SB20220201106 - SUSE update for the Linux Kernel (Live Patch 15 for SLE 15 SP2)
Published: February 1, 2022 Updated: June 28, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Cryptographic Issues (CVE-ID: CVE-2020-3702)
The vulnerability allows a remote attacker to gain access top sensitive information.
The vulnerability exists due to improper input validation in WIFI driver(Krook). A remote attacker can temporary disable WPA2 or the WPA/WPA2 mixed-mode encryption and intercept traffic in clear text.
2) Use-after-free (CVE-ID: CVE-2021-4154)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the cgroup1_parse_param() function in kernel/cgroup/cgroup-v1.c in Linux kernel's cgroup v1 parser. A local user can execute arbitrary code via the fsconfig syscall parameter leading to a container breakout.
3) Buffer overflow (CVE-ID: CVE-2021-42739)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary within the firewire subsystem in the Linux kernel in drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c files. A local privileged user can run a specially crafted program tat calls avc_ca_pmt() function to trigger memory corruption and execute arbitrary code with elevated privileges.
4) Integer overflow (CVE-ID: CVE-2022-0185)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer overflow in the legacy_parse_param() function in fs/fs_context.c in Linux kernel. A local user can tun a specially crafted program to trigger integer overflow and execute arbitrary code with root privileges.
Remediation
Install update from vendor's website.