SUSE SLES12 Security Update : kernel (SUSE-SU-2021:3972-1)

high Nessus Plugin ID 155959

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3972-1 advisory.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

- Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have happened in the past (jsc#SLE-22573)

You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0.
(kernel.unprivileged_bpf_disabled = 0)


The following security bugs were fixed:

- CVE-2021-0941: In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192045).
- CVE-2021-31916: An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm- ioctl.c in the Multi-device driver module in the Linux kernel A bound check failure allowed an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability (bnc#1192781).
- CVE-2021-20322: Make the ipv4 and ipv6 ICMP exception caches less predictive to avoid information leaks about UDP ports in use. (bsc#1191790)
- CVE-2021-34981: Fixed file refcounting in cmtp when cmtp_attach_device fails. (bsc#1191961)
- CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the kernel to read uninitialized memory (bsc#1188563).
- CVE-2021-3715: Fixed a use-after-free in route4_change() in net/sched/cls_route.c (bsc#1190349).
- CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
- CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv- avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bsc#1184673).
- CVE-2021-3542: Fixed heap buffer overflow in firedtv driver (bsc#1186063).
- CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute privileges (bnc#1190479).
- CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
- CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead to root access (bsc#1191315).
- CVE-2021-37159: Fixed use-after-free and a double free inside hso_free_net_device in drivers/net/usb/hso.c when unregister_netdev is called without checking for the NETREG_REGISTERED state (bnc#1188601).
- CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
- CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module.
(bsc#1190023)
- CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
- CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
- CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
- CVE-2021-3772: Fixed a remote denial of service in the SCTP stack, if the attacker can spoof IP addresses and knows the IP-addresses and port numbers being used (bnc#1190351).
- CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect (bsc#1108488).
- CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace applications (bnc#1129898).
- CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx() (bnc#1133374).
- CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth stack (bsc#1188172).
- CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable AVIC support for the L2 guest. (bsc#1189399).
- CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400).
- CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057).
- CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
- CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
- CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks (bsc#1190115).
- CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
- CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault (bnc#1189262).
- CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations (bnc#1189291).
- CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program that could have obtain sensitive information from kernel memory (bsc#1188983).
- CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of arbitrary kernel memory (bsc#1188985).
- CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
- CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c (bsc#1188876).
- CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (bsc#1186482).
- CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS memory corruption via rtas_args.nargs (bsc#1188838).
- CVE-2020-0429: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. (bsc#1176724).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1087082

