SUSE-SU-2022:3693-1: important: Security update for the Linux Kernel

22 Oct 2022

      SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:3693-1
Rating:             important
References:         #1199564 #1200288 #1201309 #1202677 #1202960 
                    #1203552 #1203769 #1203987 PED-529 
Cross-References:   CVE-2022-20008 CVE-2022-2503 CVE-2022-32296
                    CVE-2022-3239 CVE-2022-3303 CVE-2022-41218
                    CVE-2022-41848
CVSS scores:
                    CVE-2022-20008 (NVD) : 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
                    CVE-2022-20008 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
                    CVE-2022-2503 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-2503 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-32296 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
                    CVE-2022-32296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
                    CVE-2022-3239 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-3239 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-3303 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-3303 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-41218 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-41218 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-41848 (NVD) : 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-41848 (SUSE): 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:
                    SUSE CaaS Platform 4.0
                    SUSE Enterprise Storage 6
                    SUSE Linux Enterprise High Availability 15-SP1
                    SUSE Linux Enterprise High Performance Computing 15-SP1
                    SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS
                    SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
                    SUSE Linux Enterprise Module for Live Patching 15-SP1
                    SUSE Linux Enterprise Server 15-SP1
                    SUSE Linux Enterprise Server 15-SP1-BCL
                    SUSE Linux Enterprise Server 15-SP1-LTSS
                    SUSE Linux Enterprise Server for SAP 15-SP1
                    SUSE Linux Enterprise Server for SAP Applications 15-SP1
                    SUSE Linux Enterprise Storage 6
                    SUSE Manager Proxy 4.0
                    SUSE Manager Retail Branch Server 4.0
                    SUSE Manager Server 4.0
                    openSUSE Leap 15.3
                    openSUSE Leap 15.4
______________________________________________________________________________

   An update that solves 7 vulnerabilities, contains one
   feature and has one errata is now available.

Description:

   The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various
   security and bugfixes.

   The following security bugs were fixed:

   - CVE-2022-20008: Fixed local information disclosure due to possibility to
     read kernel heap memory via mmc_blk_read_single of block.c (bnc#1199564).
   - CVE-2022-2503: Fixed a vulnerability that allowed root to bypass LoadPin
     and load untrusted and unverified kernel modules and firmware
     (bnc#1202677).
   - CVE-2022-32296: Fixed vulnerability where TCP servers were allowed to
     identify clients by observing what source ports are used (bnc#1200288).
   - CVE-2022-3239: Fixed an use-after-free in the video4linux driver that
     could lead a local user to able to crash the system or escalate their
     privileges (bnc#1203552).
   - CVE-2022-3303: Fixed a race condition in the sound subsystem due to
     improper locking (bnc#1203769).
   - CVE-2022-41218: Fixed an use-after-free caused by refcount races in
     drivers/media/dvb-core/dmxdev.c (bnc#1202960).
   - CVE-2022-41848: Fixed a race condition in
     drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and mgslpc_detach
     (bnc#1203987).

   The following non-security bugs were fixed:

   - dtb: Do not include sources in src.rpm - refer to kernel-source Same as
     other kernel binary packages there is no need to carry duplicate sources
     in dtb packages.
   - mkspec: eliminate @NOSOURCE@ macro This should be alsways used with
     @SOURCES@, just include the content there.
   - net: mana: Add rmb after checking owner bits (git-fixes).
   - net: mana: Add the Linux MANA PF driver (bnc#1201309, jsc#PED-529).
   - x86/bugs: Reenable retbleed=off While for older kernels the return
     thunks are statically built in and cannot be dynamically patched out,
     retbleed=off should still be possible to do so that the mitigation can
     still be disabled on Intel who do not use the return thunks but IBRS.

Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.4:

      zypper in -t patch openSUSE-SLE-15.4-2022-3693=1

   - openSUSE Leap 15.3:

      zypper in -t patch openSUSE-SLE-15.3-2022-3693=1

   - SUSE Linux Enterprise Server for SAP 15-SP1:

      zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3693=1

   - SUSE Linux Enterprise Server 15-SP1-LTSS:

      zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3693=1

   - SUSE Linux Enterprise Server 15-SP1-BCL:

      zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3693=1

   - SUSE Linux Enterprise Module for Live Patching 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2022-3693=1

      Please note that this is the initial kernel livepatch without fixes
      itself, this livepatch package is later updated by seperate standalone
      livepatch updates.

   - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3693=1

   - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3693=1

   - SUSE Linux Enterprise High Availability 15-SP1:

      zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-3693=1

   - SUSE Enterprise Storage 6:

      zypper in -t patch SUSE-Storage-6-2022-3693=1

   - SUSE CaaS Platform 4.0:

      To install this update, use the SUSE CaaS Platform 'skuba' tool. It
      will inform you if it detects new updates and let you then trigger
      updating of the complete cluster in a controlled way.

