SUSE-IU-2022:3-1 SUSE Image security@suse.de SUSE Security Team SUSE Image SUSE-IU-2022:3-1 Interim 1 1 2022-09-11T06:59:09Z current 2022-01-03T01:00:00Z 2022-01-03T01:00:00Z cve-database/bin/generate-cvrf-publiccloud.pl 2021-02-18T01:00:00Z Image update for SUSE-IU-2022:3-1 / google/sles-15-sp3-chost-byos-v20220103 This image update for google/sles-15-sp3-chost-byos-v20220103 contains the following changes: Package aaa_base was updated: - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error Package apparmor was updated: Package cpupower was updated: - bsc#1193557 - fixes: turbostat(version 20.09.30) started then immediately exit on AMD Zen machines A tools-power-turbostat-Fix-turbostat-for-AMD-Zen-CPUs.patch Package dracut was updated: - Update to version 049.1+suse.218.gca24e614: * fix(iscsi): add iscsi-init.service requirements (bsc#1193512) Package glibc was updated: - 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch, 0002-S390-Optimize-__memcpy_z196.patch, 0003-S390-Optimize-__memset_z196.patch, 0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch, 0005-S390-Add-new-hwcap-values.patch, 0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 - GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869) Package gmp was updated: - Add gmp-6.2.1-CVE-2021-43618.patch to fix buffer overflow on malformed input to mpz_inp_raw. [bsc#1192717, CVE-2021-43618] Package grub2 was updated: - Fix error lvmid disk cannot be found after second disk added to the root volume group (bsc#1189874) (bsc#1071559) * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch - Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769) * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch * 0001-Filter-out-POSIX-locale-for-translation.patch - Fix unknown TPM error on buggy uefi firmware (bsc#1191504) * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch - Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522) * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch Package kernel-default was updated: - config: disable unprivileged BPF by default (jsc#SLE-22573) Backport of mainline commit 8a03e56b253e (&quot;/bpf: Disallow unprivileged bpf by default&quot;/) only changes kconfig default, used e.g. for &quot;/make oldconfig&quot;/ when the config option is missing, but does not update our kernel configs used for build. Update also these to make sure unprivileged BPF is really disabled by default. - commit 9a413cc - Input: elantench - fix misreporting trackpoint coordinates (bsc#1192918). - commit af3fd37 - mm/hugetlb: initialize hugetlb_usage in mm_init (bsc#1192906). - commit 4bfee1a - blacklist.conf: Add 04f8ef5643bc cgroup: Fix memory leak caused by missing cgroup_bpf_offline - commit d046894 - fix patch metadata - fix Patch-mainline: - patches.suse/btrfs-fix-memory-ordering-between-normal-and-ordered-work-functions.patch - commit 7ca7de6 - fix patches metadata - fix Patch-mainline: - patches.suse/scsi-core-Fix-spelling-in-a-source-code-comment - patches.suse/scsi-csiostor-Uninitialized-data-in-csio_ln_vnp_read_cbfn - patches.suse/scsi-dc395-Fix-error-case-unwinding - patches.suse/scsi-ufs-ufshcd-pltfrm-Fix-memory-leak-due-to-probe-defer - commit 2c768e7 - btrfs: update comments for chunk allocation -ENOSPC cases (bsc#1192896). - btrfs: fix deadlock between chunk allocation and chunk btree modifications (bsc#1192896). - btrfs: block-group: Rework documentation of check_system_chunk function (bsc#1192896). - commit 20b2047 - fix patches metadata - fix Patch-mainline: - patches.suse/ipv4-make-exception-cache-less-predictible.patch - patches.suse/ipv6-make-exception-cache-less-predictible.patch - patches.suse/qtnfmac-fix-potential-spectre-vulnerabilities.patch - commit 5c2e4e8 - fix patches metadata - fix Patch-mainline: - patches.suse/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch - patches.suse/x86-sme-use-define-use_early_pgtable_l5-in-mem_encrypt_identity-c.patch - commit fd7ddeb - blacklist.conf: Add 8520e224f547 bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode - commit 04918fc - btrfs: fix memory ordering between normal and ordered work functions (git-fixes). - commit 2b13f6d - blacklist.conf: 5c9d706f6133 (&quot;/bpf: Fix BPF_LSM kconfig symbol dependency&quot;/) Not needed since 30897832d8b9 (&quot;/bpf: Allow local storage to be used from LSM programs&quot;/) is not backported. - commit 22dfc3c - Eradicate Patch-mainline: No The pre-commit check can reject this deprecated tag then. - Refresh patches.suse/acpi_thinkpad_introduce_acpi_root_table_boot_param.patch. - Refresh patches.suse/btrfs-provide-super_operations-get_inode_dev. - commit e877505 - ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE (bsc#1192473). - commit b39e9ef - Update patches.suse/bpf-Remove-MTU-check-in-__bpf_skb_max_len.patch (bsc#1155518 bsc#1192045 CVE-2021-0941). - commit 5daf798 - Update patches.suse/bpf-Remove-MTU-check-in-__bpf_skb_max_len.patch (bsc#1155518 bsc#1192045 CVE-2021-0941). - commit 33fb6b6 - drm: prevent spectre issue in vmw_execbuf_ioctl (bsc#1192802). - qtnfmac: fix potential Spectre vulnerabilities (bsc#1192802). - commit 5952a38 - drm/i915: Introduce intel_hpd_hotplug_irqs() (bsc#1192758). - commit 29d7f7a - Update config files: pull BPF configs together - commit 86a3134 - bpf: Disallow unprivileged bpf by default (jsc#SLE-22573). - bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22573) - Update config files: Add CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set - commit cb7628d - dm ioctl: fix out of bounds