The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bnc#1184509).

CVE-2021-29650: Fixed an issue inside the netfilter subsystem that allowed attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value (bnc#1184208).

CVE-2021-29155: Fixed an issue within kernel/bpf/verifier.c that performed undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations (bnc#1184942).

CVE-2020-36310: Fixed an issue in arch/x86/kvm/svm/svm.c that allowed a set_memory_region_test infinite loop for certain nested page faults (bnc#1184512).

CVE-2020-27673: Fixed an issue in Xen where a guest OS users could have caused a denial of service (host OS hang) via a high rate of events to dom0 (bnc#1177411, bnc#1184583).

CVE-2021-29154: Fixed BPF JIT compilers that allowed to execute arbitrary code within the kernel context (bnc#1184391).

CVE-2020-25673: Fixed NFC endless loops caused by repeated llcp_sock_connect() (bsc#1178181).

CVE-2020-25672: Fixed NFC memory leak in llcp_sock_connect() (bsc#1178181).

CVE-2020-25671: Fixed NFC refcount leak in llcp_sock_connect() (bsc#1178181).

CVE-2020-25670: Fixed NFC refcount leak in llcp_sock_bind() (bsc#1178181).

CVE-2020-36311: Fixed an issue in arch/x86/kvm/svm/sev.c that allowed attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions) (bnc#1184511).

CVE-2021-28950: Fixed an issue in fs/fuse/fuse_i.h where a 'stall on CPU' could have occured because a retry loop continually finds the same bad inode (bnc#1184194, bnc#1184211).

CVE-2020-36322: Fixed an issue inside the FUSE filesystem implementation where fuse_do_getattr() calls make_bad_inode() in inappropriate situations, could have caused a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950 (bnc#1184211).

CVE-2021-30002: Fixed a memory leak issue when a webcam device exists (bnc#1184120).

CVE-2021-3483: Fixed a use-after-free bug in nosy_ioctl() (bsc#1184393).

CVE-2021-20219: Fixed a denial of service vulnerability in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a normal user privilege could have delayed the loop and cause a threat to the system availability (bnc#1184397).

CVE-2021-28964: Fixed a race condition in fs/btrfs/ctree.c that could have caused a denial of service because of a lack of locking on an extent buffer before a cloning operation (bnc#1184193).

CVE-2021-3444: Fixed the bpf verifier as it did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution (bnc#1184170).

CVE-2021-28971: Fixed a potential local denial of service in intel_pmu_drain_pebs_nhm where userspace applications can cause a system crash because the PEBS status in a PEBS record is mishandled (bnc#1184196).

CVE-2021-28688: Fixed XSA-365 that includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up.
The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains (bnc#1183646).

CVE-2021-29265: Fixed an issue in usbip_sockfd_store in drivers/usb/usbip/stub_dev.c that allowed attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status (bnc#1184167).

CVE-2021-29264: Fixed an issue in drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver that allowed attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled (bnc#1184168).

CVE-2021-28972: Fixed an issue in drivers/pci/hotplug/rpadlpar_sysfs.c where the RPA PCI Hotplug driver had a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination (bnc#1184198).

CVE-2021-29647: Fixed an issue in kernel qrtr_recvmsg in net/qrtr/qrtr.c that allowed attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure (bnc#1184192).

CVE-2020-27171: Fixed an issue in kernel/bpf/verifier.c that had an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory (bnc#1183686, bnc#1183775).

CVE-2020-27170: Fixed an issue in kernel/bpf/verifier.c that performed undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. This affects pointer types that do not define a ptr_limit (bnc#1183686 bnc#1183775).

CVE-2021-28660: Fixed rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c that allowed writing beyond the end of the ssid array (bnc#1183593).

CVE-2020-35519: Update patch reference for x25 fix (bsc#1183696).

CVE-2021-3428: Fixed ext4 integer overflow in ext4_es_cache_extent (bsc#1173485, bsc#1183509).

