Security update for the Linux Kernel
Announcement ID: | SUSE-SU-2022:2478-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves nine vulnerabilities and has four security fixes can now be installed.
Description:
The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
- CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
- CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
- CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
- CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
- CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
- CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
- CVE-2017-16525: Fixed a use-after-free after failed setup in usb/serial/console (bsc#1066618).
The following non-security bugs were fixed:
- exec: Force single empty string when argv is empty (bsc#1200571).
Special Instructions and Notes:
- Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3
zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-2478=1
Package List:
-
SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 (nosrc x86_64)
- kernel-default-4.4.180-94.167.1
-
SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 (x86_64)
- kernel-default-base-debuginfo-4.4.180-94.167.1
- kernel-syms-4.4.180-94.167.1
- kernel-default-base-4.4.180-94.167.1
- kernel-default-debuginfo-4.4.180-94.167.1
- kernel-default-devel-4.4.180-94.167.1
- kernel-default-debugsource-4.4.180-94.167.1
-
SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 (noarch)
- kernel-devel-4.4.180-94.167.1
- kernel-macros-4.4.180-94.167.1
- kernel-source-4.4.180-94.167.1
References:
- https://www.suse.com/security/cve/CVE-2017-16525.html
- https://www.suse.com/security/cve/CVE-2021-26341.html
- https://www.suse.com/security/cve/CVE-2021-4157.html
- https://www.suse.com/security/cve/CVE-2022-1679.html
- https://www.suse.com/security/cve/CVE-2022-20132.html
- https://www.suse.com/security/cve/CVE-2022-20141.html
- https://www.suse.com/security/cve/CVE-2022-29900.html
- https://www.suse.com/security/cve/CVE-2022-29901.html
- https://www.suse.com/security/cve/CVE-2022-33981.html
- https://bugzilla.suse.com/show_bug.cgi?id=1066618
- https://bugzilla.suse.com/show_bug.cgi?id=1146519
- https://bugzilla.suse.com/show_bug.cgi?id=1194013
- https://bugzilla.suse.com/show_bug.cgi?id=1196901
- https://bugzilla.suse.com/show_bug.cgi?id=1199487
- https://bugzilla.suse.com/show_bug.cgi?id=1199657
- https://bugzilla.suse.com/show_bug.cgi?id=1200571
- https://bugzilla.suse.com/show_bug.cgi?id=1200604
- https://bugzilla.suse.com/show_bug.cgi?id=1200605
- https://bugzilla.suse.com/show_bug.cgi?id=1200619
- https://bugzilla.suse.com/show_bug.cgi?id=1200692
- https://bugzilla.suse.com/show_bug.cgi?id=1201050
- https://bugzilla.suse.com/show_bug.cgi?id=1201080