Security update for the Linux Kernel

Announcement ID:	SUSE-SU-2024:3565-1
Release Date:	2024-10-09T09:40:49Z
Rating:	important
References:	bsc#1185988 bsc#1220826 bsc#1226145 bsc#1227487 bsc#1228466 bsc#1229633 bsc#1230015 bsc#1230245 bsc#1230326 bsc#1230398 bsc#1230434 bsc#1230519 bsc#1230767
Cross-References:	CVE-2021-47069 CVE-2022-48911 CVE-2022-48945 CVE-2024-36971 CVE-2024-41087 CVE-2024-44946 CVE-2024-45003 CVE-2024-45021 CVE-2024-46695 CVE-2024-46774
CVSS scores:	CVE-2021-47069 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-48911 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-48911 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-36971 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-36971 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-41087 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-41087 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-44946 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-44946 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-45003 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-45021 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-45021 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-46695 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-46695 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CVE-2024-46774 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise High Availability Extension 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 SUSE Linux Enterprise Live Patching 15-SP2 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1

An update that solves 10 vulnerabilities and has three security fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance. (bsc#1229633).
• CVE-2022-48945: media: vivid: fix compose size exceed boundary (bsc#1230398).
• CVE-2024-36971: net: fix __dst_negative_advice() race (bsc#1226145).
• CVE-2024-41087: Fix double free on error (bsc#1228466).
• CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).
• CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).
• CVE-2024-45021: memcg_write_event_control(): fix a user-triggerable oops (bsc#1230434).
• CVE-2024-46695: selinux,smack: do not bypass permissions check in inode_setsecctx hook (bsc#1230519).

The following non-security bugs were fixed:

• Revert "ext4: consolidate checks for resize of bigalloc into ext4_resize_begin" (bsc#1230326).
• ext4: add check to prevent attempting to resize an fs with sparse_super2 (bsc#1230326).
• ext4: add reserved GDT blocks check (bsc#1230326).
• ext4: consolidate checks for resize of bigalloc into ext4_resize_begin (bsc#1230326).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1230326).
• kabi: add __nf_queue_get_refs() for kabi compliance.

Special Instructions and Notes:

• Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Live Patching 15-SP2
  zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP2-2024-3565=1
• SUSE Linux Enterprise High Availability Extension 15 SP2
  zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2024-3565=1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-3565=1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-3565=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-3565=1

Package List:

