SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:3775-1)

high Nessus Plugin ID 166585

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3775-1 advisory.

- Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
(CVE-2020-16119)

- In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

- Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

- kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

- A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect. (CVE-2022-3169)

- A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. (CVE-2022-3239)

- A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition (CVE-2022-3303)

- drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
(CVE-2022-40768)

- In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

- mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. (CVE-2022-41222)

- An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

- drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

- drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use- after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect. (CVE-2022-41849)

- A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code. (CVE-2022-42719)

- Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after- free conditions to potentially execute code. (CVE-2022-42720)

- A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code. (CVE-2022-42721)

- In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. (CVE-2022-42722)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1201309

https://bugzilla.suse.com/1201310

https://bugzilla.suse.com/1201489

https://bugzilla.suse.com/1201645

https://bugzilla.suse.com/1201865

https://bugzilla.suse.com/1201990

https://bugzilla.suse.com/1202095

https://bugzilla.suse.com/1202341

https://bugzilla.suse.com/1202385

https://bugzilla.suse.com/1202677

https://bugzilla.suse.com/1202960

https://bugzilla.suse.com/1202984

https://bugzilla.suse.com/1203159

https://bugzilla.suse.com/1203290

https://bugzilla.suse.com/1203313

https://bugzilla.suse.com/1203389

https://bugzilla.suse.com/1203410

https://bugzilla.suse.com/1203424

https://bugzilla.suse.com/1203514

https://bugzilla.suse.com/1203552

https://bugzilla.suse.com/1203622

https://bugzilla.suse.com/1203737

https://bugzilla.suse.com/1203769

https://bugzilla.suse.com/1203770

https://bugzilla.suse.com/1203906

https://bugzilla.suse.com/1203909

https://bugzilla.suse.com/1203935

https://bugzilla.suse.com/1203939

https://bugzilla.suse.com/1203987

https://bugzilla.suse.com/1203992

https://bugzilla.suse.com/1204051

https://bugzilla.suse.com/1204059

https://bugzilla.suse.com/1204060

https://bugzilla.suse.com/1204125

https://bugzilla.suse.com/1204289

https://bugzilla.suse.com/1204290

https://bugzilla.suse.com/1204291

https://bugzilla.suse.com/1204292

https://www.suse.com/security/cve/CVE-2020-16119

https://www.suse.com/security/cve/CVE-2022-20008

https://www.suse.com/security/cve/CVE-2022-2503

https://www.suse.com/security/cve/CVE-2022-2586

https://www.suse.com/security/cve/CVE-2022-3169

https://www.suse.com/security/cve/CVE-2022-3239

https://www.suse.com/security/cve/CVE-2022-3303

https://www.suse.com/security/cve/CVE-2022-40768

https://www.suse.com/security/cve/CVE-2022-41218

https://www.suse.com/security/cve/CVE-2022-41222

https://www.suse.com/security/cve/CVE-2022-41674

https://www.suse.com/security/cve/CVE-2022-41848

https://www.suse.com/security/cve/CVE-2022-41849

https://www.suse.com/security/cve/CVE-2022-42719

https://www.suse.com/security/cve/CVE-2022-42720

https://www.suse.com/security/cve/CVE-2022-42721

https://www.suse.com/security/cve/CVE-2022-42722

http://www.nessus.org/u?e46e89a7

https://bugzilla.suse.com/1177471

https://bugzilla.suse.com/1185032

https://bugzilla.suse.com/1194023

https://bugzilla.suse.com/1196444

https://bugzilla.suse.com/1197659

https://bugzilla.suse.com/1199564

https://bugzilla.suse.com/1200313

https://bugzilla.suse.com/1200622

Plugin Details

Severity: High

ID: 166585

File Name: suse_SU-2022-3775-1.nasl

Version: 1.10

Type: local

Agent: unix

Published: 10/27/2022

Updated: 6/26/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-16119

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS Score Source: CVE-2022-42719

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:kernel-default-base, p-cpe:/a:novell:suse_linux:kernel-macros, p-cpe:/a:novell:suse_linux:kernel-preempt, p-cpe:/a:novell:suse_linux:kernel-zfcpdump, p-cpe:/a:novell:suse_linux:kernel-default-devel, p-cpe:/a:novell:suse_linux:kernel-64kb-devel, p-cpe:/a:novell:suse_linux:kernel-devel, p-cpe:/a:novell:suse_linux:kernel-default, p-cpe:/a:novell:suse_linux:kernel-preempt-extra, p-cpe:/a:novell:suse_linux:kernel-default-extra, p-cpe:/a:novell:suse_linux:kernel-64kb, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/26/2022

Vulnerability Publication Date: 10/15/2020

CISA Known Exploited Vulnerability Due Dates: 7/17/2024

Reference Information

CVE: CVE-2020-16119, CVE-2022-20008, CVE-2022-2503, CVE-2022-2586, CVE-2022-3169, CVE-2022-3239, CVE-2022-3303, CVE-2022-40768, CVE-2022-41218, CVE-2022-41222, CVE-2022-41674, CVE-2022-41848, CVE-2022-41849, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721, CVE-2022-42722

SuSE: SUSE-SU-2022:3775-1