File _patchinfo of Package patchinfo.20465
<patchinfo incident="20465"> <issue id="1179610" tracker="bnc">VUL-0: CVE-2020-26555,CVE-2020-26558: bluez: Multiple Bluetooth Core Specification Vulnerabilities</issue> <issue id="1180846" tracker="bnc">L3: PVHVM SLES12 SP5 - NMI Watchdog CPU Stuck - Need core analyzed</issue> <issue id="1184611" tracker="bnc">VUL-0: CVE-2021-32399: kernel-source: Race condition vulnerability in Linux BlueTooth subsystem</issue> <issue id="1185859" tracker="bnc">VUL-0: CVE-2020-24586,CVE-2020-24587: kernel-source: mac80211: extend protection against mixed key and fragment cache attacks</issue> <issue id="1185860" tracker="bnc">VUL-0: CVE-2020-26145: ath10k: drop fragments with multicast DA for PCIe</issue> <issue id="1185861" tracker="bnc">VUL-0: CVE-2020-24588: kernel-source: ath10k: drop MPDU which has discard flag set by firmware for SDIO</issue> <issue id="1185862" tracker="bnc">VUL-0: CVE-2020-24587: kernel-source: ath11k: Clear the fragment cache during key install</issue> <issue id="1185863" tracker="bnc">VUL-0: kernel-source: various 802.11 security issues aka "FRAGATTACKS"</issue> <issue id="1185898" tracker="bnc">VUL-0: CVE-2021-32399: kernel-source-rt,kernel-source,kernel-source-azure: Linux device detach race condition</issue> <issue id="1185987" tracker="bnc">VUL-1: CVE-2020-26141: kernel-source-azure,kernel-source,kernel-source-rt: mac80211: Not verifying TKIP MIC of fragmented frames</issue> <issue id="1186060" tracker="bnc">VUL-0: CVE-2021-23134: kernel-source-rt,kernel-source-azure,kernel-source: kernel: use-after-free in nfc sockets</issue> <issue id="1186062" tracker="bnc">VUL-0: CVE-2020-26139: kernel-source,kernel-source-rt,kernel-source-azure: kernel: Forwarding EAPOL from unauthenticated wifi client</issue> <issue id="1186111" tracker="bnc">VUL-0: CVE-2021-33034: kernel-source-azure,kernel-source,kernel-source-rt: use-after-free when destroying an hci_chan</issue> <issue id="1186390" tracker="bnc">CVE-2021-23134 CVE-2021-33033 CVE-2021-33034 CVE-2021-29154 CVE-2020-36322 fixes needed for Reactive LTSS SLES 12 SP2: kernel</issue> <issue id="1186463" tracker="bnc">VUL-0: CVE-2021-0129,CVE-2020-26558: kernel-source, bluez: vulnerabilities with bluetooth subsystem (INTEL-SA-00517)</issue> <issue id="1187038" tracker="bnc">VUL-0: CVE-2020-36386: kernel-source-rt,kernel-source-azure,kernel-source: An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf</issue> <issue id="1187050" tracker="bnc">VUL-1: CVE-2020-36385: kernel-source,kernel-source-azure,kernel-source-rt: An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma</issue> <issue id="1187215" tracker="bnc">VUL-0: CVE-2021-3609: kernel-source: net/can: race condition in net/can/bcm.c leads to local privilege escalation</issue> <issue id="1187452" tracker="bnc">VUL-0: CVE-2021-34693: kernel-source,kernel-source-azure,kernel-source-rt: allows local users to obtain sensitive information from stack memory because of uninitialized data structure in net/can/bcm.c</issue> <issue id="1187595" tracker="bnc">VUL-0: CVE-2021-0512: kernel-source-azure,kernel-source-rt,kernel-source: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers() of hid-input.c</issue> <issue id="1187601" tracker="bnc">VUL-0: CVE-2021-0605: kernel-source,kernel-source-rt,kernel-source-azure: In pfkey_dump() dplen and splen can both be specified to access the xfrm_address_t structure out of bounds</issue> <issue id="1187934" tracker="bnc">CVE-2020-36385 fix needed for Reactive LTSS SLES 12 SP2 : kernel-default</issue> <issue id="1188062" tracker="bnc">VUL-0: EMBARGOED: CVE-2021-33909: kernel-source: size_t-to-int vulnerability in Linux's filesystem layer</issue> <issue id="1188116" tracker="bnc">VUL-0: CVE-2021-22555: kernel-source-azure,kernel-source-rt,kernel-source: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c</issue> <issue id="2021-22555" tracker="cve" /> <issue id="2021-33909" tracker="cve" /> <issue id="2021-3609" tracker="cve" /> <issue id="2021-0605" tracker="cve" /> <issue id="2021-0512" tracker="cve" /> <issue id="2021-34693" tracker="cve" /> <issue id="2020-36385" tracker="cve" /> <issue id="2021-0129" tracker="cve" /> <issue