array access when no devices (CVE-2021-31916 bsc#1192781). - commit 49351dc - bpf: Disallow unprivileged bpf by default (jsc#SLE-22574). - commit 7b9dddf - bpf: Fix BPF_JIT kconfig symbol dependency (git-fixes jsc#SLE-22574). - bpf: Add kconfig knob for disabling unpriv bpf by default (jsc#SLE-22574) - Update config files: Add CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set - bpf, kconfig: Add consolidated menu entry for bpf with core options (jsc#SLE-22574). - commit 5bd323f - patches.suse/zram-replace-fsync_bdev-with-sync_blockdev.patch: (bsc#1170269). - commit 75a41c2 - patches.suse/zram-avoid-race-between-zram_remove-and-disksize_sto.patch: (bsc#1170269). - commit 406dc3d - patches.suse/zram-don-t-fail-to-remove-zram-during-unloading-modu.patch: (bsc#1170269). - commit cb34e92 - patches.suse/zram-fix-race-between-zram_reset_device-and-disksize.patch: (bsc#1170269). - commit 09f1f4d - patches.suse/zram-replace-fsync_bdev-with-sync_blockdev.patch: (bsc#1170269). - commit 6a0e897 - patches.suse/zram-avoid-race-between-zram_remove-and-disksize_sto.patch: (bsc#1170269). - commit 2c18cb4 - patches.suse/zram-don-t-fail-to-remove-zram-during-unloading-modu.patch: (bsc#1170269). - commit 913e901 - patches.suse/zram-fix-race-between-zram_reset_device-and-disksize.patch: (bsc#1170269). - commit 173dc9b - blacklist.conf: printk/workqueue: very hard to hit; works well with lockless ringuffer; but it might cause wrong timestamps or even lost messages on 5.3 where using par-CPU buffers (bsc#1192750) - commit 63c8c7f - printk/console: Allow to disable console output by using console=&quot;/&quot;/ or console=null (bsc#1192753). - commit 4f99186 - printk: handle blank console arguments passed in (bsc#1192753). - commit db08758 - ALSA: hda: fix general protection fault in azx_runtime_idle (git-fixes). - ALSA: hda: Free card instance properly at probe errors (git-fixes). - commit 57f0538 - ALSA: usb-audio: Fix dB level of Bose Revolve+ SoundLink (bsc#1192375). - ALSA: usb-audio: Add minimal-mute notion in dB mapping table (bsc#1192375). - ALSA: usb-audio: Use int for dB map values (bsc#1192375). - commit 561c434 - Move upstreamed sound fix into sorted section - commit b52485e - net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb (git-fixes). - gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the code and avoid a leak (git-fixes). - stmmac: platform: Fix signedness bug in stmmac_probe_config_dt() (git-fixes). - net: dsa: felix: re-enable TX flow control in ocelot_port_flush() (git-fixes). - net: mscc: ocelot: fix hardware timestamp dequeue logic. - commit 4fdc3dd - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together (bsc#1192745). - commit bc3e5c2 - blacklist.conf: add mscc driver fixes - commit 109b7ec - kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740). - commit a133bf4 - random: fix crash on multiple early calls to add_bootloader_randomness() (bsc#1184924) - commit d4705fe - blacklist.conf: changes device names, kABI massacre - commit 68b0003 - fuse: fix page stealing (bsc#1192718). - commit 5c46aef - ipv4: make exception cache less predictible (bsc#1191790, CVE-2021-20322). - ipv6: make exception cache less predictible (bsc#1191790, CVE-2021-20322). - ipv4: use siphash instead of Jenkins in fnhe_hashfun() (bsc#1191790, CVE-2021-20322). - ipv6: use siphash in rt6_exception_hash() (bsc#1191790, CVE-2021-20322). - commit 191e9b3 - Revert &quot;/x86/kvm: fix vcpu-id indexed array sizes&quot;/ (git-fixes). - commit 918d1fd - Delete patches.kabi/kabi-fix-after-kvm-vcpu-id-array-fix.patch, as the patch causing its introduction is being reverted. - commit 2e03b9d - x86/xen: Mark cpu_bringup_and_idle() as dead_end_function (git-fixes). - commit bb35029 - xen-pciback: Fix return in pm_ctrl_init() (git-fixes). - commit 94628c1 - xen: Fix implicit type conversion (git-fixes). - commit 89e345e - x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c (bsc#1152489). - commit 60c8f9c - scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer (git-fixes). - scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() (git-fixes). - scsi: core: Fix spelling in a source code comment (git-fixes). - scsi: dc395: Fix error case unwinding (git-fixes). - scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() (git-fixes). - scsi: csiostor: Add module softdep on cxgb4 (git-fixes). - scsi: qedf: Fix error codes in qedf_alloc_global_queues() (git-fixes). - scsi: qedi: Fix error codes in qedi_alloc_global_queues() (git-fixes). - scsi: smartpqi: Fix an error code in pqi_get_raid_map() (git-fixes). - scsi: fdomain: Fix error return code in fdomain_probe() (git-fixes). - scsi: BusLogic: Fix missing pr_cont() use (git-fixes). - scsi: iscsi: Fix iface sysfs attr detection (git-fixes). - scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() (git-fixes). - scsi: mpt3sas: Fix error return value in _scsih_expander_add() (git-fixes). - scsi: FlashPoint: Rename si_flags field (git-fixes). - scsi: snic: Fix an error message (git-fixes). - scsi: libsas: Use _safe() loop in sas_resume_port() (git-fixes). - scsi: qedf: Add pointer checks in qedf_update_link_speed() (git-fixes). - Revert &quot;/scsi: ufs: fix a missing check of devm_reset_control_get&quot;/ (git-fixes). - scsi: ufs-pci: Add quirk for broken auto-hibernate for Intel EHL (git-fixes). - scsi: qla2xxx: Make sure that aborted commands are freed (git-fixes). - commit c10ecb2 - EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1152489). - commit e920f56 - s390/qeth: fix deadlock