtc_hctosys() (git-fixes). - rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path (git-fixes). - scsi: qedf: Do not put host in qedf_vport_create() unconditionally (bsc#1170511). - serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates (git-fixes). - serial_cs: Add Option International GSM-Ready 56K/ISDN modem (git-fixes). - serial_cs: remove wrong GLOBETROTTER.cis entry (git-fixes). - serial: mvebu-uart: correctly calculate minimal possible baudrate (git-fixes). - serial: mvebu-uart: do not allow changing baudrate when uartclk is not available (git-fixes). - serial: mvebu-uart: fix calculation of clock divisor (git-fixes). - serial: tegra-tcu: Reorder channel initialization (git-fixes). - soc: fsl: qbman: Delete useless kfree code (bsc#1188176). - soc: fsl: qbman: Ensure device cleanup is run for kexec (bsc#1188176). - soundwire: stream: Fix test for DP prepare complete (git-fixes). - spi: fspi: dynamically alloc AHB memory (bsc#1188121). - spi: Make of_register_spi_device also set the fwnode (git-fixes). - spi: nxp-fspi: Use devm API to fix missed unregistration of controller (bsc#1188121). - spi: omap-100k: Fix the length judgment problem (git-fixes). - spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' (git-fixes). - spi: spi-nxp-fspi: Add ACPI support (bsc#1188121). - spi: spi-nxp-fspi: Add support for IP read only (bsc#1188121). - spi: spi-nxp-fspi: Enable the Octal Mode in MCR0 (bsc#1188121). - spi: spi-nxp-fspi: Fix a NULL vs IS_ERR() check in probe (bsc#1188121). - spi: spi-nxp-fspi: Implement errata workaround for LS1028A (bsc#1188121). - spi: spi-sun6i: Fix chipselect/clock bug (git-fixes). - spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() (git-fixes). - spi: stm32-qspi: Remove unused qspi field of struct stm32_qspi_flash (git-fixes). - spi: tegra114: Fix an error message (git-fixes). - ssb: Fix error return code in ssb_bus_scan() (git-fixes). - ssb: sdio: Do not overwrite const buffer if block_write fails (git-fixes). - staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt() (git-fixes). - staging: gdm724x: check for overflow in gdm_lte_netif_rx() (git-fixes). - staging: rtl8712: fix memory leak in rtl871x_load_fw_cb (git-fixes). - staging: rtl8712: remove redundant check in r871xu_drv_init (git-fixes). - thermal/drivers/rcar_gen3_thermal: Fix coefficient calculations (git-fixes). - tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality() (bsc#1188036). - tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality() (bsc#1188036). - tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() (bsc#1188036). - tpm, tpm_tis: Reserve locality in tpm_tis_resume() (bsc#1188036). - tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing (git-fixes). - tracing/histograms: Fix parsing of 'sym-offset' modifier (git-fixes). - tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT (git-fixes). - tracing: Simplify & fix saved_tgids logic (git-fixes). - tty: nozomi: Fix a resource leak in an error handling function (git-fixes). - tty: nozomi: Fix the error handling path of 'nozomi_card_init()' (git-fixes). - USB: cdc-acm: blacklist Heimann USB Appset device (git-fixes). - usb: dwc2: Do not reset the core after setting turnaround time (git-fixes). - usb: dwc3: Fix debugfs creation flow (git-fixes). - usb: gadget: eem: fix echo command packet response issue (git-fixes). - usb: gadget: f_fs: Fix setting of device and driver data cross-references (git-fixes). - usb: typec: Add the missed altmode_id_remove() in typec_register_altmode() (git-fixes). - usb: typec: fusb302: Always provide fwnode for the port (git-fixes). - usb: typec: fusb302: fix 'op-sink-microwatt' default that was in mW (git-fixes). - usb: typec: tcpm: Error handling for tcpm_register_partner_altmodes (git-fixes). - usb: typec: tcpm: Move mod_delayed_work(&port->vdm_state_machine) call into tcpm_queue_vdm() (git-fixes). - usb: typec: tcpm: move to SNK_UNATTACHED if sink removed for DRP (git-fixes). - usb: typec: tcpm: Refactor tcpm_handle_vdm_request (git-fixes). - usb: typec: tcpm: Refactor tcpm_handle_vdm_request payload handling (git-fixes). - usb: typec: tcpm: Remove tcpc_config configuration mechanism (git-fixes). - usb: typec: tcpm: set correct data role for non-DRD (git-fixes). - usb: typec: tcpm: Switch to use fwnode_property_count_uXX() (git-fixes). - usb: typec: tcpm: update power supply once partner accepts (git-fixes). - usb: typec: ucsi: Hold con->lock for the entire duration of ucsi_register_port() (git-fixes). - usb: typec: ucsi: Put fwnode in any case during ->probe() (git-fixes). - usb: typec: wcove: Fx wrong kernel doc format (git-fixes). - Use /usr/lib/modules as module dir when usermerge is active in the target distro. - vfio/pci: Handle concurrent vma faults (git-fixes). - vfs: Convert functionfs to use the new mount API (git -fixes). - video: fbdev: imxfb: Fix an error message (git-fixes). - visorbus: fix