SUSE-SU-2022:3693-1: important: Security update for the Linux Kernel

SUSE 5081 Published by

A Linux Kernel security update has been released for SUSE Linux Enterprise and openSUSE Leap 15.3/15.4.



SUSE-SU-2022:3693-1: important: Security update for the Linux Kernel


SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________

Announcement ID: SUSE-SU-2022:3693-1
Rating: important
References: #1199564 #1200288 #1201309 #1202677 #1202960 #1203552 #1203769 #1203987 PED-529
Cross-References: CVE-2022-20008 CVE-2022-2503 CVE-2022-32296 CVE-2022-3239 CVE-2022-3303 CVE-2022-41218 CVE-2022-41848
CVSS scores:
CVE-2022-20008 (NVD) : 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2022-20008 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2022-2503 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2503 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-32296 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE-2022-32296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-3239 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-3239 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-3303 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-3303 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVE-2022-41218 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-41218 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-41848 (NVD) : 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-41848 (SUSE): 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:
SUSE CaaS Platform 4.0
SUSE Enterprise Storage 6
SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
SUSE Linux Enterprise Module for Live Patching 15-SP1 SUSE Linux Enterprise Server 15-SP1
SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP1SUSE Linux Enterprise Storage 6
SUSE Manager Proxy 4.0
SUSE Manager Retail Branch Server 4.0
SUSE Manager Server 4.0
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________

An update that solves 7 vulnerabilities, contains one
feature and has one errata is now available.

Description:

The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

- CVE-2022-20008: Fixed local information disclosure due to possibility to
read kernel heap memory via mmc_blk_read_single of block.c (bnc#1199564).
- CVE-2022-2503: Fixed a vulnerability that allowed root to bypass LoadPin
and load untrusted and unverified kernel modules and firmware (bnc#1202677).
- CVE-2022-32296: Fixed vulnerability where TCP servers were allowed to identify clients by observing what source ports are used (bnc#1200288).- CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
- CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
- CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
- CVE-2022-41848: Fixed a race condition in
drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and mgslpc_detach (bnc#1203987).

The following non-security bugs were fixed:

- dtb: Do not include sources in src.rpm - refer to kernel-source Same asother kernel binary packages there is no need to carry duplicate sources
in dtb packages.
- mkspec: eliminate @NOSOURCE@ macro This should be alsways used with @SOURCES@, just include the content there.
- net: mana: Add rmb after checking owner bits (git-fixes). - net: mana: Add the Linux MANA PF driver (bnc#1201309, jsc#PED-529). - x86/bugs: Reenable retbleed=off While for older kernels the return thunks are statically built in and cannot be dynamically patched out, retbleed=off should still be possible to do so that the mitigation can still be disabled on Intel who do not use the return thunks but IBRS.

Special Instructions and Notes:

Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:

zypper in -t patch openSUSE-SLE-15.4-2022-3693=1

- openSUSE Leap 15.3:

zypper in -t patch openSUSE-SLE-15.3-2022-3693=1

- SUSE Linux Enterprise Server for SAP 15-SP1:

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3693=1
- SUSE Linux Enterprise Server 15-SP1-LTSS:

zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3693=1
- SUSE Linux Enterprise Server 15-SP1-BCL:

zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3693=1
- SUSE Linux Enterprise Module for Live Patching 15-SP1:
zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2022-3693=1
Please note that this is the initial kernel livepatch without fixes itself, this livepatch package is later updated by seperate standalonelivepatch updates.

- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3693=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3693=1
- SUSE Linux Enterprise High Availability 15-SP1:

zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-3693=1
- SUSE Enterprise Storage 6:

zypper in -t patch SUSE-Storage-6-2022-3693=1

- SUSE CaaS Platform 4.0:

To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.