during failing recovery (git-fixes). - s390/qeth: Fix deadlock in remove_discipline (git-fixes). - s390/qeth: fix NULL deref in qeth_clear_working_pool_list() (git-fixes). - commit 8d9df1e - s390/pci: fix zpci_zdev_put() on reserve (git-fixes). - commit 5f2d7a4 - net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work (git-fixes). - s390/pci: fix use after free of zpci_dev (git-fixes). - net/smc: Correct smc link connection counter in case of smc client (git-fixes). - s390/dasd: fix use after free in dasd path handling (git-fixes). - s390/topology: clear thread/group maps for offline cpus (git-fixes). - commit 4287499 - Fix problem with missing installkernel on Tumbleweed. - commit 2ed6686 - ibmvnic: Process crqs after enabling interrupts (bsc#1192273 ltc#194629). - ibmvnic: don't stop queue in xmit (bsc#1192273 ltc#194629). - commit 99d6daa - Revert &quot;/ibmvnic: check failover_pending in login response&quot;/ (bsc#1190523 ltc#194510). - ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510). - commit ac4c874 - Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails (bsc#1191961 CVE-2021-34981). - commit a4ff591 - Revert &quot;/r8152: adjust the settings about MAC clock speed down for RTL8153&quot;/ (git-fixes). - commit 541bc3e - r8152: don't enable U1U2 with USB_SPEED_HIGH for RTL8153B (git-fixes). - commit e20d73d - r8152: Disable PLA MCU clock speed down (git-fixes). - Refresh patches.suse/r8152-disable-test-IO-for-RTL8153B.patch. - commit 9b878a2 - r8152: disable U2P3 for RTL8153B (git-fixes). - commit d6c58f7 - r8152: reset flow control patch when linking on for RTL8153B (git-fixes). - commit 7f46ee2 - r8152: fix runtime resume for linking change (git-fixes). - commit 0ff2979 - r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock Gen 2 (git-fixes). - commit d73c455 - r8152: add a helper function about setting EEE (git-fixes). - commit 5f95fd2 - r8152: divide the tx and rx bottom functions (git-fixes). - Refresh patches.suse/r8152-Re-order-napi_disable-in-rtl8152_close.patch. - Refresh patches.suse/r8152-avoid-to-call-napi_disable-twice.patch. - commit 248b976 - r8152: saving the settings of EEE (git-fixes). - commit 7c0dac3 - r8152: use alloc_pages for rx buffer (git-fixes). - commit 3304002 - r8152: replace array with linking list for rx information (git-fixes). - commit b5a7bd7 - r8152: separate the rx buffer size (git-fixes). - commit 4176c6f - rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request (git-fixes). - commit 3af49ca - crypto: qat - disregard spurious PFVF interrupts (git-fixes). - commit 11f64ca - crypto: qat - detect PFVF collision after ACK (git-fixes). - commit fa10b1f - crypto: caam - disable pkc for non-E SoCs (git-fixes). - commit 49a0bf8 - blacklist.conf: build warning only - commit 389a467 - bpf: Fix potential race in tail call compatibility check (git-fixes). - commit 6fdd9c7 - cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem (git-fixes). - commit c3f4c78 - exfat: handle wrong stream entry size in exfat_readdir() (git-fixes). - exfat: fix erroneous discard when clear cluster bit (git-fixes). - commit 366e900 - exfat: truncate atimes to 2s granularity (bsc#1192328). - Refresh patches.suse/exfat-fix-use-of-uninitialized-spinlock-on-error-path.patch. - exfat: properly set s_time_gran (bsc#1192328). - commit 832525a - Drop two USB patches that are reverted by stable 5.4.158 Deleted: patches.suse/usb-core-hcd-Add-support-for-deferring-roothub-regis.patch patches.suse/xhci-Set-HCD-flag-to-defer-primary-roothub-registrat.patch blacklist.conf: updated - commit 10f1374 - serial: xilinx_uartps: Fix race condition causing stuck TX (git-fixes). - serial: 8250_dw: Drop wrong use of ACPI_PTR() (git-fixes). - staging: rtl8192u: fix control-message timeouts (git-fixes). - USB: serial: keyspan: fix memleak on probe errors (git-fixes). - USB: iowarrior: fix control-message timeouts (git-fixes). - usb: musb: Balance list entry in musb_gadget_queue (git-fixes). - usb: max-3421: Use driver data instead of maintaining a list of bound devices (git-fixes). - usb: gadget: hid: fix error code in do_config() (git-fixes). - commit b954450 - power: supply: bq27xxx: Fix kernel crash on IRQ handler register error (git-fixes). - power: supply: max17042_battery: Prevent int underflow in set_soc_threshold (git-fixes). - =?UTF-8?q?power:=20supply:=20rt5033=5Fbattery:=20Change?= =?UTF-8?q?=20voltage=20values=20to=20=C2=B5V?= (git-fixes). - power: supply: max17042_battery: use VFSOC for capacity when no rsns (git-fixes). - iio: dac: ad5446: Fix ad5622_write() return value (git-fixes). - staging: r8712u: fix control-message timeout (git-fixes). - Revert &quot;/platform/x86: i2c-multi-instantiate: Don't create platform device for INT3515 ACPI nodes&quot;/ (git-fixes). - commit 0f3a4f1 - PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation (git-fixes). - PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG (git-fixes). - PCI: aardvark: Fix return value of MSI domain .alloc() method (git-fixes). - PCI: pci-bridge-emul: Fix emulation of W1C bits (git-fixes). - HID: u2fzero: properly handle timeouts in usb_submit_urb (git-fixes). - HID: u2fzero: clarify error check and length calculations (git-fixes). - pinctrl: core: fix possible memory leak in pinctrl_enable() (git-fixes). - video: fbdev: chipsfb: use memset_io() instead of memset() (git-fixes). - ABI: sysfs-kernel-slab: Document some stats (git-fixes). - commit 92991a1 - auxdisplay: ht16k33: Fix frame buffer device blanking (git-fixes). - auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes). - auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string (git-fixes). - PCI: aardvark: Fix reporting Data Link Layer Link Active (git-fixes). - PCI: aardvark: Fix checking for link up via LTSSM state (git-fixes). - PCI: aardvark: Do not unmask unused interrupts (git-fixes). - PCI: aardvark: Do not clear status bits of masked interrupts (git-fixes). - PCI: aardvark: Don't spam about PIO Response Status (git-fixes). - commit 3e5c258 - ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes). - ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes). - commit b23c22d - ocfs2: do not zero pages beyond i_size (bsc#1190795). - commit 5f3b3d8 - ocfs2: fix data corruption on truncate (bsc#1190795). - commit 4b0d91a - PCI/ACPI: Check for _OSC support in acpi_pci_osc_control_set() (bsc#1169263). - PCI/ACPI: Move _OSC query checks to separate function (bsc#1169263). - PCI/ACPI: Move supported and control calculations to separate functions (bsc#1169263). - PCI/ACPI: Remove OSC_PCI_SUPPORT_MASKS and OSC_PCI_CONTROL_MASKS (bsc#1169263). - PCI/ACPI: Clarify message about _OSC failure (bsc#1169263). - PCI/ACPI: Remove unnecessary osc_lock (bsc#1169263). - commit a38114a - gpio/rockchip: fetch deferred output settings on probe (bsc#1192217). - pinctrl/rockchip: add a queue for deferred pin output settings on probe (bsc#1192217). - gpio/rockchip: fix get_direction value handling (bsc#1192217). - gpio/rockchip: extended debounce support is only available on v2 (bsc#1192217). - pinctrl/rockchip: drop the gpio related codes (bsc#1192217). - gpio/rockchip: drop irq_gc_lock/irq_gc_unlock for irq set type (bsc#1192217). - gpio/rockchip: support next version gpio controller (bsc#1192217). - gpio/rockchip: use struct rockchip_gpio_regs for gpio controller (bsc#1192217). - gpio/rockchip: add driver for rockchip gpio (bsc#1192217). - pinctrl/rockchip: add pinctrl device to gpio bank struct (bsc#1192217). - pinctrl/rockchip: separate struct rockchip_pin_bank to a head file (bsc#1192217). - pinctrl/rockchip: always enable clock for gpio controller (bsc#1192217). - pinctrl: rockchip: do coding style for mux route struct (bsc#1192217). - pinctrl: rockchip: add support for rk3568 (bsc#1192217). - pinctrl: rockchip: make driver be tristate module (bsc#1192217). - pinctrl: rockchip: clear int status when driver probed (bsc#1192217). - pinctrl: rockchip: create irq mapping in gpio_to_irq (bsc#1192217). - pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq (bsc#1192217). - pinctrl: rockchip: Replace HTTP links with HTTPS ones (bsc#1192217). - pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours (bsc#1192217). - pinctrl: rockchip: return ENOMEM instead of EINVAL if allocation fails (bsc#1192217). - pinctrl: rockchip: add rk3308 SoC support (bsc#1192217). - commit de4b584 Package keyutils was updated: - Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)- update to 1.6.3: * Revert the change notifications that were using /dev/watch_queue. * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE). * Allow &quot;/keyctl supports&quot;/ to retrieve raw capability data. * Allow &quot;/keyctl id&quot;/ to turn a symbolic key ID into a numeric ID. * Allow &quot;/keyctl new_session&quot;/ to name the keyring. * Allow &quot;/keyctl add/padd/etc.&quot;/ to take hex-encoded data. * Add &quot;/keyctl watch*&quot;/ to expose kernel change notifications on keys. * Add caps for namespacing and notifications. * Set a default TTL on keys that upcall for name resolution. * Explicitly clear memory after it's held sensitive information. * Various manual page fixes. * Fix C++-related errors. * Add support for keyctl_move(). * Add support for keyctl_capabilities(). * Make key=val list optional for various public-key ops. * Fix system call signature for KEYCTL_PKEY_QUERY. * Fix 'keyctl pkey_query' argument passing. * Use keyctl_read_alloc() in dump_key_tree_aux(). * Various manual page fixes. - spec-cleaner run (fixup failing homepage url) - prepare usrmerge (boo#1029961) - updated to 1.6 - Apply various specfile cleanups from Fedora. - request-key: Provide a command line option to suppress helper execution. - request-key: Find least-wildcard match rather than first match. - Remove the dependency on MIT Kerberos. - Fix some error messages - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes. - Fix doc and comment typos. - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20). - Add pkg-config support for finding libkeyutils. - upstream isn't offering PGP signatures for the source tarballs anymore - Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS to shortcut the ring0 bootstrap cycle by also using krb5-mini. - add upstream signing key and verify source signature - updated to 1.5.11 (bsc#1113013) - Add keyring restriction support. - Add KDF support to the Diffie-Helman function. - DNS: Add support for AFS config files and SRV records Package kmod was updated: - Ensure that kmod and packages linking to libkmod provide same features (bsc#1193430). Package libgcrypt was updated: - FIPS: Fix gcry_mpi_sub_ui subtraction [bsc#1193480] * gcry_mpi_sub_ui: fix subtracting from negative value * Add libgcrypt-FIPS-fix-gcry_mpi_sub_ui.patch Package lvm2 was updated: - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch Package mozilla-nss was updated: - Mozilla NSS 3.68.1 MFSA 2021-51 (bsc#1193170) * CVE-2021-43527 (bmo#1737470) Memory corruption via DER-encoded DSA and RSA-PSS signatures - Remove now obsolete patch nss-bsc1193170.patch - Add patch to fix CVE-2021-43527 (bsc#1193170): nss-bsc1193170.patch Package openssh was updated: - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. Package openssl-1_1 was updated: - Previously added patch interferes with FIPS validation. * Removed openssl-1.1.1-fips_list_ciphers.patch Package p11-kit was updated: - 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch 0001-Check-for-arithmetic-overflows-before-allocating.patch 0001-Follow-up-to-arithmetic-overflow-fix.patch: Fixed multiple integer overflows in rpc code (bsc#1180064 CVE-2020-29361) - Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993, 0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch) - add bcond to spec file to enable debug easily Package permissions was updated: * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)- Update to version 20181225: Package python3 was updated: - The previous construct works only on the current Factory, not in SLE. - BuildRequire rpm-build-python: The provider to inject python(abi) has been moved there. rpm-build pulls rpm-build-python automatically in when building anything against python3-base, but this implies that the initial build of python3-base does not trigger the automatic installation. - Due to conflicting demands of bsc#1183858 and platforms where Python 3.6 is only in interpreter+pip set we have to make complicated ugly construct about Sphinx BR. - Make python36 primary interpreter on SLE-15 - Make build working even on older SLEs. - Update to 3.6.15: - bpo-43124: Made the internal putcmd function in smtplib sanitize input for presence of r and n characters to avoid (unlikely) command injection. Library - bpo-45001: Made email date parsing more robust against malformed input, namely a whitespace-only Date: header. Patch by Wouter Bolsterlee. Tests - bpo-38965: Fix test_faulthandler on GCC 10. Use the “volatile” keyword in faulthandler._stack_overflow() to prevent tail call optimization on any compiler, rather than relying on compiler specific pragma. - Remove upstreamed patches: - faulthandler_stack_overflow_on_GCC10.patch - test_faulthandler is still problematic under qemu linux-user emulation, disable it there - Update to 3.6.14: * Security - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now avoids infinitely reading potential HTTP headers after a 100 Continue status response from the server. - bpo-43882: The presence of newline or tab characters in parts of a URL could allow some forms of attacks. Following the controlling specification for URLs defined by WHATWG urllib.parse() now removes ASCII newlines and tabs from URLs, preventing such attacks. - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature of the pydoc module which could be abused to read arbitrary files on the disk (directory traversal vulnerability). Moreover, even source code of Python modules can contain sensitive data like passwords. Vulnerability reported by David Schwörer. - bpo-43285: ftplib no longer trusts the IP address value returned from the server in response to the PASV command by default. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network. Code that requires the former vulnerable behavior may set a trust_server_pasv_ipv4_address attribute on their ftplib.FTP instances to True to re-enable it. - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression Denial of Service (ReDoS) vulnerability in urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex has quadratic worst-case complexity and it allows cause a denial of service when identifying crafted invalid RFCs. This ReDoS issue is on the client side and needs remote attackers to control the HTTP server. - Upstreamed patches were removed: - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch - Refreshed patches: - python3-sorted_tar.patch - riscv64-ctypes.patch - Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858). - Modify Lib/ensurepip/__init__.py to contain the same version numbers as are in reality the ones in the bundled wheels (bsc#1187668). - add 22198.patch to build with Sphinx 4 - Stop providing &quot;/python&quot;/ symbol (bsc#1185588), which means python2 currently. - (bsc#1180125) We really don't Require python-rpm-macros package. Unnecessary dependency. Package runc was updated: - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 (bsc#1193436) * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). Package samba was updated: - The username map [script] advice from CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails; (bsc#1192849); (bso#14901). Package suse-module-tools was updated: - Update to version 15.3.15: * blacklist isst_if_mbox_msr (bsc#1187196) Package system-users was updated: - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). Package systemd was updated: * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce &quot;/none&quot;/ for loop devices (boo#1193759) - Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1 0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858) 848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858) ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423) 9325a68316 test: use kbd-mode-map we ship in one more test case 8ff379e11d test-keymap-util: always use kbd-model-map we ship Package timezone was updated: - timezone update 2021e (bsc#1177460): * Palestine will fall back 10-29 (not 10-30) at 01:00 - timezone update 2021d: * Fiji suspends DST for the 2021/2022 season * 'zic -r' marks unspecified timestamps with &quot;/-00&quot;/ - timezone update 2021c: * Revert almost all