Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:1074-1 Final 1 1 2021-04-07T07:11:18Z current 2021-04-07T07:11:18Z 2021-04-07T07:11:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3) This update for the Linux Kernel 4.4.180-94_141 fixes several issues. The following security issues were fixed: - CVE-2021-27365: Fixed an issue where data structures did not have appropriate length constraints or checks, and could exceed the PAGE_SIZE value (bsc#1183491). - CVE-2021-27363: Fixed a kernel pointer leak which could have been used to determine the address of the iscsi_transport structure (bsc#1183120). - CVE-2021-27364: Fixed an issue where an unprivileged user could craft Netlink messages (bsc#1182717). - CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bsc#1177513). - CVE-2020-0429: Fixed a memory corruption due to a use after free which could have led to local escalation of privilege with System execution privileges needed (bsc#1176931). - CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165631). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-1074,SUSE-SLE-SAP-12-SP3-2021-1074,SUSE-SLE-SERVER-12-SP3-2021-1074 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20211074-1/ Link for SUSE-SU-2021:1074-1 https://lists.suse.com/pipermail/sle-security-updates/2021-April/008590.html E-Mail link for SUSE-SU-2021:1074-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1165631 SUSE Bug 1165631 https://bugzilla.suse.com/1176931 SUSE Bug 1176931 https://bugzilla.suse.com/1177513 SUSE Bug 1177513 https://bugzilla.suse.com/1182717 SUSE Bug 1182717 https://bugzilla.suse.com/1183120 SUSE Bug 1183120 https://bugzilla.suse.com/1183491 SUSE Bug 1183491 https://www.suse.com/security/cve/CVE-2020-0429/ SUSE CVE CVE-2020-0429 page https://www.suse.com/security/cve/CVE-2020-1749/ SUSE CVE CVE-2020-1749 page https://www.suse.com/security/cve/CVE-2020-25645/ SUSE CVE CVE-2020-25645 page https://www.suse.com/security/cve/CVE-2021-27363/ SUSE CVE CVE-2021-27363 page https://www.suse.com/security/cve/CVE-2021-27364/ SUSE CVE CVE-2021-27364 page https://www.suse.com/security/cve/CVE-2021-27365/ SUSE CVE CVE-2021-27365 page SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_141-default-2-2.2 kgraft-patch-4_4_180-94_141-default-2-2.2 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_141-default-2-2.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152735806 CVE-2020-0429 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_141-default-2-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_141-default-2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211074-1/ https://www.suse.com/security/cve/CVE-2020-0429.html CVE-2020-0429 https://bugzilla.suse.com/1176724 SUSE Bug 1176724 https://bugzilla.suse.com/1176931 SUSE Bug 1176931 https://bugzilla.suse.com/1188026 SUSE Bug 1188026 A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. CVE-2020-1749 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_141-default-2-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_141-default-2-2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211074-1/ https://www.suse.com/security/cve/CVE-2020-1749.html CVE-2020-1749 https://bugzilla.suse.com/1165629 SUSE Bug 1165629 https://bugzilla.suse.com/1165631 SUSE Bug 1165631 https://bugzilla.suse.com/1177511 SUSE Bug 1177511 https://bugzilla.suse.com/1177513 SUSE Bug 1177513 https://bugzilla.suse.com/1189302 SUSE Bug 1189302 A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality. CVE-2020-25645 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_141-default-2-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_141-default-2-2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211074-1/ https://www.suse.com/security/cve/CVE-2020-25645.html CVE-2020-25645 https://bugzilla.suse.com/1177511 SUSE Bug 1177511 https://bugzilla.suse.com/1177513 SUSE Bug 1177513 An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables. CVE-2021-27363 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_141-default-2-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_141-default-2-2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211074-1/ https://www.suse.com/security/cve/CVE-2021-27363.html CVE-2021-27363 https://bugzilla.suse.com/1182716 SUSE Bug 1182716 https://bugzilla.suse.com/1182717 SUSE Bug 1182717 https://bugzilla.suse.com/1183120 SUSE Bug 1183120 https://bugzilla.suse.com/1200084 SUSE Bug 1200084 An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages. CVE-2021-27364 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_141-default-2-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_141-default-2-2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211074-1/ https://www.suse.com/security/cve/CVE-2021-27364.html CVE-2021-27364 https://bugzilla.suse.com/1182715 SUSE Bug 1182715 https://bugzilla.suse.com/1182716 SUSE Bug 1182716 https://bugzilla.suse.com/1182717 SUSE Bug 1182717 https://bugzilla.suse.com/1200084 SUSE Bug 1200084 https://bugzilla.suse.com/1214268 SUSE Bug 1214268 An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message. CVE-2021-27365 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_141-default-2-2.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_141-default-2-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211074-1/ https://www.suse.com/security/cve/CVE-2021-27365.html CVE-2021-27365 https://bugzilla.suse.com/1182712 SUSE Bug 1182712 https://bugzilla.suse.com/1182715 SUSE Bug 1182715 https://bugzilla.suse.com/1183491 SUSE Bug 1183491 https://bugzilla.suse.com/1200084 SUSE Bug 1200084 https://bugzilla.suse.com/1214268 SUSE Bug 1214268