SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2134-1)

high Nessus Plugin ID 139364
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 6.7

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-10135: Legacy pairing and secure-connections pairing authentication in Bluetooth may have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key (bnc#1171988).

CVE-2020-10711: A NULL pointer dereference flaw was found in the SELinux subsystem. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. This flaw allowed a remote network user to crash the system kernel, resulting in a denial of service (bnc#1171191).

CVE-2020-10751: A flaw was found in the SELinux LSM hook implementation, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing (bnc#1171189).

CVE-2019-20812: An issue was discovered in the prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067 (bnc#1172453).

CVE-2020-10732: A flaw was found in the implementation of userspace core dumps. This flaw allowed an attacker with a local account to crash a trivial program and exfiltrate private kernel data (bnc#1171220).

CVE-2020-0305: In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1174462).

CVE-2020-12771: btree_gc_coalesce in drivers/md/bcache/btree.c had a deadlock if a coalescing operation fails (bnc#1171732).

CVE-2020-10773: A kernel stack information leak on s390/s390x was fixed (bnc#1172999).

CVE-2020-14416: A race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c (bnc#1162002).

CVE-2020-10768: Indirect branch speculation could have been enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command. (bnc#1172783).

CVE-2020-10766: Fixed Rogue cross-process SSBD shutdown, where a Linux scheduler logical bug allows an attacker to turn off the SSBD protection. (bnc#1172781).

CVE-2020-10767: Indirect Branch Prediction Barrier was force-disabled when STIBP is unavailable or enhanced IBRS is available.
(bnc#1172782).

CVE-2020-13974: drivers/tty/vt/keyboard.c had an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059.
(bnc#1172775).

CVE-2019-20810: go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel did not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586 (bnc#1172458).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud 7 :

zypper in -t patch SUSE-OpenStack-Cloud-7-2020-2134=1

SUSE Linux Enterprise Server for SAP 12-SP2 :

zypper in -t patch SUSE-SLE-SAP-12-SP2-2020-2134=1

SUSE Linux Enterprise Server 12-SP2-LTSS :

zypper in -t patch SUSE-SLE-SERVER-12-SP2-2020-2134=1

SUSE Linux Enterprise Server 12-SP2-BCL :

zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2020-2134=1

SUSE Linux Enterprise High Availability 12-SP2 :

zypper in -t patch SUSE-SLE-HA-12-SP2-2020-2134=1

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1162002

https://bugzilla.suse.com/show_bug.cgi?id=1170383

https://bugzilla.suse.com/show_bug.cgi?id=1171189

https://bugzilla.suse.com/show_bug.cgi?id=1171191

https://bugzilla.suse.com/show_bug.cgi?id=1171220

https://bugzilla.suse.com/show_bug.cgi?id=1171732

https://bugzilla.suse.com/show_bug.cgi?id=1171988

https://bugzilla.suse.com/show_bug.cgi?id=1172049

https://bugzilla.suse.com/show_bug.cgi?id=1172453

https://bugzilla.suse.com/show_bug.cgi?id=1172458

https://bugzilla.suse.com/show_bug.cgi?id=1172775

https://bugzilla.suse.com/show_bug.cgi?id=1172781

https://bugzilla.suse.com/show_bug.cgi?id=1172782

https://bugzilla.suse.com/show_bug.cgi?id=1172783

https://bugzilla.suse.com/show_bug.cgi?id=1172999

https://bugzilla.suse.com/show_bug.cgi?id=1174115

https://bugzilla.suse.com/show_bug.cgi?id=1174462

https://bugzilla.suse.com/show_bug.cgi?id=1174543

https://www.suse.com/security/cve/CVE-2019-20810/

https://www.suse.com/security/cve/CVE-2019-20812/

https://www.suse.com/security/cve/CVE-2020-0305/

https://www.suse.com/security/cve/CVE-2020-10135/

https://www.suse.com/security/cve/CVE-2020-10711/

https://www.suse.com/security/cve/CVE-2020-10732/

https://www.suse.com/security/cve/CVE-2020-10751/

https://www.suse.com/security/cve/CVE-2020-10766/

https://www.suse.com/security/cve/CVE-2020-10767/

https://www.suse.com/security/cve/CVE-2020-10768/

https://www.suse.com/security/cve/CVE-2020-10773/

https://www.suse.com/security/cve/CVE-2020-12771/

https://www.suse.com/security/cve/CVE-2020-13974/

https://www.suse.com/security/cve/CVE-2020-14416/

http://www.nessus.org/u?a3821185

Plugin Details

Severity: High

ID: 139364

File Name: suse_SU-2020-2134-1.nasl

Version: 1.5

Type: local

Agent: unix

Published: 8/6/2020

Updated: 1/13/2021

Dependencies: ssh_get_info.nasl

Risk Information

Risk Factor: High

VPR Score: 6.7

CVSS Score Source: CVE-2020-13974

CVSS v2.0

Base Score: 7.2

Temporal Score: 5.6

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debuginfo, p-cpe:/a:novell:suse_linux:kernel-default-debugsource, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kgraft-patch-4_4_121-92_138-default, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/5/2020

Vulnerability Publication Date: 5/9/2020

Reference Information

CVE: CVE-2019-20810, CVE-2019-20812, CVE-2020-0305, CVE-2020-10135, CVE-2020-10711, CVE-2020-10732, CVE-2020-10751, CVE-2020-10766, CVE-2020-10767, CVE-2020-10768, CVE-2020-10773, CVE-2020-12771, CVE-2020-13974, CVE-2020-14416