🛡️ SUSE-SU-2021:3807-1 — kernel-azure (CVE-2021-0941 +5 more)

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0. (kernel.unprivileged_bpf_disabled = 0)

• CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).
• CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).
• CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)
• CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails (bsc#1191961).
• CVE-2021-43389: There was an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).
• CVE-2021-37159: hso_free_net_device in drivers/net/usb/hso.c called unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free (bnc#1188601).

The following non-security bugs were fixed:

• ABI: sysfs-kernel-slab: Document some stats (git-fixes).
• ALSA: hda: Reduce udelay() at SKL+ position reporting (git-fixes).
• ALSA: ua101: fix division by zero at probe (git-fixes).
• ALSA: usb-audio: Add Audient iD14 to mixer map quirk table (git-fixes).
• ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table (git-fixes).
• ASoC: cs42l42: Correct some register default values (git-fixes).
• ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER (git-fixes).
• ASoC: cs42l42: Do not set defaults for volatile registers (git-fixes).
• ASoC: dt-bindings: cs42l42: Correct description of ts-inv (git-fixes).
• ASoC: mediatek: mt8195: Remove unsued irqs_lock (git-fixes).
• ASoC: rockchip: Use generic dmaengine code (git-fixes).
• Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync (git-fixes).
• Bluetooth: fix init and cleanup of sco_conn.timeout_work (git-fixes).
• EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell (bsc#1152489).
• Eradicate Patch-mainline: No The pre-commit check can reject this deprecated tag then.
• Fix problem with missing installkernel on Tumbleweed.
• HID: u2fzero: clarify error check and length calculations (git-fixes).
• HID: u2fzero: properly handle timeouts in usb_submit_urb (git-fixes).
• Input: elantench - fix misreporting trackpoint coordinates (bsc#1192918).
• Input: i8042 - Add quirk for Fujitsu Lifebook T725 (bsc#1191980).
• PCI/ACPI: Check for _OSC support in acpi_pci_osc_control_set() (bsc#1169263).
• PCI/ACPI: Clarify message about _OSC failure (bsc#1169263).
• PCI/ACPI: Move _OSC query checks to separate function (bsc#1169263).
• PCI/ACPI: Move supported and control calculations to separate functions (bsc#1169263).
• PCI/ACPI: Remove OSC_PCI_SUPPORT_MASKS and OSC_PCI_CONTROL_MASKS (bsc#1169263).
• PCI/ACPI: Remove unnecessary osc_lock (bsc#1169263).
• PCI: aardvark: Do not clear status bits of masked interrupts (git-fixes).
• PCI: aardvark: Do not spam about PIO Response Status (git-fixes).
• PCI: aardvark: Do not unmask unused interrupts (git-fixes).
• PCI: aardvark: Fix checking for link up via LTSSM state (git-fixes).
• PCI: aardvark: Fix reporting Data Link Layer Link Active (git-fixes).
• PCI: aardvark: Fix return value of MSI domain .alloc() method (git-fixes).
• PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG (git-fixes).
• PCI: pci-bridge-emul: Fix emulation of W1C bits (git-fixes).
• PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation (git-fixes).
• Revert 'ibmvnic: check failover_pending in login response' (bsc#1190523 ltc#194510).
• Revert 'platform/x86: i2c-multi-instantiate: Do not create platform device for INT3515 ACPI nodes' (git-fixes).
• Revert 'r8152: adjust the settings about MAC clock speed down for RTL8153' (git-fixes).
• Revert 'scsi: ufs: fix a missing check of devm_reset_control_get' (git-fixes).
• Revert 'x86/kvm: fix vcpu-id indexed array sizes' (git-fixes).
• USB: iowarrior: fix control-message timeouts (git-fixes).
• USB: serial: keyspan: fix memleak on probe errors (git-fixes).
• Update config files: Add CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
• Update patches.suse/NFS-Do-uncached-readdir-when-we-re-seeking-a-cooki