error return code in visorchipset_init() (git-fixes). - vmxnet3: fix cksum offload issues for tunnels with non-default udp ports (git-fixes). - watchdog: aspeed: fix hardware timeout calculation (git-fixes). - watchdog: sp805: Fix kernel doc description (git-fixes). - wcn36xx: Move hal_buf allocation to devm_kmalloc in probe (git-fixes). - wireless: carl9170: fix LEDS build errors & warnings (git-fixes). - x86/kvm: Disable all PV features on crash (bsc#1185308). - x86/kvm: Disable kvmclock on all CPUs on shutdown (bsc#1185308). - x86/kvm: Fix pr_info() for async PF setup/teardown (bsc#1185308). - x86/kvm: Teardown PV features on boot CPU as well (bsc#1185308). - x86/kvm: Unify kvm_pv_guest_cpu_reboot() with kvm_guest_cpu_offline() (bsc#1185308). - [xarray] iov_iter_fault_in_readable() should do nothing in xarray case (git-fixes). - xhci: solve a double free problem while doing s4 (git-fixes). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-2438,SUSE-SLE-Module-Basesystem-15-SP2-2021-2438,SUSE-SLE-Module-Development-Tools-15-SP2-2021-2438,SUSE-SLE-Module-Legacy-15-SP2-2021-2438,SUSE-SLE-Module-Live-Patching-15-SP2-2021-2438,SUSE-SLE-Product-HA-15-SP2-2021-2438,SUSE-SLE-Product-WE-15-SP2-2021-2438,SUSE-SUSE-MicroOS-5.0-2021-2438 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212438-1/ Link for SUSE-SU-2021:2438-1 https://lists.suse.com/pipermail/sle-security-updates/2021-July/009194.html E-Mail link for SUSE-SU-2021:2438-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1065729 SUSE Bug 1065729 https://bugzilla.suse.com/1085224 SUSE Bug 1085224 https://bugzilla.suse.com/1094840 SUSE Bug 1094840 https://bugzilla.suse.com/1152472 SUSE Bug 1152472 https://bugzilla.suse.com/1152489 SUSE Bug 1152489 https://bugzilla.suse.com/1170511 SUSE Bug 1170511 https://bugzilla.suse.com/1179243 SUSE Bug 1179243 https://bugzilla.suse.com/1183871 SUSE Bug 1183871 https://bugzilla.suse.com/1184114 SUSE Bug 1184114 https://bugzilla.suse.com/1184804 SUSE Bug 1184804 https://bugzilla.suse.com/1185308 SUSE Bug 1185308 https://bugzilla.suse.com/1185791 SUSE Bug 1185791 https://bugzilla.suse.com/1187215 SUSE Bug 1187215 https://bugzilla.suse.com/1187585 SUSE Bug 1187585 https://bugzilla.suse.com/1188036 SUSE Bug 1188036 https://bugzilla.suse.com/1188062 SUSE Bug 1188062 https://bugzilla.suse.com/1188080 SUSE Bug 1188080 https://bugzilla.suse.com/1188116 SUSE Bug 1188116 https://bugzilla.suse.com/1188121 SUSE Bug 1188121 https://bugzilla.suse.com/1188176 SUSE Bug 1188176 https://bugzilla.suse.com/1188267 SUSE Bug 1188267 https://bugzilla.suse.com/1188268 SUSE Bug 1188268 https://bugzilla.suse.com/1188269 SUSE Bug 1188269 https://www.suse.com/security/cve/CVE-2021-22555/ SUSE CVE CVE-2021-22555 page https://www.suse.com/security/cve/CVE-2021-33909/ SUSE CVE CVE-2021-33909 page https://www.suse.com/security/cve/CVE-2021-35039/ SUSE CVE CVE-2021-35039 page https://www.suse.com/security/cve/CVE-2021-3609/ SUSE CVE CVE-2021-3609 page https://www.suse.com/security/cve/CVE-2021-3612/ SUSE CVE CVE-2021-3612 page SUSE Linux Enterprise High Availability Extension 15 SP2 SUSE Linux Enterprise Live Patching 15 SP2 SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Legacy 15 SP2 SUSE Linux Enterprise Workstation Extension 15 SP2 cluster-md-kmp-default-5.3.18-24.75.3 cluster-md-kmp-preempt-5.3.18-24.75.3 dlm-kmp-default-5.3.18-24.75.3 dlm-kmp-preempt-5.3.18-24.75.3 gfs2-kmp-default-5.3.18-24.75.3 gfs2-kmp-preempt-5.3.18-24.75.3 kernel-debug-5.3.18-24.75.3 kernel-debug-devel-5.3.18-24.75.3 kernel-debug-livepatch-devel-5.3.18-24.75.3 kernel-default-5.3.18-24.75.3 kernel-default-base-5.3.18-24.75.3.9.34.3 kernel-default-base-rebuild-5.3.18-24.75.3.9.34.3 kernel-default-devel-5.3.18-24.75.3 kernel-default-extra-5.3.18-24.75.3 kernel-default-livepatch-5.3.18-24.75.3 kernel-default-livepatch-devel-5.3.18-24.75.3 kernel-devel-5.3.18-24.75.2 kernel-docs-5.3.18-24.75.2 kernel-docs-html-5.3.18-24.75.2 kernel-kvmsmall-5.3.18-24.75.3 kernel-kvmsmall-devel-5.3.18-24.75.3 kernel-kvmsmall-livepatch-devel-5.3.18-24.75.3 kernel-livepatch-5_3_18-24_75-default-1-5.3.3 kernel-livepatch-5_3_18-24_75-preempt-1-5.3.3 kernel-macros-5.3.18-24.75.2 kernel-obs-build-5.3.18-24.75.3 kernel-obs-qa-5.3.18-24.75.1 kernel-preempt-5.3.18-24.75.3 kernel-preempt-devel-5.3.18-24.75.3 kernel-preempt-extra-5.3.18-24.75.3 kernel-preempt-livepatch-devel-5.3.18-24.75.3 kernel-source-5.3.18-24.75.2 kernel-source-vanilla-5.3.18-24.75.2 kernel-syms-5.3.18-24.75.1 kernel-zfcpdump-5.3.18-24.75.2 kselftests-kmp-default-5.3.18-24.75.3 kselftests-kmp-preempt-5.3.18-24.75.3 ocfs2-kmp-default-5.3.18-24.75.3 ocfs2-kmp-preempt-5.3.18-24.75.3 reiserfs-kmp-default-5.3.18-24.75.3 reiserfs-kmp-preempt-5.3.18-24.75.3 cluster-md-kmp-default-5.3.18-24.75.3 as a component of SUSE Linux Enterprise High Availability Extension 15 SP2 dlm-kmp-default-5.3.18-24.75.3 as a component of SUSE Linux Enterprise High Availability