Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:0764-1 Final 1 1 2022-03-09T13:32:59Z current 2022-03-09T13:32:59Z 2022-03-09T13:32:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes. Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated. The following security bugs were fixed: - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580). - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580). - CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584). The following non-security bugs were fixed: - btrfs: check for missing device in btrfs_trim_fs (bsc#1195701). - lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584). - nfsd: allow delegation state ids to be revoked and then freed (bsc#1192483). - nfsd: allow open state ids to be revoked and then freed (bsc#1192483). - nfsd: do not admin-revoke NSv4.0 state ids (bsc#1192483). - nfsd: prepare for supporting admin-revocation of state (bsc#1192483). - powerpc/pseries/ddw: Revert 'Extend upper limit for huge DMA window for persistent memory' (bsc#1195995 ltc#196394). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-764,SUSE-SLE-Module-RT-15-SP2-2022-764,SUSE-SUSE-MicroOS-5.0-2022-764 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20220764-1/ Link for SUSE-SU-2022:0764-1 https://lists.suse.com/pipermail/sle-security-updates/2022-March/010389.html E-Mail link for SUSE-SU-2022:0764-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1191580 SUSE Bug 1191580 https://bugzilla.suse.com/1192483 SUSE Bug 1192483 https://bugzilla.suse.com/1195701 SUSE Bug 1195701 https://bugzilla.suse.com/1195995 SUSE Bug 1195995 https://bugzilla.suse.com/1196584 SUSE Bug 1196584 https://www.suse.com/security/cve/CVE-2022-0001/ SUSE CVE CVE-2022-0001 page https://www.suse.com/security/cve/CVE-2022-0002/ SUSE CVE CVE-2022-0002 page https://www.suse.com/security/cve/CVE-2022-0847/ SUSE CVE CVE-2022-0847 page SUSE Linux Enterprise Micro 5.0 SUSE Real Time Module 15 SP2 cluster-md-kmp-rt-5.3.18-76.1 cluster-md-kmp-rt_debug-5.3.18-76.1 dlm-kmp-rt-5.3.18-76.1 dlm-kmp-rt_debug-5.3.18-76.1 gfs2-kmp-rt-5.3.18-76.1 gfs2-kmp-rt_debug-5.3.18-76.1 kernel-devel-rt-5.3.18-76.1 kernel-rt-5.3.18-76.1 kernel-rt-devel-5.3.18-76.1 kernel-rt-extra-5.3.18-76.1 kernel-rt-livepatch-devel-5.3.18-76.1 kernel-rt_debug-5.3.18-76.1 kernel-rt_debug-devel-5.3.18-76.1 kernel-rt_debug-extra-5.3.18-76.1 kernel-rt_debug-livepatch-devel-5.3.18-76.1 kernel-source-rt-5.3.18-76.1 kernel-syms-rt-5.3.18-76.1 kselftests-kmp-rt-5.3.18-76.1 kselftests-kmp-rt_debug-5.3.18-76.1 ocfs2-kmp-rt-5.3.18-76.1 ocfs2-kmp-rt_debug-5.3.18-76.1 reiserfs-kmp-rt-5.3.18-76.1 reiserfs-kmp-rt_debug-5.3.18-76.1 kernel-rt-5.3.18-76.1 as a component of SUSE Linux Enterprise Micro 5.0 cluster-md-kmp-rt-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 dlm-kmp-rt-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 gfs2-kmp-rt-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 kernel-devel-rt-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 kernel-rt-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 kernel-rt-devel-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 kernel-rt_debug-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 kernel-rt_debug-devel-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 kernel-source-rt-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 kernel-syms-rt-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 ocfs2-kmp-rt-5.3.18-76.1 as a component of SUSE Real Time Module 15 SP2 Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. CVE-2022-0001 SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-76.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220764-1/ https://www.suse.com/security/cve/CVE-2022-0001.html CVE-2022-0001 https://bugzilla.suse.com/1191580 SUSE Bug 1191580 https://bugzilla.suse.com/1196901 SUSE Bug 1196901 Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. CVE-2022-0002 SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-76.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220764-1/ https://www.suse.com/security/cve/CVE-2022-0002.html CVE-2022-0002 https://bugzilla.suse.com/1191580 SUSE Bug 1191580 https://bugzilla.suse.com/1196901 SUSE Bug 1196901 A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. CVE-2022-0847 SUSE Linux Enterprise Micro 5.0:kernel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:cluster-md-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:dlm-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:gfs2-kmp-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-devel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt-devel-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt_debug-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-rt_debug-devel-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-source-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:kernel-syms-rt-5.3.18-76.1 SUSE Real Time Module 15 SP2:ocfs2-kmp-rt-5.3.18-76.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220764-1/ https://www.suse.com/security/cve/CVE-2022-0847.html CVE-2022-0847 https://bugzilla.suse.com/1196584 SUSE Bug 1196584 https://bugzilla.suse.com/1196601 SUSE Bug 1196601