Security update for the Linux Kernel (Live Patch 24 for SLE 12 SP5) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3692-1 Final 1 1 2021-11-17T09:02:32Z current 2021-11-17T09:02:32Z 2021-11-17T09:02:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 24 for SLE 12 SP5) This update for the Linux Kernel 4.12.14-122_91 fixes several issues. The following security issues were fixed: - CVE-2021-0935: Fixed use after free that could lead to local escalation of privilege in ip6_xmit of ip6_output.c (bsc#1192042). - CVE-2021-41864: Fixed an integer overflow with a resultant out-of-bounds write in prealloc_elems_and_freelist in kernel/bpf/stackmap.c (bsc#1191318). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-3692,SUSE-SLE-Live-Patching-12-SP5-2021-3692 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213692-1/ Link for SUSE-SU-2021:3692-1 https://lists.suse.com/pipermail/sle-security-updates/2021-November/009742.html E-Mail link for SUSE-SU-2021:3692-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1191318 SUSE Bug 1191318 https://bugzilla.suse.com/1192042 SUSE Bug 1192042 https://www.suse.com/security/cve/CVE-2021-0935/ SUSE CVE CVE-2021-0935 page https://www.suse.com/security/cve/CVE-2021-41864/ SUSE CVE CVE-2021-41864 page SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_91-default-2-2.2 kgraft-patch-4_12_14-122_91-default-2-2.2 as a component of SUSE Linux Enterprise Live Patching 12 SP5 In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168607263References: Upstream kernel CVE-2021-0935 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-2-2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213692-1/ https://www.suse.com/security/cve/CVE-2021-0935.html CVE-2021-0935 https://bugzilla.suse.com/1192032 SUSE Bug 1192032 https://bugzilla.suse.com/1192042 SUSE Bug 1192042 https://bugzilla.suse.com/1196722 SUSE Bug 1196722 prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write. CVE-2021-41864 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-2-2.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213692-1/ https://www.suse.com/security/cve/CVE-2021-41864.html CVE-2021-41864 https://bugzilla.suse.com/1191317 SUSE Bug 1191317 https://bugzilla.suse.com/1191318 SUSE Bug 1191318