Package List:

- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):

kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-4.12.14-150100.197.126.1
kernel-vanilla-base-4.12.14-150100.197.126.1
kernel-vanilla-base-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-debuginfo-4.12.14-150100.197.126.1
kernel-vanilla-debugsource-4.12.14-150100.197.126.1
kernel-vanilla-devel-4.12.14-150100.197.126.1
kernel-vanilla-devel-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-livepatch-devel-4.12.14-150100.197.126.1
- openSUSE Leap 15.4 (ppc64le x86_64):

kernel-debug-base-4.12.14-150100.197.126.1
kernel-debug-base-debuginfo-4.12.14-150100.197.126.1

- openSUSE Leap 15.4 (x86_64):

kernel-kvmsmall-base-4.12.14-150100.197.126.1
kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.126.1
- openSUSE Leap 15.4 (s390x):

kernel-default-man-4.12.14-150100.197.126.1
kernel-zfcpdump-man-4.12.14-150100.197.126.1

- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):

kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-4.12.14-150100.197.126.1
kernel-vanilla-base-4.12.14-150100.197.126.1
kernel-vanilla-base-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-debuginfo-4.12.14-150100.197.126.1
kernel-vanilla-debugsource-4.12.14-150100.197.126.1
kernel-vanilla-devel-4.12.14-150100.197.126.1
kernel-vanilla-devel-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-livepatch-devel-4.12.14-150100.197.126.1
- openSUSE Leap 15.3 (ppc64le x86_64):

kernel-debug-base-4.12.14-150100.197.126.1
kernel-debug-base-debuginfo-4.12.14-150100.197.126.1

- openSUSE Leap 15.3 (x86_64):

kernel-kvmsmall-base-4.12.14-150100.197.126.1
kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.126.1
- openSUSE Leap 15.3 (s390x):

kernel-default-man-4.12.14-150100.197.126.1
kernel-zfcpdump-man-4.12.14-150100.197.126.1

- SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64):
kernel-default-4.12.14-150100.197.126.1
kernel-default-base-4.12.14-150100.197.126.1
kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
kernel-default-devel-4.12.14-150100.197.126.1
kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1
kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1
reiserfs-kmp-default-4.12.14-150100.197.126.1
reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (noarch):

kernel-devel-4.12.14-150100.197.126.1
kernel-docs-4.12.14-150100.197.126.1
kernel-macros-4.12.14-150100.197.126.1
kernel-source-4.12.14-150100.197.126.1

- SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64):

kernel-default-4.12.14-150100.197.126.1
kernel-default-base-4.12.14-150100.197.126.1
kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
kernel-default-devel-4.12.14-150100.197.126.1
kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1
kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1
reiserfs-kmp-default-4.12.14-150100.197.126.1
reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (noarch):

kernel-devel-4.12.14-150100.197.126.1
kernel-docs-4.12.14-150100.197.126.1
kernel-macros-4.12.14-150100.197.126.1
kernel-source-4.12.14-150100.197.126.1

- SUSE Linux Enterprise Server 15-SP1-LTSS (s390x):

kernel-default-man-4.12.14-150100.197.126.1
kernel-zfcpdump-debuginfo-4.12.14-150100.197.126.1
kernel-zfcpdump-debugsource-4.12.14-150100.197.126.1

- SUSE Linux Enterprise Server 15-SP1-BCL (x86_64):

kernel-default-4.12.14-150100.197.126.1
kernel-default-base-4.12.14-150100.197.126.1
kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
kernel-default-devel-4.12.14-150100.197.126.1
kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1
kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1
reiserfs-kmp-default-4.12.14-150100.197.126.1
reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1
- SUSE Linux Enterprise Server 15-SP1-BCL (noarch):

kernel-devel-4.12.14-150100.197.126.1
kernel-docs-4.12.14-150100.197.126.1
kernel-macros-4.12.14-150100.197.126.1
kernel-source-4.12.14-150100.197.126.1

- SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64):
kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
kernel-default-livepatch-4.12.14-150100.197.126.1
kernel-default-livepatch-devel-4.12.14-150100.197.126.1 kernel-livepatch-4_12_14-150100_197_126-default-1-150100.3.3.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64):

kernel-default-4.12.14-150100.197.126.1
kernel-default-base-4.12.14-150100.197.126.1
kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
kernel-default-devel-4.12.14-150100.197.126.1
kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1
kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1

- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch):
kernel-devel-4.12.14-150100.197.126.1
kernel-docs-4.12.14-150100.197.126.1
kernel-macros-4.12.14-150100.197.126.1
kernel-source-4.12.14-150100.197.126.1

- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64):

kernel-default-4.12.14-150100.197.126.1
kernel-default-base-4.12.14-150100.197.126.1
kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
kernel-default-devel-4.12.14-150100.197.126.1
kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1
kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1

- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch):
kernel-devel-4.12.14-150100.197.126.1
kernel-docs-4.12.14-150100.197.126.1
kernel-macros-4.12.14-150100.197.126.1
kernel-source-4.12.14-150100.197.126.1

- SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64):

cluster-md-kmp-default-4.12.14-150100.197.126.1
cluster-md-kmp-default-debuginfo-4.12.14-150100.197.126.1 dlm-kmp-default-4.12.14-150100.197.126.1
dlm-kmp-default-debuginfo-4.12.14-150100.197.126.1
gfs2-kmp-default-4.12.14-150100.197.126.1
gfs2-kmp-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
ocfs2-kmp-default-4.12.14-150100.197.126.1
ocfs2-kmp-default-debuginfo-4.12.14-150100.197.126.1

- SUSE Enterprise Storage 6 (aarch64 x86_64):

kernel-default-4.12.14-150100.197.126.1
kernel-default-base-4.12.14-150100.197.126.1
kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
kernel-default-devel-4.12.14-150100.197.126.1
kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1
kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1
reiserfs-kmp-default-4.12.14-150100.197.126.1
reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1
- SUSE Enterprise Storage 6 (noarch):

kernel-devel-4.12.14-150100.197.126.1
kernel-docs-4.12.14-150100.197.126.1
kernel-macros-4.12.14-150100.197.126.1
kernel-source-4.12.14-150100.197.126.1

- SUSE CaaS Platform 4.0 (noarch):

kernel-devel-4.12.14-150100.197.126.1
kernel-docs-4.12.14-150100.197.126.1
kernel-macros-4.12.14-150100.197.126.1
kernel-source-4.12.14-150100.197.126.1

- SUSE CaaS Platform 4.0 (x86_64):

kernel-default-4.12.14-150100.197.126.1
kernel-default-base-4.12.14-150100.197.126.1
kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1
kernel-default-debugsource-4.12.14-150100.197.126.1
kernel-default-devel-4.12.14-150100.197.126.1
kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1
kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1
reiserfs-kmp-default-4.12.14-150100.197.126.1
reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1

References:

  https://www.suse.com/security/cve/CVE-2022-20008.html
  https://www.suse.com/security/cve/CVE-2022-2503.html
  https://www.suse.com/security/cve/CVE-2022-32296.html
  https://www.suse.com/security/cve/CVE-2022-3239.html
  https://www.suse.com/security/cve/CVE-2022-3303.html
  https://www.suse.com/security/cve/CVE-2022-41218.html
  https://www.suse.com/security/cve/CVE-2022-41848.html
  https://bugzilla.suse.com/1199564
  https://bugzilla.suse.com/1200288
  https://bugzilla.suse.com/1201309
  https://bugzilla.suse.com/1202677
  https://bugzilla.suse.com/1202960
  https://bugzilla.suse.com/1203552
  https://bugzilla.suse.com/1203769
  https://bugzilla.suse.com/1203987



Fedora 35 Update: wavpack-5.5.0-2.fc35

How to Set Up Raspberry Pi OS on a Raspberry Pi

Windows

Linux

macOS

Community

  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...
  • StephanX
    Hi friends, i am new in the Linux universe but i try to ...
  • Philipp
    I would try the XanMod kernel: https://xanmod.org  I ...