🛡️ SUSE-SU-2021:3388-1 — kernel-rt (CVE-2020-3702 +4 more)

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
• CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
• CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
• CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
• CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)

The following non-security bugs were fixed:

• be2net: Fix an error handling path in 'be_probe()' (git-fixes).
• bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
• bnxt_en: Add missing DMA memory barriers (git-fixes).
• bnxt_en: do not disable an already disabled PCI device (git-fixes).
• bnxt: disable napi before canceling DIM (bsc#1104745 ).
• btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
• clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
• clk: kirkwood: Fix a clocking boot regression (git-fixes).
• crypto: x86/aes-ni-xts - use direct calls to and 4-way stride (bsc#1114648).
• cxgb4: fix IRQ free race during driver unload (git-fixes).
• debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
• docs: Fix infiniband uverbs minor number (git-fixes).
• drm/gma500: Fix end of loop tests for list_for_each_entry (bsc#1129770) Backporting changes: * refresh
• drm/imx: ipuv3-plane: Remove two unnecessary export symbols (bsc#1129770) Backporting changes: * refreshed
• drm/mediatek: Add AAL output size configuration (bsc#1129770) Backporting changes: * adapted code to use writel() function
• drm/msm: Small msm_gem_purge() fix (bsc#1129770) Backporting changes: * context changes in msm_gem_purge() * remove test for non-existant msm_gem_is_locked()
• drm/msm/dsi: Fix some reference counted resource leaks (bsc#1129770)
• drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() (bsc#1186785).
• drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 (bsc#1129770) Backporting changes * context changes
• dt-bindings: pwm: stm32: Add #pwm-cells (git-fixes).
• e1000e: Do not take care about recovery NVM checksum (bsc#1158533).
• e1000e: Fix an error handling path in 'e1000_probe()' (git-fixes).
• e1000e: Fix the max snoop/no-snoop latency for 10M (git-fixes).
• EDAC/i10nm: Fix NVDIMM detection (bsc#1114648).
• fbmem: add margin check to fb_check_caps() (bsc#1129770) Backporting changes: * context chacnges in fb_set_var()
• Fix build warnings. Also align code location with later codestreams and improve bisectability.
• fm10k: Fix an error handling path in 'fm10k_probe()' (git-fixes).
• fs/select: avoid clang stack usage warning (git-fixes).
• fuse: truncate pagecache on atomic_o_trunc (bsc#1191051).
• gve: fix the wrong AdminQ buffer overflow check (bsc#1176940).
• hv_netvsc: Make netvsc/VF binding check both MAC and serial number (jsc#SLE-18779, bsc#1185727).
• hv: mana: adjust mana_select_queue to old API (jsc#SLE-18779, bsc#1185727).
• hv: mana: remove netdev_lockdep_set_classes usage (jsc#SLE-18779, bsc#1185727).
• i40e: Add additional info to PHY type error (git-fixes).
• i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
• i40e: Fix error handling in i40e_vsi_open (git-fixes).
• i40e: Fix log TC creation failure when max num of queues is exceeded (bsc#1109837 bsc#1111981).
• i40e: Fix logic of disabling queues (git-fixes).
• iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
• iavf: Set RSS LUT and key in reset handle path (git-fixes).
• ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510).
• ice: Prevent probing virtual functions (bsc#1118661 ).
• igb: Check if num of q_vectors is smaller than max before array access (git-fixes).
• igb: Fix an error handling path in 'igb_probe()' (git-fixes).
• igb: Fix use-after-free error during reset (git-fixes).
• ipc: remove memcg accounting for sops objects in do_semtimedop() (bsc#1190115).
• irqchip/gic-v2: Reset APRn registers at boot time (bsc#1189407).
• irqchip/gic-v3: Do not try to reset AP0Rn (bsc#1189407).
• irqchip/gic-v3: Reset APgRn registers at boot time (bsc#1189407).
• ixgbe: Fix an error handling path in 'ixgbe_probe()' (git-fixes).
• kdb: do a sanity check on the cpu in kdb_per_cpu() (git-fixes).
• KVM: x86: Use kernel's x86_phys_bits to handle reduced MAXPHYADDR (bsc#1114648).
• liquidio: Fix unintentional sign extension issue on left shift of u16 (git-fixes).
• mailbox: sti: quieten kernel-doc warnings (git-fixes).
• mlx4: Fix missing error