Package List:

   - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):

      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-vanilla-4.12.14-150100.197.126.1
      kernel-vanilla-base-4.12.14-150100.197.126.1
      kernel-vanilla-base-debuginfo-4.12.14-150100.197.126.1
      kernel-vanilla-debuginfo-4.12.14-150100.197.126.1
      kernel-vanilla-debugsource-4.12.14-150100.197.126.1
      kernel-vanilla-devel-4.12.14-150100.197.126.1
      kernel-vanilla-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-vanilla-livepatch-devel-4.12.14-150100.197.126.1

   - openSUSE Leap 15.4 (ppc64le x86_64):

      kernel-debug-base-4.12.14-150100.197.126.1
      kernel-debug-base-debuginfo-4.12.14-150100.197.126.1

   - openSUSE Leap 15.4 (x86_64):

      kernel-kvmsmall-base-4.12.14-150100.197.126.1
      kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.126.1

   - openSUSE Leap 15.4 (s390x):

      kernel-default-man-4.12.14-150100.197.126.1
      kernel-zfcpdump-man-4.12.14-150100.197.126.1

   - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):

      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-vanilla-4.12.14-150100.197.126.1
      kernel-vanilla-base-4.12.14-150100.197.126.1
      kernel-vanilla-base-debuginfo-4.12.14-150100.197.126.1
      kernel-vanilla-debuginfo-4.12.14-150100.197.126.1
      kernel-vanilla-debugsource-4.12.14-150100.197.126.1
      kernel-vanilla-devel-4.12.14-150100.197.126.1
      kernel-vanilla-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-vanilla-livepatch-devel-4.12.14-150100.197.126.1

   - openSUSE Leap 15.3 (ppc64le x86_64):

      kernel-debug-base-4.12.14-150100.197.126.1
      kernel-debug-base-debuginfo-4.12.14-150100.197.126.1

   - openSUSE Leap 15.3 (x86_64):

      kernel-kvmsmall-base-4.12.14-150100.197.126.1
      kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.126.1

   - openSUSE Leap 15.3 (s390x):

      kernel-default-man-4.12.14-150100.197.126.1
      kernel-zfcpdump-man-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64):

      kernel-default-4.12.14-150100.197.126.1
      kernel-default-base-4.12.14-150100.197.126.1
      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      kernel-default-devel-4.12.14-150100.197.126.1
      kernel-default-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-obs-build-4.12.14-150100.197.126.1
      kernel-obs-build-debugsource-4.12.14-150100.197.126.1
      kernel-syms-4.12.14-150100.197.126.1
      reiserfs-kmp-default-4.12.14-150100.197.126.1
      reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch):

      kernel-devel-4.12.14-150100.197.126.1
      kernel-docs-4.12.14-150100.197.126.1
      kernel-macros-4.12.14-150100.197.126.1
      kernel-source-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64):

      kernel-default-4.12.14-150100.197.126.1
      kernel-default-base-4.12.14-150100.197.126.1
      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      kernel-default-devel-4.12.14-150100.197.126.1
      kernel-default-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-obs-build-4.12.14-150100.197.126.1
      kernel-obs-build-debugsource-4.12.14-150100.197.126.1
      kernel-syms-4.12.14-150100.197.126.1
      reiserfs-kmp-default-4.12.14-150100.197.126.1
      reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch):

      kernel-devel-4.12.14-150100.197.126.1
      kernel-docs-4.12.14-150100.197.126.1
      kernel-macros-4.12.14-150100.197.126.1
      kernel-source-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise Server 15-SP1-LTSS (s390x):

      kernel-default-man-4.12.14-150100.197.126.1
      kernel-zfcpdump-debuginfo-4.12.14-150100.197.126.1
      kernel-zfcpdump-debugsource-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64):

      kernel-default-4.12.14-150100.197.126.1
      kernel-default-base-4.12.14-150100.197.126.1
      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      kernel-default-devel-4.12.14-150100.197.126.1
      kernel-default-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-obs-build-4.12.14-150100.197.126.1
      kernel-obs-build-debugsource-4.12.14-150100.197.126.1
      kernel-syms-4.12.14-150100.197.126.1
      reiserfs-kmp-default-4.12.14-150100.197.126.1
      reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise Server 15-SP1-BCL (noarch):

      kernel-devel-4.12.14-150100.197.126.1
      kernel-docs-4.12.14-150100.197.126.1
      kernel-macros-4.12.14-150100.197.126.1
      kernel-source-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64):

