Security update for the Linux Kernel (Live Patch 24 for SLE 15 SP2) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:0991-1 Final 1 1 2022-03-29T09:42:17Z current 2022-03-29T09:42:17Z 2022-03-29T09:42:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 24 for SLE 15 SP2) This update for the Linux Kernel 5.3.18-24_102 fixes one issue. The following security issue was fixed: - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-991,SUSE-SLE-Live-Patching-12-SP4-2022-1008,SUSE-SLE-Live-Patching-12-SP5-2022-1017,SUSE-SLE-Module-Live-Patching-15-2022-973,SUSE-SLE-Module-Live-Patching-15-SP1-2022-1014,SUSE-SLE-Module-Live-Patching-15-SP2-2022-1015,SUSE-SLE-Module-Live-Patching-15-SP2-2022-987,SUSE-SLE-Module-Live-Patching-15-SP2-2022-990,SUSE-SLE-Module-Live-Patching-15-SP2-2022-991,SUSE-SLE-Module-Live-Patching-15-SP2-2022-992,SUSE-SLE-Module-Live-Patching-15-SP2-2022-993,SUSE-SLE-Module-Live-Patching-15-SP2-2022-994,SUSE-SLE-Module-Live-Patching-15-SP2-2022-995 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20220991-1/ Link for SUSE-SU-2022:0991-1 https://lists.suse.com/pipermail/sle-security-updates/2022-March/010554.html E-Mail link for SUSE-SU-2022:0991-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1195908 SUSE Bug 1195908 https://www.suse.com/security/cve/CVE-2022-0492/ SUSE CVE CVE-2022-0492 page SUSE Linux Enterprise Live Patching 12 SP4 SUSE Linux Enterprise Live Patching 12 SP5 SUSE Linux Enterprise Live Patching 15 SUSE Linux Enterprise Live Patching 15 SP1 SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_86-default-7-150200.2.1 kernel-livepatch-5_3_18-24_86-preempt-7-150200.2.1 kgraft-patch-4_12_14-95_88-default-2-2.1 kgraft-patch-4_12_14-122_110-default-2-2.1 kernel-livepatch-4_12_14-150_83-default-2-150000.2.1 kernel-livepatch-4_12_14-197_105-default-2-150100.2.1 kernel-livepatch-5_3_18-24_83-default-7-150200.2.1 kernel-livepatch-5_3_18-24_78-default-9-150200.2.1 kernel-livepatch-5_3_18-24_75-default-10-150200.2.1 kernel-livepatch-5_3_18-24_93-default-6-150200.2.1 kernel-livepatch-5_3_18-24_96-default-5-150200.2.1 kernel-livepatch-5_3_18-24_99-default-4-150200.2.1 kernel-livepatch-5_3_18-24_102-default-3-150200.2.1 kgraft-patch-4_12_14-95_88-default-2-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP4 kgraft-patch-4_12_14-122_110-default-2-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-livepatch-4_12_14-150_83-default-2-150000.2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-197_105-default-2-150100.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP1 kernel-livepatch-5_3_18-24_83-default-7-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_78-default-9-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_75-default-10-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_86-default-7-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_93-default-6-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_96-default-5-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_99-default-4-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_102-default-3-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. CVE-2022-0492 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_88-default-2-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_110-default-2-2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_105-default-2-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_102-default-3-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_75-default-10-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_78-default-9-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_83-default-7-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_86-default-7-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_93-default-6-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_96-default-5-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_99-default-4-150200.2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_83-default-2-150000.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220991-1/ https://www.suse.com/security/cve/CVE-2022-0492.html CVE-2022-0492 https://bugzilla.suse.com/1195543 SUSE Bug 1195543 https://bugzilla.suse.com/1195908 SUSE Bug 1195908 https://bugzilla.suse.com/1196612 SUSE Bug 1196612 https://bugzilla.suse.com/1196776 SUSE Bug 1196776 https://bugzilla.suse.com/1198615 SUSE Bug 1198615 https://bugzilla.suse.com/1199255 SUSE Bug 1199255 https://bugzilla.suse.com/1199615 SUSE Bug 1199615 https://bugzilla.suse.com/1200084 SUSE Bug 1200084