SUSE SLES12 Security Update : kernel (SUSE-SU-2021:3389-1)

high Nessus Plugin ID 154063

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3389-1 advisory.

- A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3752)

- u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 (CVE-2020-3702)

- A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption).
This vulnerability is similar with the older CVE-2019-18808. (CVE-2021-3744)

- A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13. (CVE-2021-40490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1050244

https://bugzilla.suse.com/1056653

https://bugzilla.suse.com/1056657

https://bugzilla.suse.com/1056787

https://bugzilla.suse.com/1065729

https://bugzilla.suse.com/1104745

https://bugzilla.suse.com/1109837

https://bugzilla.suse.com/1111981

https://bugzilla.suse.com/1114648

https://bugzilla.suse.com/1118661

https://bugzilla.suse.com/1129770

https://bugzilla.suse.com/1148868

https://bugzilla.suse.com/1158533

https://bugzilla.suse.com/1173746

https://bugzilla.suse.com/1176940

https://bugzilla.suse.com/1181193

https://bugzilla.suse.com/1184439

https://bugzilla.suse.com/1185677

https://bugzilla.suse.com/1185727

https://bugzilla.suse.com/1186785

https://bugzilla.suse.com/1189297

https://bugzilla.suse.com/1189407

https://bugzilla.suse.com/1189884

https://bugzilla.suse.com/1190023

https://bugzilla.suse.com/1190115

https://bugzilla.suse.com/1190159

https://bugzilla.suse.com/1190432

https://bugzilla.suse.com/1190523

https://bugzilla.suse.com/1190534

https://bugzilla.suse.com/1190543

https://bugzilla.suse.com/1190576

https://bugzilla.suse.com/1190601

https://bugzilla.suse.com/1190620

https://bugzilla.suse.com/1190626

https://bugzilla.suse.com/1190717

https://bugzilla.suse.com/1190914

https://bugzilla.suse.com/1191051

https://bugzilla.suse.com/1191136

https://bugzilla.suse.com/1191193

https://lists.suse.com/pipermail/sle-updates/2021-October/020461.html

https://www.suse.com/security/cve/CVE-2020-3702

https://www.suse.com/security/cve/CVE-2021-3744

https://www.suse.com/security/cve/CVE-2021-3752

https://www.suse.com/security/cve/CVE-2021-3764

https://www.suse.com/security/cve/CVE-2021-40490

Plugin Details

Severity: High

ID: 154063

File Name: suse_SU-2021-3389-1.nasl

Version: 1.6

Type: local

Agent: unix

Published: 10/13/2021

Updated: 3/14/2022

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.9

Temporal Score: 5.8

Vector: AV:A/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2021-3752

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-azure, p-cpe:/a:novell:suse_linux:kernel-azure-base, p-cpe:/a:novell:suse_linux:kernel-azure-devel, p-cpe:/a:novell:suse_linux:kernel-devel-azure, p-cpe:/a:novell:suse_linux:kernel-source-azure, p-cpe:/a:novell:suse_linux:kernel-syms-azure, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/12/2021

Vulnerability Publication Date: 9/8/2020

Reference Information

CVE: CVE-2020-3702, CVE-2021-3744, CVE-2021-3752, CVE-2021-3764, CVE-2021-40490

SuSE: SUSE-SU-2021:3389-1