SB2021042160 - SUSE update for the Linux Kernel
Published: April 21, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2020-25670)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the NFC LLCP protocol implementation. A local user can perform manipulation with an unknown input for the llcp_sock_bind() function to crash or escalate their privileges on the system.
2) Use-after-free (CVE-ID: CVE-2020-25671)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the NFC LLCP protocol implementation. A local user can trigger the llcp_sock_connect() function to crash or escalate their privileges on the system.
3) Memory leak (CVE-ID: CVE-2020-25672)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the NFC LLCP protocol implementation when triggering the llcp_sock_connect() function. A remote attacker can force the application to leak memory and perform denial of service attack.
4) Resource exhaustion (CVE-ID: CVE-2020-25673)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper control consumption of internal resources in non-blocking socket in llcp_sock_connect() function. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Infinite loop (CVE-ID: CVE-2020-36310)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in set_memory_region_test in arch/x86/kvm/svm/svm.c. A local user can consume all available system resources and cause denial of service conditions.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-36311)
The vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to an error in arch/x86/kvm/svm/sev.c in Linux kernel, which allows soft lockup by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions).
7) Memory leak (CVE-ID: CVE-2020-36312)
The vulnerability allows a local user to perform DoS attack on the target system.
The vulnerability exists in the KVM hypervisor of the Linux kernel. A local user can force the application to leak memory and perform denial of service attack.
8) Excessive Iteration (CVE-ID: CVE-2021-28950)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to excessive iteration in fs/fuse/fuse_i.h in the Linux kernel. A local user can run a specially crafted program to perform a denial of service attack.
9) Command Injection (CVE-ID: CVE-2021-29154)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect computation of branch displacements within the BPF JIT compilers in the Linux kernel in arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. A local user can inject and execute arbitrary commands with elevated privileges.
10) Memory leak (CVE-ID: CVE-2021-30002)
The vulnerability allows a local user to perform DoS attack on the target system.
The vulnerability exists due memory leak within the webcam support driver in video_usercopy() function in drivers/media/v4l2-core/v4l2-ioctl.c in Linux kernel. A local user can trigger leak memory and perform denial of service attack.
11) Use-after-free (CVE-ID: CVE-2021-3483)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the Nosy driver in the Linux kernel. A local user can trigger use-after-free and to escalate privileges on the system.
Remediation
Install update from vendor's website.