of 2021b's changes to the 'backward' file * Fix a bug in 'zic -b fat' that caused old timestamps to be mishandled in 32-bit-only readers - timezone update 2021b: * Jordan now starts DST on February's last Thursday. * Samoa no longer observes DST. * Move some backward-compatibility links to 'backward'. * Rename Pacific/Enderbury to Pacific/Kanton. * Correct many pre-1993 transitions in Malawi, Portugal, etc. * zic now creates each output file or link atomically. * zic -L no longer omits the POSIX TZ string in its output. * zic fixes for truncation and leap second table expiration. * zic now follows POSIX for TZ strings using all-year DST. * Fix some localtime crashes and bugs in obscure cases. * zdump -v now outputs more-useful boundary cases. * tzfile.5 better matches a draft successor to RFC 8536. - Refresh tzdata-china.patch Package xen was updated: - bsc#1192554 - VUL-0: CVE-2021-28706: xen: guests may exceed their designated memory limit (XSA-385) xsa385.patch - bsc#1192557 - VUL-0: CVE-2021-28704,CVE-2021-28707,CVE-2021-28708: xen: PoD operations on misaligned GFNs (XSA-388) xsa388-1.patch xsa388-2.patch - bsc#1192559 - VUL-0: CVE-2021-28705,CVE-2021-28709: xen: issues with partially successful P2M updates on x86 (XSA-389) xsa389.patch - Upstream bug fixes (bsc#1027519) 6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch 6138b7a2-x86-AMD-enum-speculative-hints.patch 6138b7a3-x86-AMD-use-newer-SSBD.patch 6139f1b1-x86-spec-ctrl-print-AMD-features.patch 6148453b-VT-d-hidden-devices-unmap.patch 6148455f-VT-d-PCI-segment-numbers-16-bits.patch 61532102-PCI-bridge-with-subord-bus-0xFF.patch - bsc#1191363 - VUL-0: CVE-2021-28702: xen: PCI devices with RMRRs not deassigned correctly (XSA-386) 615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch - Update to Xen 4.14.3 bug fix release (bsc#1027519) xen-4.14.3-testing-src.tar.bz2 - Drop patches contained in new tarball 608676f2-VT-d-register-based-invalidation-optional.patch 60a27288-x86emul-gas-2-36-test-harness-build.patch 60af933d-x86-gcc11-hypervisor-build.patch 60afe616-x86-CPUID-rework-HLE-and-RTM-handling.patch 60afe617-x86-TSX-minor-cleanup-and-improvements.patch 60afe618-x86-TSX-deprecate-vpmu=rtm-abort.patch 60be0e24-credit2-pick-runnable-unit.patch 60be0e42-credit2-per-entity-load-tracking-when-continuing.patch 60be3097-x86-CPUID-fix-HLE-and-RTM-handling-again.patch 60bf9e19-Arm-create-dom0less-domUs-earlier.patch 60bf9e1a-Arm-boot-modules-scrubbing.patch 60bf9e1b-VT-d-size-qinval-queue-dynamically.patch 60bf9e1c-AMD-IOMMU-size-command-buffer-dynamically.patch 60bf9e1d-VT-d-eliminate-flush-related-timeouts.patch 60bf9e1e-x86-spec-ctrl-protect-against-SCSB.patch 60bf9e1f-x86-spec-ctrl-mitigate-TAA-after-S3.patch 60bfa904-AMD-IOMMU-wait-for-command-slot.patch 60bfa906-AMD-IOMMU-drop-command-completion-timeout.patch 60c0bf86-x86-TSX-cope-with-deprecation.patch 60c8a7ac-x86-vpt-fully-init-timers-before-enlisting.patch 60c8de6e-osdep_xenforeignmemory_map-prototype.patch 60d49689-VT-d-undo-device-mappings-upon-error.patch 60d496b9-VT-d-adjust-domid-map-updating-on-unmap.patch 60d496d6-VT-d-clear_fault_bits-should-clear-all.patch 60d496ee-VT-d-dont-lose-errors-on-multi-IOMMU-flush.patch 60d5c6df-IOMMU-PCI-dont-let-domain-cleanup-continue.patch 61001231-x86-work-around-GNU-ld-2-37-issue.patch 61122ac6-credit2-avoid-spuriously-picking-idle.patch 611a7e38-x86-CET-shstk-WARN-manipulation.patch 611cba4e-VT-d-Tylersburg-errata-more-steppings.patch 611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch 6126339d-AMD-IOMMU-global-ER-extending.patch 6126344f-AMD-IOMMU-unity-map-handling.patch 61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch 6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch 6126349a-AMD-IOMMU-rearrange-reassignment.patch 612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch 612634c3-x86-p2m-introduce-p2m_is_special.patch 612634dc-x86-p2m-guard-identity-mappings.patch 612634f4-x86-mm-widen-locked-region-in-xatp1.patch 6126350a-gnttab-release-mappings-preemption.patch 6126351f-gnttab-replace-mapkind.patch 6126353d-gnttab-get-status-frames-array-capacity.patch 61263553-Arm-restrict-maxmem-for-dom0less.patch 6128a856-gnttab-radix-tree-node-init.patch xsa384.patch Package zlib was updated: - Update 410.patch to include new fixes from upstream, fixes bsc#1192688 - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch to match upstream commit - Drop patches which changes have been merged in 410.patch: * zlib-compression-switching.patch * zlib-390x-z15-fix-hw-compression.patch * bsc1174551-fxi-imcomplete-raw-streams.patch The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://publiccloudimagechangeinfo.suse.com/google/sles-15-sp3-chost-byos-v20220103/ Public Cloud Image Info https://www.suse.com/support/security/rating/ SUSE Security Ratings Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 aaa_base-84.87+git20180409.04c9dae-3.52.1 apparmor-abstractions-2.13.6-3.8.1 apparmor-parser-2.13.6-3.8.1 cpupower-5.1-3.6.1 dracut-049.1+suse.218.gca24e614-3.48.3 glibc-2.31-9.6.1 glibc-locale-2.31-9.6.1 glibc-locale-base-2.31-9.6.1 grub2-2.04-22.6.3 grub2-i386-pc-2.04-22.6.3 grub2-x86_64-efi-2.04-22.6.3 kernel-default-5.3.18-59.37.2 keyutils-1.6.3-5.6.1 kmod-29-4.15.1 libapparmor1-2.13.6-3.8.1 libcpupower0-5.1-3.6.1 libdcerpc-binding0-4.13.13+git.539.fdbc44a8598-3.20.2 libdcerpc0-4.13.13+git.539.fdbc44a8598-3.20.2 libdevmapper1_03-1.02.163-8.39.1 libfreebl3-3.68.1-3.61.1 libgcrypt20-1.8.2-8.42.1 libgmp10-6.1.2-4.9.1 libkeyutils1-1.6.3-5.6.1 libkmod2-29-4.15.1 