id="2020-26558" tracker="cve" /> <issue id="2020-36386" tracker="cve" /> <issue id="2020-24588" tracker="cve" /> <issue id="2021-32399" tracker="cve" /> <issue id="2021-33034" tracker="cve" /> <issue id="2020-26139" tracker="cve" /> <issue id="2021-23134" tracker="cve" /> <issue id="2020-24586" tracker="cve" /> <issue id="2020-26141" tracker="cve" /> <issue id="2020-26145" tracker="cve" /> <issue id="2020-24587" tracker="cve" /> <issue id="2020-26147" tracker="cve" /> <category>security</category> <rating>important</rating> <packager>osalvador</packager> <reboot_needed/> <description>The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-22555: Fixed an heap out-of-bounds write in net/netfilter/x_tables.c that could allow local provilege escalation. (bsc#1188116) - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer that allows to obtain full root privileges. (bsc#1188062) - CVE-2021-3609: Fixed a race condition in the CAN BCM networking protocol which allows for local privilege escalation. (bsc#1187215) - CVE-2021-0605: Fixed an out-of-bounds read which could lead to local information disclosure in the kernel with System execution privileges needed. (bsc#1187601) - CVE-2021-0512: Fixed a possible out-of-bounds write which could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1187595) - CVE-2021-34693: Fixed a bug in net/can/bcm.c which could allow local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. (bsc#1187452) - CVE-2020-36385: Fixed a use-after-free flaw in ucma.c which allows for local privilege escalation. (bsc#1187050) - CVE-2021-0129: Fixed an improper access control in BlueZ that may have allowed an authenticated user to potentially enable information disclosure via adjacent access. (bsc#1186463) - CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing. (bsc#1179610) - CVE-2020-36386: Fixed an out-of-bounds read in hci_extended_inquiry_result_evt. (bsc#1187038) - CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-SSP A-MSDU frames to inject arbitrary network packets. (bsc#1185861) - CVE-2021-32399: Fixed a race condition in net/bluetooth/hci_request.c for removal of the HCI controller. (bsc#1184611) - CVE-2021-33034: Fixed an issue in net/bluetooth/hci_event.c where a use-after-free leads to writing an arbitrary value. (bsc#1186111) - CVE-2020-26139: Fixed a bug that allows an Access Point (AP) to forward EAPOL frames to other clients even though the sender has not yet successfully authenticated. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and made it easier to exploit other vulnerabilities in connected clients. (bsc#1186062) - CVE-2021-23134: Fixed a use After Free vulnerability in nfc sockets which allows local attackers to elevate their privileges. (bsc#1186060) - CVE-2020-24586: Fixed a bug that, under the right circumstances, allows to inject arbitrary network packets and/or exfiltrate user data when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP. (bsc#1185859) - CVE-2020-26141: Fixed a flaw that could allows an adversary to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. (bsc#1185987) - CVE-2020-26145: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject arbitrary network packets. (bsc#1185860) - CVE-2020-24587: Fixed a bug that allows an adversary to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed. (bsc#1185862) - CVE-2020-26147: Fixed a bug in the WEP, WPA, WPA2, and WPA3 implementations that could allows an adversary to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames. (bsc#1185987) The following non-security bugs were fixed: - kABI: Fix kABI after modifying struct __call_single_data (bsc#1180846). - kernel/smp: add boot parameter for controlling CSD lock debugging (bsc#1180846). - kernel/smp: Add source and destination CPUs to __call_single_data (bsc#1180846). - kernel/smp: make csdlock timeout depend on boot parameter (bsc#1180846). - kernel/smp: Provide CSD lock timeout diagnostics (bsc#1180846). - Update config files: activate CONFIG_CSD_LOCK_WAIT_DEBUG for x86 (bsc#1180846). - Update config files: disable CONFIG_CSD_LOCK_WAIT_DEBUG (bsc#1180846). </description> <summary>Security update for the Linux Kernel</summary> </patchinfo>