• SUSE Linux Enterprise Live Patching 15-SP2 (nosrc)
  • kernel-default-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Live Patching 15-SP2 (ppc64le s390x x86_64)
  • kernel-livepatch-5_3_18-150200_24_206-default-debuginfo-1-150200.5.3.1
  • kernel-livepatch-SLE15-SP2_Update_53-debugsource-1-150200.5.3.1
  • kernel-livepatch-5_3_18-150200_24_206-default-1-150200.5.3.1
  • kernel-default-livepatch-5.3.18-150200.24.206.1
  • kernel-default-debuginfo-5.3.18-150200.24.206.1
  • kernel-default-livepatch-devel-5.3.18-150200.24.206.1
  • kernel-default-debugsource-5.3.18-150200.24.206.1
• SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64)
  • gfs2-kmp-default-debuginfo-5.3.18-150200.24.206.1
  • ocfs2-kmp-default-debuginfo-5.3.18-150200.24.206.1
  • gfs2-kmp-default-5.3.18-150200.24.206.1
  • ocfs2-kmp-default-5.3.18-150200.24.206.1
  • cluster-md-kmp-default-5.3.18-150200.24.206.1
  • kernel-default-debuginfo-5.3.18-150200.24.206.1
  • cluster-md-kmp-default-debuginfo-5.3.18-150200.24.206.1
  • dlm-kmp-default-5.3.18-150200.24.206.1
  • dlm-kmp-default-debuginfo-5.3.18-150200.24.206.1
  • kernel-default-debugsource-5.3.18-150200.24.206.1
• SUSE Linux Enterprise High Availability Extension 15 SP2 (nosrc)
  • kernel-default-5.3.18-150200.24.206.1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 nosrc x86_64)
  • kernel-preempt-5.3.18-150200.24.206.1
  • kernel-default-5.3.18-150200.24.206.1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64)
  • kernel-obs-build-debugsource-5.3.18-150200.24.206.1
  • kernel-default-base-5.3.18-150200.24.206.1.150200.9.107.1
  • kernel-preempt-debugsource-5.3.18-150200.24.206.1
  • kernel-preempt-debuginfo-5.3.18-150200.24.206.1
  • kernel-obs-build-5.3.18-150200.24.206.1
  • kernel-default-devel-5.3.18-150200.24.206.1
  • kernel-default-devel-debuginfo-5.3.18-150200.24.206.1
  • kernel-preempt-devel-5.3.18-150200.24.206.1
  • kernel-default-debuginfo-5.3.18-150200.24.206.1
  • kernel-preempt-devel-debuginfo-5.3.18-150200.24.206.1
  • kernel-syms-5.3.18-150200.24.206.1
  • kernel-default-debugsource-5.3.18-150200.24.206.1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch)
  • kernel-devel-5.3.18-150200.24.206.1
  • kernel-source-5.3.18-150200.24.206.1
  • kernel-macros-5.3.18-150200.24.206.1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch nosrc)
  • kernel-docs-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64 nosrc)
  • kernel-default-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64)
  • kernel-obs-build-debugsource-5.3.18-150200.24.206.1
  • kernel-default-base-5.3.18-150200.24.206.1.150200.9.107.1
  • kernel-obs-build-5.3.18-150200.24.206.1
  • kernel-default-devel-5.3.18-150200.24.206.1
  • kernel-default-devel-debuginfo-5.3.18-150200.24.206.1
  • reiserfs-kmp-default-debuginfo-5.3.18-150200.24.206.1
  • kernel-default-debuginfo-5.3.18-150200.24.206.1
  • reiserfs-kmp-default-5.3.18-150200.24.206.1
  • kernel-syms-5.3.18-150200.24.206.1
  • kernel-default-debugsource-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)
  • kernel-devel-5.3.18-150200.24.206.1
  • kernel-source-5.3.18-150200.24.206.1
  • kernel-macros-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch nosrc)
  • kernel-docs-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 nosrc x86_64)
  • kernel-preempt-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 x86_64)
  • kernel-preempt-debugsource-5.3.18-150200.24.206.1
  • kernel-preempt-devel-5.3.18-150200.24.206.1
  • kernel-preempt-debuginfo-5.3.18-150200.24.206.1
  • kernel-preempt-devel-debuginfo-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (nosrc ppc64le x86_64)
  • kernel-default-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)
  • kernel-obs-build-debugsource-5.3.18-150200.24.206.1
  • kernel-default-base-5.3.18-150200.24.206.1.150200.9.107.1
  • kernel-obs-build-5.3.18-150200.24.206.1
  • kernel-default-devel-5.3.18-150200.24.206.1
  • kernel-default-devel-debuginfo-5.3.18-150200.24.206.1
  • reiserfs-kmp-default-debuginfo-5.3.18-150200.24.206.1
  • kernel-default-debuginfo-5.3.18-150200.24.206.1
  • reiserfs-kmp-default-5.3.18-150200.24.206.1
  • kernel-syms-5.3.18-150200.24.206.1
  • kernel-default-debugsource-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)
  • kernel-devel-5.3.18-150200.24.206.1
  • kernel-source-5.3.18-150200.24.206.1
  • kernel-macros-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch nosrc)
  • kernel-docs-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (nosrc x86_64)
  • kernel-preempt-5.3.18-150200.24.206.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (x86_64)
  • kernel-preempt-debugsource-5.3.18-150200.24.206.1
  • kernel-preempt-devel-5.3.18-150200.24.206.1
  • kernel-preempt-debuginfo-5.3.18-150200.24.206.1
  • kernel-preempt-devel-debuginfo-5.3.18-150200.24.206.1

References:

• https://www.suse.com/security/cve/CVE-2021-47069.html
• https://www.suse.com/security/cve/CVE-2022-48911.html
• https://www.suse.com/security/cve/CVE-2022-48945.html
• https://www.suse.com/security/cve/CVE-2024-36971.html
• https://www.suse.com/security/cve/CVE-2024-41087.html
• https://www.suse.com/security/cve/CVE-2024-44946.html
• https://www.suse.com/security/cve/CVE-2024-45003.html
• https://www.suse.com/security/cve/CVE-2024-45021.html
• https://www.suse.com/security/cve/CVE-2024-46695.html
• https://www.suse.com/security/cve/CVE-2024-46774.html
• https://bugzilla.suse.com/show_bug.cgi?id=1185988
• https://bugzilla.suse.com/show_bug.cgi?id=1220826
• https://bugzilla.suse.com/show_bug.cgi?id=1226145
• https://bugzilla.suse.com/show_bug.cgi?id=1227487
• https://bugzilla.suse.com/show_bug.cgi?id=1228466
• https://bugzilla.suse.com/show_bug.cgi?id=1229633
• https://bugzilla.suse.com/show_bug.cgi?id=1230015
• https://bugzilla.suse.com/show_bug.cgi?id=1230245
• https://bugzilla.suse.com/show_bug.cgi?id=1230326
• https://bugzilla.suse.com/show_bug.cgi?id=1230398
• https://bugzilla.suse.com/show_bug.cgi?id=1230434
• https://bugzilla.suse.com/show_bug.cgi?id=1230519
• https://bugzilla.suse.com/show_bug.cgi?id=1230767