      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      kernel-default-livepatch-4.12.14-150100.197.126.1
      kernel-default-livepatch-devel-4.12.14-150100.197.126.1
      kernel-livepatch-4_12_14-150100_197_126-default-1-150100.3.3.1

   - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64):

      kernel-default-4.12.14-150100.197.126.1
      kernel-default-base-4.12.14-150100.197.126.1
      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      kernel-default-devel-4.12.14-150100.197.126.1
      kernel-default-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-obs-build-4.12.14-150100.197.126.1
      kernel-obs-build-debugsource-4.12.14-150100.197.126.1
      kernel-syms-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch):

      kernel-devel-4.12.14-150100.197.126.1
      kernel-docs-4.12.14-150100.197.126.1
      kernel-macros-4.12.14-150100.197.126.1
      kernel-source-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64):

      kernel-default-4.12.14-150100.197.126.1
      kernel-default-base-4.12.14-150100.197.126.1
      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      kernel-default-devel-4.12.14-150100.197.126.1
      kernel-default-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-obs-build-4.12.14-150100.197.126.1
      kernel-obs-build-debugsource-4.12.14-150100.197.126.1
      kernel-syms-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch):

      kernel-devel-4.12.14-150100.197.126.1
      kernel-docs-4.12.14-150100.197.126.1
      kernel-macros-4.12.14-150100.197.126.1
      kernel-source-4.12.14-150100.197.126.1

   - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64):

      cluster-md-kmp-default-4.12.14-150100.197.126.1
      cluster-md-kmp-default-debuginfo-4.12.14-150100.197.126.1
      dlm-kmp-default-4.12.14-150100.197.126.1
      dlm-kmp-default-debuginfo-4.12.14-150100.197.126.1
      gfs2-kmp-default-4.12.14-150100.197.126.1
      gfs2-kmp-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      ocfs2-kmp-default-4.12.14-150100.197.126.1
      ocfs2-kmp-default-debuginfo-4.12.14-150100.197.126.1

   - SUSE Enterprise Storage 6 (aarch64 x86_64):

      kernel-default-4.12.14-150100.197.126.1
      kernel-default-base-4.12.14-150100.197.126.1
      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      kernel-default-devel-4.12.14-150100.197.126.1
      kernel-default-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-obs-build-4.12.14-150100.197.126.1
      kernel-obs-build-debugsource-4.12.14-150100.197.126.1
      kernel-syms-4.12.14-150100.197.126.1
      reiserfs-kmp-default-4.12.14-150100.197.126.1
      reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1

   - SUSE Enterprise Storage 6 (noarch):

      kernel-devel-4.12.14-150100.197.126.1
      kernel-docs-4.12.14-150100.197.126.1
      kernel-macros-4.12.14-150100.197.126.1
      kernel-source-4.12.14-150100.197.126.1

   - SUSE CaaS Platform 4.0 (noarch):

      kernel-devel-4.12.14-150100.197.126.1
      kernel-docs-4.12.14-150100.197.126.1
      kernel-macros-4.12.14-150100.197.126.1
      kernel-source-4.12.14-150100.197.126.1

   - SUSE CaaS Platform 4.0 (x86_64):

      kernel-default-4.12.14-150100.197.126.1
      kernel-default-base-4.12.14-150100.197.126.1
      kernel-default-base-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debuginfo-4.12.14-150100.197.126.1
      kernel-default-debugsource-4.12.14-150100.197.126.1
      kernel-default-devel-4.12.14-150100.197.126.1
      kernel-default-devel-debuginfo-4.12.14-150100.197.126.1
      kernel-obs-build-4.12.14-150100.197.126.1
      kernel-obs-build-debugsource-4.12.14-150100.197.126.1
      kernel-syms-4.12.14-150100.197.126.1
      reiserfs-kmp-default-4.12.14-150100.197.126.1
      reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1

References:

   https://www.suse.com/security/cve/CVE-2022-20008.html
   https://www.suse.com/security/cve/CVE-2022-2503.html
   https://www.suse.com/security/cve/CVE-2022-32296.html
   https://www.suse.com/security/cve/CVE-2022-3239.html
   https://www.suse.com/security/cve/CVE-2022-3303.html
   https://www.suse.com/security/cve/CVE-2022-41218.html
   https://www.suse.com/security/cve/CVE-2022-41848.html
   https://bugzilla.suse.com/1199564
   https://bugzilla.suse.com/1200288
   https://bugzilla.suse.com/1201309
   https://bugzilla.suse.com/1202677
   https://bugzilla.suse.com/1202960
   https://bugzilla.suse.com/1203552
   https://bugzilla.suse.com/1203769
   https://bugzilla.suse.com/1203987

opensuse-security＠opensuse.org

tags

participants (1)