https://bugzilla.suse.com/1100416

https://bugzilla.suse.com/1108488

https://bugzilla.suse.com/1129735

https://bugzilla.suse.com/1129898

https://bugzilla.suse.com/1133374

https://bugzilla.suse.com/1153720

https://bugzilla.suse.com/1171420

https://bugzilla.suse.com/1176724

https://bugzilla.suse.com/1176931

https://bugzilla.suse.com/1180624

https://bugzilla.suse.com/1181854

https://bugzilla.suse.com/1181855

https://bugzilla.suse.com/1183050

https://bugzilla.suse.com/1183861

https://bugzilla.suse.com/1184673

https://bugzilla.suse.com/1184804

https://bugzilla.suse.com/1185377

https://bugzilla.suse.com/1185677

https://bugzilla.suse.com/1185726

https://bugzilla.suse.com/1185727

https://bugzilla.suse.com/1185758

https://bugzilla.suse.com/1185973

https://bugzilla.suse.com/1186063

https://bugzilla.suse.com/1186482

https://bugzilla.suse.com/1186483

https://bugzilla.suse.com/1186672

https://bugzilla.suse.com/1188026

https://bugzilla.suse.com/1188172

https://bugzilla.suse.com/1188563

https://bugzilla.suse.com/1188601

https://bugzilla.suse.com/1188613

https://bugzilla.suse.com/1188838

https://bugzilla.suse.com/1188842

https://bugzilla.suse.com/1188876

https://bugzilla.suse.com/1188983

https://bugzilla.suse.com/1188985

https://bugzilla.suse.com/1189057

https://bugzilla.suse.com/1189262

https://bugzilla.suse.com/1189278

https://bugzilla.suse.com/1189291

https://bugzilla.suse.com/1189399

https://bugzilla.suse.com/1189400

https://bugzilla.suse.com/1189418

https://bugzilla.suse.com/1189420

https://bugzilla.suse.com/1189706

https://bugzilla.suse.com/1189846

https://bugzilla.suse.com/1189884

https://bugzilla.suse.com/1190023

https://bugzilla.suse.com/1190025

https://bugzilla.suse.com/1190067

https://bugzilla.suse.com/1190115

https://bugzilla.suse.com/1190117

https://bugzilla.suse.com/1190118

https://bugzilla.suse.com/1190159

https://bugzilla.suse.com/1190276

https://bugzilla.suse.com/1190349

https://bugzilla.suse.com/1190350

https://bugzilla.suse.com/1190351

https://bugzilla.suse.com/1190432

https://bugzilla.suse.com/1190479

https://bugzilla.suse.com/1190534

https://bugzilla.suse.com/1190601

https://bugzilla.suse.com/1190717

https://bugzilla.suse.com/1191193

https://bugzilla.suse.com/1191315

https://bugzilla.suse.com/1191317

https://bugzilla.suse.com/1191318

https://bugzilla.suse.com/1191529

https://bugzilla.suse.com/1191530

https://bugzilla.suse.com/1191628

https://bugzilla.suse.com/1191660

https://bugzilla.suse.com/1191790

https://bugzilla.suse.com/1191801

https://bugzilla.suse.com/1191813

https://bugzilla.suse.com/1191961

https://bugzilla.suse.com/1192036

https://bugzilla.suse.com/1192045

https://bugzilla.suse.com/1192048

https://bugzilla.suse.com/1192267

https://bugzilla.suse.com/1192379

https://bugzilla.suse.com/1192400

https://bugzilla.suse.com/1192444

https://bugzilla.suse.com/1192549

https://bugzilla.suse.com/1192775

https://bugzilla.suse.com/1192781

https://bugzilla.suse.com/1192802

http://www.nessus.org/u?6d4473a3

https://www.suse.com/security/cve/CVE-2018-9517

https://www.suse.com/security/cve/CVE-2018-13405

https://www.suse.com/security/cve/CVE-2019-3874

https://www.suse.com/security/cve/CVE-2019-3900

https://www.suse.com/security/cve/CVE-2020-0429

https://www.suse.com/security/cve/CVE-2020-3702

https://www.suse.com/security/cve/CVE-2020-12770

https://www.suse.com/security/cve/CVE-2021-0941

https://www.suse.com/security/cve/CVE-2021-3640

https://www.suse.com/security/cve/CVE-2021-3653

https://www.suse.com/security/cve/CVE-2021-3655

https://www.suse.com/security/cve/CVE-2021-3656

https://www.suse.com/security/cve/CVE-2021-3659

https://www.suse.com/security/cve/CVE-2021-3679

https://www.suse.com/security/cve/CVE-2021-3715

https://www.suse.com/security/cve/CVE-2021-3732

https://www.suse.com/security/cve/CVE-2021-3744

https://www.suse.com/security/cve/CVE-2021-3752

https://www.suse.com/security/cve/CVE-2021-3753

https://www.suse.com/security/cve/CVE-2021-3759

https://www.suse.com/security/cve/CVE-2021-3760

https://www.suse.com/security/cve/CVE-2021-3764

https://www.suse.com/security/cve/CVE-2021-3772

https://www.suse.com/security/cve/CVE-2021-20322

https://www.suse.com/security/cve/CVE-2021-22543

https://www.suse.com/security/cve/CVE-2021-31916

https://www.suse.com/security/cve/CVE-2021-34556

https://www.suse.com/security/cve/CVE-2021-34981

https://www.suse.com/security/cve/CVE-2021-35477

https://www.suse.com/security/cve/CVE-2021-37159

https://www.suse.com/security/cve/CVE-2021-37576

https://www.suse.com/security/cve/CVE-2021-38160

https://www.suse.com/security/cve/CVE-2021-38198

https://www.suse.com/security/cve/CVE-2021-38204

https://www.suse.com/security/cve/CVE-2021-40490

https://www.suse.com/security/cve/CVE-2021-41864

https://www.suse.com/security/cve/CVE-2021-42008

https://www.suse.com/security/cve/CVE-2021-42252

https://www.suse.com/security/cve/CVE-2021-42739

Plugin Details

Severity: High

ID: 155959

File Name: suse_SU-2021-3972-1.nasl

Version: 1.9

Type: local

Agent: unix

Published: 12/9/2021

Updated: 9/24/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.9

Temporal Score: 6.2

Vector: CVSS2#AV:A/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-3752

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2021-3656

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 7.2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

CVSS Score Source: CVE-2021-22543

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:dlm-kmp-default, p-cpe:/a:novell:suse_linux:cluster-md-kmp-default, p-cpe:/a:novell:suse_linux:kernel-syms, p-cpe:/a:novell:suse_linux:kernel-default-man, p-cpe:/a:novell:suse_linux:ocfs2-kmp-default, p-cpe:/a:novell:suse_linux:kernel-source, p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-macros, p-cpe:/a:novell:suse_linux:kernel-default-kgraft-devel, p-cpe:/a:novell:suse_linux:kgraft-patch-4_12_14-95_83-default, p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-devel, p-cpe:/a:novell:suse_linux:kernel-default-kgraft, cpe:/o:novell:suse_linux:12, p-cpe:/a:novell:suse_linux:gfs2-kmp-default

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/8/2021

Vulnerability Publication Date: 7/6/2018

Reference Information

CVE: CVE-2018-13405, CVE-2018-9517, CVE-2019-3874, CVE-2019-3900, CVE-2020-0429, CVE-2020-12770, CVE-2020-3702, CVE-2021-0941, CVE-2021-20322, CVE-2021-22543, CVE-2021-31916, CVE-2021-34556, CVE-2021-34981, CVE-2021-35477, CVE-2021-3640, CVE-2021-3653, CVE-2021-3655, CVE-2021-3656, CVE-2021-3659, CVE-2021-3679, CVE-2021-3715, CVE-2021-37159, CVE-2021-3732, CVE-2021-3744, CVE-2021-3752, CVE-2021-3753, CVE-2021-37576, CVE-2021-3759, CVE-2021-3760, CVE-2021-3764, CVE-2021-3772, CVE-2021-38160, CVE-2021-38198, CVE-2021-38204, CVE-2021-40490, CVE-2021-41864, CVE-2021-42008, CVE-2021-42252, CVE-2021-42739

SuSE: SUSE-SU-2021:3972-1