Security update for the Linux Kernel (Live Patch 41 for SLE 12 SP3) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1012-1 Final 1 1 2022-03-29T10:29:04Z current 2022-03-29T10:29:04Z 2022-03-29T10:29:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 41 for SLE 12 SP3) This update for the Linux Kernel 4.4.180-94_150 fixes several issues. The following security issues were fixed: - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516). - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1012,SUSE-SLE-Live-Patching-12-SP4-2022-1004,SUSE-SLE-Live-Patching-12-SP4-2022-1005,SUSE-SLE-Live-Patching-12-SP4-2022-1006,SUSE-SLE-Live-Patching-12-SP4-2022-1007,SUSE-SLE-Live-Patching-12-SP5-2022-1009,SUSE-SLE-Live-Patching-12-SP5-2022-963,SUSE-SLE-Live-Patching-12-SP5-2022-964,SUSE-SLE-Live-Patching-12-SP5-2022-965,SUSE-SLE-Live-Patching-12-SP5-2022-966,SUSE-SLE-Live-Patching-12-SP5-2022-967,SUSE-SLE-Live-Patching-12-SP5-2022-968,SUSE-SLE-Live-Patching-12-SP5-2022-969,SUSE-SLE-Live-Patching-12-SP5-2022-970,SUSE-SLE-Live-Patching-12-SP5-2022-971,SUSE-SLE-Live-Patching-12-SP5-2022-972,SUSE-SLE-Module-Live-Patching-15-2022-974,SUSE-SLE-Module-Live-Patching-15-2022-975,SUSE-SLE-Module-Live-Patching-15-2022-997,SUSE-SLE-Module-Live-Patching-15-SP1-2022-1010,SUSE-SLE-Module-Live-Patching-15-SP1-2022-1011,SUSE-SLE-Module-Live-Patching-15-SP1-2022-1012,SUSE-SLE-Module-Live-Patching-15-SP1-2022-1013,SUSE-SLE-Module-Live-Patching-15-SP2-2022-1022,SUSE-SLE-Module-Live-Patching-15-SP2-2022-1030,SUSE-SLE-Module-Live-Patching-15-SP2-2022-988,SUSE-SLE-Module-Live-Patching-15-SP2-2022-989,SUSE-SLE-SAP-12-SP3-2022-1000,SUSE-SLE-SAP-12-SP3-2022-1001,SUSE-SLE-SAP-12-SP3-2022-1002,SUSE-SLE-SERVER-12-SP3-2022-1000,SUSE-SLE-SERVER-12-SP3-2022-1001,SUSE-SLE-SERVER-12-SP3-2022-1002 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221012-1/ Link for SUSE-SU-2022:1012-1 https://lists.suse.com/pipermail/sle-security-updates/2022-March/010561.html E-Mail link for SUSE-SU-2022:1012-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1195908 SUSE Bug 1195908 https://bugzilla.suse.com/1195949 SUSE Bug 1195949 https://www.suse.com/security/cve/CVE-2022-0487/ SUSE CVE CVE-2022-0487 page https://www.suse.com/security/cve/CVE-2022-0492/ SUSE CVE CVE-2022-0492 page SUSE Linux Enterprise Live Patching 12 SP4 SUSE Linux Enterprise Live Patching 12 SP5 SUSE Linux Enterprise Live Patching 15 SUSE Linux Enterprise Live Patching 15 SP1 SUSE Linux Enterprise Live Patching 15 SP2 SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP3 kernel-livepatch-4_12_14-197_99-default-10-150100.2.1 kgraft-patch-4_12_14-95_74-default-13-2.1 kgraft-patch-4_12_14-95_77-default-12-2.1 kgraft-patch-4_12_14-95_80-default-10-2.1 kgraft-patch-4_12_14-95_83-default-5-2.1 kgraft-patch-4_12_14-122_74-default-11-2.1 kgraft-patch-4_12_14-122_80-default-10-2.1 kgraft-patch-4_12_14-122_71-default-13-2.1 kgraft-patch-4_12_14-122_66-default-14-2.1 kgraft-patch-4_12_14-122_77-default-11-2.1 kgraft-patch-4_12_14-122_83-default-9-2.1 kgraft-patch-4_12_14-122_88-default-7-2.1 kgraft-patch-4_12_14-122_91-default-7-2.1 kgraft-patch-4_12_14-122_98-default-5-2.1 kgraft-patch-4_12_14-122_103-default-5-2.1 kgraft-patch-4_12_14-122_106-default-3-2.1 kernel-livepatch-4_12_14-150_78-default-5-150000.2.1 kernel-livepatch-4_12_14-150_72-default-13-150000.2.1 kernel-livepatch-4_12_14-150_75-default-10-150000.2.1 kernel-livepatch-4_12_14-197_89-default-13-150100.2.1 kernel-livepatch-4_12_14-197_92-default-12-150100.2.1 kernel-livepatch-4_12_14-197_102-default-5-150100.2.1 kernel-livepatch-5_3_18-24_53_4-default-11-150200.2.1 kernel-livepatch-5_3_18-24_64-default-13-150200.2.1 kernel-livepatch-5_3_18-24_70-default-11-150200.2.1 kernel-livepatch-5_3_18-24_67-default-11-150200.2.1 kgraft-patch-4_4_180-94_144-default-13-2.1 kgraft-patch-4_4_180-94_147-default-10-2.1 kgraft-patch-4_4_180-94_150-default-6-2.1 kgraft-patch-4_12_14-95_74-default-13-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP4 kgraft-patch-4_12_14-95_77-default-12-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP4 kgraft-patch-4_12_14-95_80-default-10-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP4 kgraft-patch-4_12_14-95_83-default-5-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP4 kgraft-patch-4_12_14-122_74-default-11-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_80-default-10-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_71-default-13-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_66-default-14-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_77-default-11-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_83-default-9-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_88-default-7-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_91-default-7-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_98-default-5-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_103-default-5-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_106-default-3-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-livepatch-4_12_14-150_78-default-5-150000.2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-150_72-default-13-150000.2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-150_75-default-10-150000.2.1 as a component of SUSE Linux Enterprise Live Patching 15 kernel-livepatch-4_12_14-197_89-default-13-150100.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP1 kernel-livepatch-4_12_14-197_92-default-12-150100.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP1 kernel-livepatch-4_12_14-197_99-default-10-150100.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP1 kernel-livepatch-4_12_14-197_102-default-5-150100.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP1 kernel-livepatch-5_3_18-24_53_4-default-11-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_64-default-13-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_70-default-11-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_67-default-11-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kgraft-patch-4_4_180-94_144-default-13-2.