SUSE SLES15 Security Update : kernel (SUSE-SU-2022:0363-1)

high Nessus Plugin ID 157898

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0363-1 advisory.

- The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85. (CVE-2020-28097)

- A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)

- In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. This could lead to local information disclosure with System execution privileges needed.
User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
A-160822094References: Upstream kernel (CVE-2021-39648)

- In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed.
User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
A-194696049References: Upstream kernel (CVE-2021-39657)

- In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel (CVE-2021-39685)

- A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (CVE-2021-4159)

- A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object. (CVE-2021-44733)

- pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
(CVE-2021-45095)

- A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service. (CVE-2022-0286)

- A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330)

- A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network. (CVE-2022-0435)

- kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1154353

https://bugzilla.suse.com/1154488

https://bugzilla.suse.com/1160634

https://bugzilla.suse.com/1176447

https://bugzilla.suse.com/1177599

https://bugzilla.suse.com/1183405

https://bugzilla.suse.com/1185377

https://bugzilla.suse.com/1187428

https://bugzilla.suse.com/1187723

https://bugzilla.suse.com/1188605

https://bugzilla.suse.com/1191881

https://bugzilla.suse.com/1193096

https://bugzilla.suse.com/1193506

https://bugzilla.suse.com/1193767

https://bugzilla.suse.com/1193802

https://bugzilla.suse.com/1193861

https://bugzilla.suse.com/1193864

https://bugzilla.suse.com/1193867

https://bugzilla.suse.com/1194048

https://bugzilla.suse.com/1194227

https://bugzilla.suse.com/1194291

https://bugzilla.suse.com/1194880

https://bugzilla.suse.com/1195009

https://bugzilla.suse.com/1195062

https://bugzilla.suse.com/1195065

https://bugzilla.suse.com/1195073

https://bugzilla.suse.com/1195183

https://bugzilla.suse.com/1195184

https://bugzilla.suse.com/1195254

https://bugzilla.suse.com/1195267

https://bugzilla.suse.com/1195293

https://bugzilla.suse.com/1195371

https://lists.suse.com/pipermail/sle-updates/2022-February/021670.html

https://www.suse.com/security/cve/CVE-2020-28097

https://www.suse.com/security/cve/CVE-2021-22600

https://www.suse.com/security/cve/CVE-2021-39648

https://www.suse.com/security/cve/CVE-2021-39657

https://www.suse.com/security/cve/CVE-2021-39685

https://www.suse.com/security/cve/CVE-2021-4159

https://www.suse.com/security/cve/CVE-2021-44733

https://www.suse.com/security/cve/CVE-2021-45095

https://www.suse.com/security/cve/CVE-2022-0286

https://www.suse.com/security/cve/CVE-2022-0330

https://www.suse.com/security/cve/CVE-2022-0435

https://www.suse.com/security/cve/CVE-2022-22942

Plugin Details

Severity: High

ID: 157898

File Name: suse_SU-2022-0363-1.nasl

Version: 1.8

Type: local

Agent: unix

Published: 2/11/2022

Updated: 11/9/2023

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2022-0435

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-source-azure, p-cpe:/a:novell:suse_linux:kernel-syms-azure, p-cpe:/a:novell:suse_linux:kernel-azure-devel, p-cpe:/a:novell:suse_linux:kernel-devel-azure, p-cpe:/a:novell:suse_linux:kernel-azure, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/10/2022

Vulnerability Publication Date: 2/16/2021

CISA Known Exploited Vulnerability Due Dates: 5/2/2022

Exploitable With

Metasploit (vmwgfx Driver File Descriptor Handling Priv Esc)

Reference Information

CVE: CVE-2020-28097, CVE-2021-22600, CVE-2021-39648, CVE-2021-39657, CVE-2021-39685, CVE-2021-4159, CVE-2021-44733, CVE-2021-45095, CVE-2022-0286, CVE-2022-0330, CVE-2022-0435, CVE-2022-22942

SuSE: SUSE-SU-2022:0363-1