CVE-2020-0433: Fixed blk_mq_queue_tag_busy_iter of blk-mq-tag.c, where a possible use after free due to improper locking could have happened.
This could have led to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1176720).

CVE-2021-28038: Fixed an issue with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931 (bnc#1183022, bnc#1183069).

CVE-2020-27815: Fixed jfs array index bounds check in dbAdjTree (bsc#1179454).

CVE-2021-27365: Fixed an issue inside the iSCSI data structures that does not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message (bnc#1182715).

CVE-2021-27363: Fixed an issue with a kernel pointer leak that could have been used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables (bnc#1182716).

CVE-2021-27364: Fixed an issue in drivers/scsi/scsi_transport_iscsi.c where an unprivileged user can craft Netlink messages (bnc#1182717).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE Linux Leap 15.2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2021-3483: Fixed a use-after-free in nosy.c     (bsc#1184393).

  - CVE-2021-30002: Fixed a memory leak for large arguments     in video_usercopy (bsc#1184120).

  - CVE-2021-29154: Fixed incorrect computation of branch     displacements, allowing arbitrary code execution     (bsc#1184391).

  - CVE-2021-28950: Fixed an issue in fs/fuse/fuse_i.h due     to a retry loop continually was finding the same bad     inode (bsc#1184194).

  - CVE-2020-36312: Fixed a memory leak upon a kmalloc     failure (bsc#1184509 ).

  - CVE-2020-36311: Fixed a denial of service (soft lockup)     by triggering destruction of a large SEV VM     (bsc#1184511).

  - CVE-2020-36310: Fixed infinite loop for certain nested     page faults (bsc#1184512).

  - CVE-2020-25670, CVE-2020-25671, CVE-2020-25672,     CVE-2020-25673: Fixed multiple bugs in NFC subsytem     (bsc#1178181).

  - CVE-2020-36322: Fixed an issue was discovered in FUSE     filesystem implementation which could have caused a     system crash (bsc#1184211).

The following non-security bugs were fixed :

  - ALSA: aloop: Fix initialization of controls (git-fixes).

  - ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire     E1 (git-fixes).

  - appletalk: Fix skb allocation size in loopback case     (git-fixes).

  - ASoC: cygnus: fix for_each_child.cocci warnings     (git-fixes).

  - ASoC: fsl_esai: Fix TDM slot setup for I2S mode     (git-fixes).

  - ASoC: intel: atom: Remove 44100 sample-rate from the     media and deep-buffer DAI descriptions (git-fixes).

  - ASoC: intel: atom: Stop advertising non working S24LE     support (git-fixes).

  - ASoC: max98373: Added 30ms turn on/off time delay     (git-fixes).

  - ASoC: sunxi: sun4i-codec: fill ASoC card owner     (git-fixes).

  - ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled     for some chips (git-fixes).

  - ath10k: hold RCU lock when calling     ieee80211_find_sta_by_ifaddr() (git-fixes).

  - atl1c: fix error return code in atl1c_probe()     (git-fixes).

  - atl1e: fix error return code in atl1e_probe()     (git-fixes).

  - batman-adv: initialize 'struct     batadv_tvlv_tt_vlan_data'->reserved field (git-fixes).

  - bpf: Fix verifier jsgt branch analysis on max bound     (bsc#1155518).

  - bpf: Remove MTU check in __bpf_skb_max_len     (bsc#1155518).

  - bpf, sockmap: Fix sk->prot unhash op reset     (bsc#1155518).

  - brcmfmac: clear EAP/association status bits on linkdown     events (git-fixes).

  - bus: ti-sysc: Fix warning on unbind if reset is not     deasserted (git-fixes).

  - cifs: change noisy error message to FYI (bsc#1181507).

  - cifs_debug: use %pd instead of messing with ->d_name     (bsc#1181507).

  - cifs: do not send close in compound create+close     requests (bsc#1181507).

  - cifs: New optype for session operations (bsc#1181507).

  - cifs: print MIDs in decimal notation (bsc#1181507).

  - cifs: return proper error code in statfs(2)     (bsc#1181507).

