SB2022020219 - SUSE update for the Linux Kernel



SB2022020219 - SUSE update for the Linux Kernel

Published: February 2, 2022 Updated: August 21, 2024

Security Bulletin ID SB2022020219
Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2021-4083)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the Linux kernel's garbage collection for Unix domain socket file handlers. A local user can call close() and fget() simultaneously and can potentially trigger a race condition, which in turn leads to a use-after-free error and allows privilege escalation.


2) Information disclosure (CVE-ID: CVE-2021-4135)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to simulated networking device driver for the Linux kernel does not properly initialize memory in certain situations. A local user can gain unauthorized access to sensitive information (kernel memory).


3) Improper locking (CVE-ID: CVE-2021-4149)

The vulnerability allows a local user to perform a denial of service attack (DoS) on the target system.

The vulnerability exists in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. A local user can exploit this vulnerability to cause a deadlock, resulting in a denial of service condition.


4) Security restrictions bypass (CVE-ID: CVE-2021-4197)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to missing permissions checks within the cgroups (control groups) functionality of Linux Kernel when writing into a file descriptor. A local low privileged process can trick a higher privileged parent process into writing arbitrary data into files, which can result in denial of service or privileges escalation.


5) Use-after-free (CVE-ID: CVE-2021-4202)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the nci_request() function in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. A local user can cause a data race problem while the device is getting removed and escalate privileges on the system.


6) Use-after-free (CVE-ID: CVE-2021-44733)

The vulnerability allows a local user to elevate privileges on the system.

The vulnerability exists due to a use-after-free error in the drivers/tee/tee_shm.c file within the TEE subsystem in the Linux kernel. A local user can trigger a race condition in tee_shm_get_from_id during an attempt to free a shared memory object and execute arbitrary code with elevated privileges.


7) Information disclosure (CVE-ID: CVE-2021-45485)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error in the IPv6 implementation in the Linux kernel. A remote attacker can gain access to sensitive information.


8) Information disclosure (CVE-ID: CVE-2021-45486)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to incorrect implementation of the IPv4 protocol in the Linux kernel. A remote attacker can disclose internal state in some situations.


9) Integer overflow (CVE-ID: CVE-2022-0185)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow in the legacy_parse_param() function in fs/fs_context.c in Linux kernel. A local user can tun a specially crafted program to trigger integer overflow and execute arbitrary code with root privileges.



10) Type conversion (CVE-ID: CVE-2022-0322)

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a type conversion error in the sctp_make_strreset_req() function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel. A local user can perform a denial of service attack.


Remediation

Install update from vendor's website.