Security update for the Linux Kernel (Live Patch 23 for SLE 15 SP2)

Announcement ID:	SUSE-SU-2022:4587-1
Rating:	important
References:	bsc#1203008 bsc#1203606 bsc#1204424 bsc#1204486 bsc#1204576 bsc#1205130 bsc#1205815 bsc#1206228
Cross-References:	CVE-2022-2964 CVE-2022-3545 CVE-2022-3577 CVE-2022-3586 CVE-2022-41218 CVE-2022-4139 CVE-2022-4378 CVE-2022-43945
CVSS scores:	CVE-2022-2964 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-2964 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-3545 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-3545 ( NVD ): 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2022-3577 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-3577 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-3586 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-3586 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-41218 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-41218 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-4139 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-4139 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-4378 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-4378 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-43945 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-43945 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	openSUSE Leap 15.3 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise Live Patching 15-SP2 SUSE Linux Enterprise Live Patching 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3

An update that solves eight vulnerabilities can now be installed.

Description:

This update for the Linux Kernel 5.3.18-24_99 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Live Patching 15-SP2
  zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2022-4587=1 SUSE-SLE-Module-Live-Patching-15-SP2-2022-4582=1 SUSE-SLE-Module-Live-Patching-15-SP2-2022-4588=1
• openSUSE Leap 15.3
  zypper in -t patch SUSE-2022-4570=1 SUSE-2022-4571=1 SUSE-2022-4555=1 SUSE-2022-4562=1 SUSE-2022-4563=1 SUSE-2022-4528=1 SUSE-2022-4564=1 SUSE-2022-4532=1
• SUSE Linux Enterprise Live Patching 15-SP3
  zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2022-4570=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4571=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4555=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4562=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4563=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4528=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4564=1 SUSE-SLE-Module-Live-Patching-15-SP3-2022-4532=1

Package List:

• SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le s390x x86_64)
  • kernel-livepatch-5_3_18-24_107-default-debuginfo-15-150200.2.2
  • kernel-livepatch-5_3_18-24_99-default-17-150200.2.2
  • kernel-livepatch-5_3_18-24_99-default-debuginfo-17-150200.2.2
  • kernel-livepatch-5_3_18-24_107-default-15-150200.2.2
  • kernel-livepatch-SLE15-SP2_Update_23-debugsource-17-150200.2.2
  • kernel-livepatch-SLE15-SP2_Update_24-debugsource-16-150200.2.2
  • kernel-livepatch-5_3_18-24_102-default-debuginfo-16-150200.2.2
  • kernel-livepatch-5_3_18-24_102-default-16-150200.2.2
• SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le x86_64)
  • kernel-livepatch-SLE15-SP2_Update_25-debugsource-15-150200.2.2
• openSUSE Leap 15.3 (ppc64le s390x x86_64)
  • kernel-livepatch-5_3_18-150300_59_54-default-debuginfo-15-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_43-default-17-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_49-default-debuginfo-16-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_54-default-15-150300.2.2
  • kernel-livepatch-5_3_18-59_40-default-debuginfo-18-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_46-default-17-150300.2.2
  • kernel-livepatch-5_3_18-59_37-default-debuginfo-18-150300.2.2
  • kernel-livepatch-5_3_18-59_40-default-18-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_15-debugsource-15-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_49-default-16-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_12-debugsource-17-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_13-debugsource-17-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_46-default-debuginfo-17-150300.2.2
  • kernel-livepatch-5_3_18-59_34-default-debuginfo-19-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_43-default-debuginfo-17-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_10-debugsource-18-150300.2.2
  • kernel-livepatch-5_3_18-59_37-default-18-150300.2.2
  • kernel-livepatch-5_3_18-59_34-default-19-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_60-default-14-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_11-debugsource-18-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_9-debugsource-19-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_16-debugsource-14-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_14-debugsource-16-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_60-default-debuginfo-14-150300.2.2
• openSUSE Leap 15.3 (x86_64)
  • kernel-livepatch-5_3_18-150300_59_60-preempt-14-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_49-preempt-16-150300.2.2
  • kernel-livepatch-5_3_18-59_40-preempt-18-150300.2.2
  • kernel-livepatch-5_3_18-59_34-preempt-19-150300.2.2
  • kernel-livepatch-5_3_18-59_37-preempt-debuginfo-18-150300.2.2
  • kernel-livepatch-5_3_18-59_34-preempt-debuginfo-19-150300.2.2
  • kernel-livepatch-5_3_18-59_40-preempt-debuginfo-18-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_46-preempt-17-150300.2.2
  • kernel-livepatch-5_3_18-59_37-preempt-18-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_49-preempt-debuginfo-16-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_54-preempt-15-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_54-preempt-debuginfo-15-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_60-preempt-debuginfo-14-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_46-preempt-debuginfo-17-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_43-preempt-17-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_43-preempt-debuginfo-17-150300.2.2
• SUSE Linux Enterprise Live Patching 15-SP3 (ppc64le s390x x86_64)
  • kernel-livepatch-5_3_18-59_37-default-18-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_43-default-17-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_49-default-16-150300.2.2
  • kernel-livepatch-5_3_18-59_34-default-19-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_60-default-14-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_46-default-debuginfo-17-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_54-default-15-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_46-default-17-150300.2.2
  • kernel-livepatch-5_3_18-59_40-default-18-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_9-debugsource-19-150300.2.2
  • kernel-livepatch-5_3_18-59_34-default-debuginfo-19-150300.2.2
  • kernel-livepatch-5_3_18-150300_59_43-default-debuginfo-17-150300.2.2
  • kernel-livepatch-SLE15-SP3_Update_10-debugsource-18-150300.2.2
  • kernel-livepatch-5_3_18-59_37-default-debuginfo-18-150300.2.2
• SUSE Linux Enterprise Live Patching 15-SP3 (ppc64le x86_64)
  • kernel-livepatch-5_3_18-59_40-default-debuginfo-18-150300.2.2

References:

• https://www.suse.com/security/cve/CVE-2022-2964.html
• https://www.suse.com/security/cve/CVE-2022-3545.html
• https://www.suse.com/security/cve/CVE-2022-3577.html
• https://www.suse.com/security/cve/CVE-2022-3586.html
• https://www.suse.com/security/cve/CVE-2022-41218.html
• https://www.suse.com/security/cve/CVE-2022-4139.html
• https://www.suse.com/security/cve/CVE-2022-4378.html
• https://www.suse.com/security/cve/CVE-2022-43945.html
• https://bugzilla.suse.com/show_bug.cgi?id=1203008
• https://bugzilla.suse.com/show_bug.cgi?id=1203606
• https://bugzilla.suse.com/show_bug.cgi?id=1204424
• https://bugzilla.suse.com/show_bug.cgi?id=1204486
• https://bugzilla.suse.com/show_bug.cgi?id=1204576
• https://bugzilla.suse.com/show_bug.cgi?id=1205130
• https://bugzilla.suse.com/show_bug.cgi?id=1205815
• https://bugzilla.suse.com/show_bug.cgi?id=1206228