libndr-krb5pac0-4.13.13+git.539.fdbc44a8598-3.20.2 libndr-nbt0-4.13.13+git.539.fdbc44a8598-3.20.2 libndr-standard0-4.13.13+git.539.fdbc44a8598-3.20.2 libndr1-4.13.13+git.539.fdbc44a8598-3.20.2 libnetapi0-4.13.13+git.539.fdbc44a8598-3.20.2 libopenssl1_1-1.1.1d-11.33.2 libp11-kit0-0.23.2-4.13.1 libpython3_6m1_0-3.6.15-10.9.1 libsamba-credentials0-4.13.13+git.539.fdbc44a8598-3.20.2 libsamba-errors0-4.13.13+git.539.fdbc44a8598-3.20.2 libsamba-hostconfig0-4.13.13+git.539.fdbc44a8598-3.20.2 libsamba-passdb0-4.13.13+git.539.fdbc44a8598-3.20.2 libsamba-util0-4.13.13+git.539.fdbc44a8598-3.20.2 libsamdb0-4.13.13+git.539.fdbc44a8598-3.20.2 libsmbconf0-4.13.13+git.539.fdbc44a8598-3.20.2 libsmbldap2-4.13.13+git.539.fdbc44a8598-3.20.2 libsystemd0-246.16-7.28.1 libtevent-util0-4.13.13+git.539.fdbc44a8598-3.20.2 libudev1-246.16-7.28.1 libwbclient0-4.13.13+git.539.fdbc44a8598-3.20.2 libz1-1.2.11-3.24.1 openssh-8.4p1-3.9.1 openssh-clients-8.4p1-3.9.1 openssh-common-8.4p1-3.9.1 openssh-server-8.4p1-3.9.1 openssl-1_1-1.1.1d-11.33.2 p11-kit-0.23.2-4.13.1 p11-kit-tools-0.23.2-4.13.1 permissions-20181225-23.9.1 python3-3.6.15-10.9.1 python3-base-3.6.15-10.9.1 runc-1.0.3-27.1 samba-libs-4.13.13+git.539.fdbc44a8598-3.20.2 samba-libs-python3-4.13.13+git.539.fdbc44a8598-3.20.2 suse-module-tools-15.3.15-3.17.1 system-group-hardware-20170617-17.3.1 system-group-kvm-20170617-17.3.1 system-group-wheel-20170617-17.3.1 system-user-lp-20170617-17.3.1 system-user-nobody-20170617-17.3.1 systemd-246.16-7.28.1 systemd-sysvinit-246.16-7.28.1 timezone-2021e-75.4.1 udev-246.16-7.28.1 xen-libs-4.14.3_04-3.15.1 aaa_base-84.87+git20180409.04c9dae-3.52.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 apparmor-abstractions-2.13.6-3.8.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 apparmor-parser-2.13.6-3.8.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 cpupower-5.1-3.6.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 dracut-049.1+suse.218.gca24e614-3.48.3 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 glibc-2.31-9.6.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 glibc-locale-2.31-9.6.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 glibc-locale-base-2.31-9.6.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 grub2-2.04-22.6.3 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 grub2-i386-pc-2.04-22.6.3 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 grub2-x86_64-efi-2.04-22.6.3 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 kernel-default-5.3.18-59.37.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 keyutils-1.6.3-5.6.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 kmod-29-4.15.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libapparmor1-2.13.6-3.8.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libcpupower0-5.1-3.6.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libdcerpc-binding0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libdcerpc0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libdevmapper1_03-1.02.163-8.39.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libfreebl3-3.68.1-3.61.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libgcrypt20-1.8.2-8.42.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libgmp10-6.1.2-4.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libkeyutils1-1.6.3-5.6.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libkmod2-29-4.15.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libndr-krb5pac0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libndr-nbt0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libndr-standard0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libndr1-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libnetapi0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libopenssl1_1-1.1.1d-11.33.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libp11-kit0-0.23.2-4.13.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libpython3_6m1_0-3.6.15-10.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsamba-credentials0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsamba-errors0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsamba-hostconfig0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsamba-passdb0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsamba-util0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsamdb0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsmbconf0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsmbldap2-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libsystemd0-246.16-7.28.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libtevent-util0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libudev1-246.16-7.28.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libwbclient0-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 libz1-1.2.11-3.24.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 openssh-8.4p1-3.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 openssh-clients-8.4p1-3.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 openssh-common-8.4p1-3.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 openssh-server-8.4p1-3.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 openssl-1_1-1.1.1d-11.33.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 p11-kit-0.23.2-4.13.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 p11-kit-tools-0.23.2-4.13.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 permissions-20181225-23.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 python3-3.6.15-10.