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_147-default-10-2.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_150-default-6-2.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS kgraft-patch-4_4_180-94_144-default-13-2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_147-default-10-2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 kgraft-patch-4_4_180-94_150-default-6-2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1. CVE-2022-0487 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_74-default-13-2.1 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_77-default-12-2.1 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_80-default-10-2.1 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_83-default-5-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_103-default-5-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_106-default-3-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_66-default-14-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_71-default-13-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_74-default-11-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_77-default-11-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_80-default-10-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-9-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_88-default-7-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-7-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-5-2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_102-default-5-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_89-default-13-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_92-default-12-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_99-default-10-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_53_4-default-11-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_64-default-13-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_67-default-11-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_70-default-11-150200.2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_72-default-13-150000.2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_75-default-10-150000.2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_78-default-5-150000.2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_144-default-13-2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_147-default-10-2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_150-default-6-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_144-default-13-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_147-default-10-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_150-default-6-2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221012-1/ https://www.suse.com/security/cve/CVE-2022-0487.html CVE-2022-0487 https://bugzilla.suse.com/1194516 SUSE Bug 1194516 https://bugzilla.suse.com/1195949 SUSE Bug 1195949 https://bugzilla.suse.com/1198615 SUSE Bug 1198615 A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. CVE-2022-0492 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_74-default-13-2.1 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_77-default-12-2.1 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_80-default-10-2.1 SUSE Linux Enterprise Live Patching 12 SP4:kgraft-patch-4_12_14-95_83-default-5-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_103-default-5-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_106-default-3-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_66-default-14-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_71-default-13-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_74-default-11-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_77-default-11-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_80-default-10-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_83-default-9-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_88-default-7-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_91-default-7-2.1 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_98-default-5-2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_102-default-5-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_89-default-13-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_92-default-12-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP1:kernel-livepatch-4_12_14-197_99-default-10-150100.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_53_4-default-11-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_64-default-13-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_67-default-11-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_70-default-11-150200.2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_72-default-13-150000.2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_75-default-10-150000.2.1 SUSE Linux Enterprise Live Patching 15:kernel-livepatch-4_12_14-150_78-default-5-150000.2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_144-default-13-2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_147-default-10-2.1 SUSE Linux Enterprise Server 12 SP3-LTSS:kgraft-patch-4_4_180-94_150-default-6-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_144-default-13-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_147-default-10-2.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:kgraft-patch-4_4_180-94_150-default-6-2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221012-1/ https://www.suse.com/security/cve/CVE-2022-0492.html CVE-2022-0492 https://bugzilla.suse.com/1195543 SUSE Bug 1195543 https://bugzilla.suse.com/1195908 SUSE Bug 1195908 https://bugzilla.suse.com/1196612 SUSE Bug 1196612 https://bugzilla.suse.com/1196776 SUSE Bug 1196776 https://bugzilla.suse.com/1198615 SUSE Bug 1198615 https://bugzilla.suse.com/1199255 SUSE Bug 1199255 https://bugzilla.suse.com/1199615 SUSE Bug 1199615 https://bugzilla.suse.com/1200084 SUSE Bug 1200084