Extension 15 SP2 gfs2-kmp-default-5.3.18-24.75.3 as a component of SUSE Linux Enterprise High Availability Extension 15 SP2 ocfs2-kmp-default-5.3.18-24.75.3 as a component of SUSE Linux Enterprise High Availability Extension 15 SP2 kernel-default-livepatch-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-default-livepatch-devel-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_75-default-1-5.3.3 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-default-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Micro 5.0 kernel-default-base-5.3.18-24.75.3.9.34.3 as a component of SUSE Linux Enterprise Micro 5.0 kernel-default-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 kernel-default-base-5.3.18-24.75.3.9.34.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 kernel-default-devel-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 kernel-devel-5.3.18-24.75.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 kernel-macros-5.3.18-24.75.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 kernel-preempt-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 kernel-docs-5.3.18-24.75.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 kernel-obs-build-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 kernel-preempt-devel-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 kernel-source-5.3.18-24.75.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 kernel-syms-5.3.18-24.75.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 reiserfs-kmp-default-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Module for Legacy 15 SP2 kernel-default-extra-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Workstation Extension 15 SP2 kernel-preempt-extra-5.3.18-24.75.3 as a component of SUSE Linux Enterprise Workstation Extension 15 SP2 A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space CVE-2021-22555 SUSE Linux Enterprise High Availability Extension 15 SP2:cluster-md-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:dlm-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:gfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:ocfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-devel-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_75-default-1-5.3.3 SUSE Linux Enterprise Micro 5.0:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Micro 5.0:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-devel-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-macros-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-preempt-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-docs-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-obs-build-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-preempt-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-source-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-syms-5.3.18-24.75.1 SUSE Linux Enterprise Module for Legacy 15 SP2:reiserfs-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-default-extra-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-preempt-extra-5.3.18-24.75.3 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212438-1/ https://www.suse.com/security/cve/CVE-2021-22555.html CVE-2021-22555 https://bugzilla.suse.com/1188116 SUSE Bug 1188116 https://bugzilla.suse.com/1188117 SUSE Bug 1188117 https://bugzilla.suse.com/1188411 SUSE Bug 1188411 fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05. CVE-2021-33909 SUSE Linux Enterprise High Availability Extension 15 SP2:cluster-md-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:dlm-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:gfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:ocfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-devel-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_75-default-1-5.3.3 SUSE Linux Enterprise Micro 5.0:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Micro 5.0:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-devel-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-macros-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-preempt-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-docs-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-obs-build-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-preempt-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-source-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-syms-5.3.18-24.75.1 SUSE Linux Enterprise Module for Legacy 15 SP2:reiserfs-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-default-extra-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-preempt-extra-5.3.18-24.75.3 important 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212438-1/ https://www.suse.com/security/cve/CVE-2021-33909.html CVE-2021-33909 https://bugzilla.suse.com/1188062 SUSE Bug 1188062 https://bugzilla.suse.com/1188063 SUSE Bug 1188063 https://bugzilla.suse.com/1188257 SUSE Bug 1188257 https://bugzilla.suse.com/1189302 SUSE Bug 