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 python3-base-3.6.15-10.9.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 runc-1.0.3-27.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 samba-libs-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 samba-libs-python3-4.13.13+git.539.fdbc44a8598-3.20.2 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 suse-module-tools-15.3.15-3.17.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 system-group-hardware-20170617-17.3.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 system-group-kvm-20170617-17.3.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 system-group-wheel-20170617-17.3.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 system-user-lp-20170617-17.3.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 system-user-nobody-20170617-17.3.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 systemd-246.16-7.28.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 systemd-sysvinit-246.16-7.28.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 timezone-2021e-75.4.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 udev-246.16-7.28.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 xen-libs-4.14.3_04-3.15.1 as a component of Public Cloud Image google/sles-15-sp3-chost-byos-v20220103 A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. CVE-2020-25717 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:samba-libs-4.13.13+git.539.fdbc44a8598-3.20.2 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:samba-libs-python3-4.13.13+git.539.fdbc44a8598-3.20.2 important 8.5 AV:N/AC:L/Au:S/C:C/I:C/A:N An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc. CVE-2020-29361 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:libp11-kit0-0.23.2-4.13.1 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:p11-kit-0.23.2-4.13.1 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:p11-kit-tools-0.23.2-4.13.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References: Upstream kernel CVE-2021-0941 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:kernel-default-5.3.18-59.37.2 important 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well. CVE-2021-20322 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:kernel-default-5.3.18-59.37.2 important 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. CVE-2021-28041 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:openssh-8.4p1-3.9.1 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:openssh-clients-8.4p1-3.9.1 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:openssh-common-8.4p1-3.9.1 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:openssh-server-8.4p1-3.9.1 important 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption. CVE-2021-28702 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:xen-libs-4.14.3_04-3.15.1 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for the specified order, yet some code involved in PoD handling actually makes such an assumption. These operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707), the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain. (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708, patch 2). CVE-2021-28704 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:xen-libs-4.14.3_04-3.15.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error handling in certain PoD cases has been insufficient in that in particular partial success of some operations was not properly accounted for. There are two code paths affected - page removal (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix to both issues.) CVE-2021-28705 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:xen-libs-4.14.3_04-3.15.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound. CVE-2021-28706 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:xen-libs-4.14.3_04-3.15.1 moderate 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability. CVE-2021-31916 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:kernel-default-5.3.18-59.37.2 moderate 6.1 AV:L/AC:L/Au:N/C:P/I:P/A:C There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7. CVE-2021-3426 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:python3-3.6.15-10.9.1 moderate 2.7 AV:A/AC:L/Au:S/C:P/I:N/A:N ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2021-34981 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:kernel-default-5.3.18-59.37.2 important There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. CVE-2021-3733 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:python3-3.6.15-10.9.1 low 4 AV:N/AC:L/Au:S/C:N/I:N/A:P A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. CVE-2021-3737 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:python3-3.6.15-10.9.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. CVE-2021-41617 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:openssh-8.4p1-3.9.1 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:openssh-clients-8.4p1-3.9.1 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:openssh-common-8.4p1-3.9.1 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:openssh-server-8.4p1-3.9.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1. CVE-2021-43527 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:libfreebl3-3.68.1-3.61.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms. CVE-2021-43618 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:libgmp10-6.1.2-4.9.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug. CVE-2021-43784 Public Cloud Image google/sles-15-sp3-chost-byos-v20220103:runc-1.0.3-27.1 moderate