1189302 https://bugzilla.suse.com/1190859 SUSE Bug 1190859 kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument. CVE-2021-35039 SUSE Linux Enterprise High Availability Extension 15 SP2:cluster-md-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:dlm-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:gfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:ocfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-devel-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_75-default-1-5.3.3 SUSE Linux Enterprise Micro 5.0:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Micro 5.0:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-devel-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-macros-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-preempt-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-docs-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-obs-build-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-preempt-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-source-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-syms-5.3.18-24.75.1 SUSE Linux Enterprise Module for Legacy 15 SP2:reiserfs-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-default-extra-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-preempt-extra-5.3.18-24.75.3 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212438-1/ https://www.suse.com/security/cve/CVE-2021-35039.html CVE-2021-35039 https://bugzilla.suse.com/1188080 SUSE Bug 1188080 https://bugzilla.suse.com/1188126 SUSE Bug 1188126 .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root. CVE-2021-3609 SUSE Linux Enterprise High Availability Extension 15 SP2:cluster-md-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:dlm-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:gfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:ocfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-devel-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_75-default-1-5.3.3 SUSE Linux Enterprise Micro 5.0:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Micro 5.0:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-devel-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-macros-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-preempt-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-docs-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-obs-build-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-preempt-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-source-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-syms-5.3.18-24.75.1 SUSE Linux Enterprise Module for Legacy 15 SP2:reiserfs-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-default-extra-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-preempt-extra-5.3.18-24.75.3 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212438-1/ https://www.suse.com/security/cve/CVE-2021-3609.html CVE-2021-3609 https://bugzilla.suse.com/1187215 SUSE Bug 1187215 https://bugzilla.suse.com/1188323 SUSE Bug 1188323 https://bugzilla.suse.com/1188720 SUSE Bug 1188720 https://bugzilla.suse.com/1190276 SUSE Bug 1190276 https://bugzilla.suse.com/1196810 SUSE Bug 1196810 An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2021-3612 SUSE Linux Enterprise High Availability Extension 15 SP2:cluster-md-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:dlm-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:gfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise High Availability Extension 15 SP2:ocfs2-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-default-livepatch-devel-5.3.18-24.75.3 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_75-default-1-5.3.3 SUSE Linux Enterprise Micro 5.0:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Micro 5.0:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-base-5.3.18-24.75.3.9.34.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-default-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-devel-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-macros-5.3.18-24.75.2 SUSE Linux Enterprise Module for Basesystem 15 SP2:kernel-preempt-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-docs-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-obs-build-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-preempt-devel-5.3.18-24.75.3 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-source-5.3.18-24.75.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:kernel-syms-5.3.18-24.75.1 SUSE Linux Enterprise Module for Legacy 15 SP2:reiserfs-kmp-default-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-default-extra-5.3.18-24.75.3 SUSE Linux Enterprise Workstation Extension 15 SP2:kernel-preempt-extra-5.3.18-24.75.3 moderate 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212438-1/ https://www.suse.com/security/cve/CVE-2021-3612.html CVE-2021-3612 https://bugzilla.suse.com/1187585 SUSE Bug 1187585