  - cifs: Tracepoints and logs for tracing credit changes     (bsc#1181507).

  - clk: fix invalid usage of list cursor in register     (git-fixes).

  - clk: fix invalid usage of list cursor in unregister     (git-fixes).

  - clk: socfpga: fix iomem pointer cast on 64-bit     (git-fixes).

  - dm mpath: switch paths in dm_blk_ioctl() code path     (bsc#1167574, bsc#1175995, bsc#1184485).

  - drivers: video: fbcon: fix NULL dereference in     fbcon_cursor() (git-fixes).

  - drm/amdgpu: check alignment on CPU page for bo map     (git-fixes).

  - drm/amdgpu: fix offset calculation in     amdgpu_vm_bo_clear_mappings() (git-fixes).

  - drm/i915: Fix invalid access to ACPI _DSM objects     (bsc#1184074).

  - drm/msm/adreno: a5xx_power: Do not apply A540 lm_setup     to other GPUs (git-fixes).

  - drm/msm: Ratelimit invalid-fence message (git-fixes).

  - drm/msm: Set drvdata to NULL when msm_drm_init() fails     (git-fixes).

  - enetc: Fix reporting of h/w packet counters (git-fixes).

  - fix Patch-mainline:
    patches.suse/cifs_debug-use-pd-instead-of-messing-with-d
    _name.patch

  - fix patch metadata

  - fuse: fix bad inode (bsc#1184211).

  - fuse: fix live lock in fuse_iget() (bsc#1184211).

  - gianfar: Handle error code at MAC address change     (git-fixes).

  - i40e: Fix parameters in aq_get_phy_register()     (jsc#SLE-8025).

  - i40e: Fix sparse error: 'vsi->netdev' could be null     (jsc#SLE-8025).

  - ice: remove DCBNL_DEVRESET bit from PF state     (jsc#SLE-7926).

  - iommu/vt-d: Use device numa domain if RHSA is missing     (bsc#1184585).

  - kABI: powerpc/pmem: Include pmem prototypes (bsc#1113295     git-fixes).

  - libbpf: Fix INSTALL flag order (bsc#1155518).

  - libbpf: Only create rx and tx XDP rings when necessary     (bsc#1155518).

  - locking/mutex: Fix non debug version of     mutex_lock_io_nested() (git-fixes).

  - mac80211: choose first enabled channel for monitor     (git-fixes).

  - mac80211: fix TXQ AC confusion (git-fixes).

  - mISDN: fix crash in fritzpci (git-fixes).

  - net: atheros: switch from 'pci_' to 'dma_' API     (git-fixes).

  - net: b44: fix error return code in b44_init_one()     (git-fixes).

  - net: ethernet: ti: cpsw: fix error return code in     cpsw_probe() (git-fixes).

  - net: hns3: Remove the left over redundant check &     assignment (bsc#1154353).

  - net: lantiq: Wait for the GPHY firmware to be ready     (git-fixes).

  - net/mlx5: Fix PPLM register mapping (jsc#SLE-8464).

  - net: pasemi: fix error return code in pasemi_mac_open()     (git-fixes).

  - net: phy: broadcom: Only advertise EEE for supported     modes (git-fixes).

  - net: qualcomm: rmnet: Fix incorrect receive packet     handling during cleanup (git-fixes).

  - net: sched: disable TCQ_F_NOLOCK for pfifo_fast     (bsc#1183405)

  - net: wan/lmc: unregister device when no matching device     is found (git-fixes).

  - platform/x86: intel-hid: Support Lenovo ThinkPad X1     Tablet Gen 2 (git-fixes).

  - platform/x86: thinkpad_acpi: Allow the FnLock LED to     change state (git-fixes).

  - PM: runtime: Fix ordering in pm_runtime_get_suppliers()     (git-fixes).

  - post.sh: Return an error when module update fails     (bsc#1047233 bsc#1184388).

  - powerpc/64s: Fix instruction encoding for lis in     ppc_function_entry() (bsc#1065729).

  - powerpc/pmem: Include pmem prototypes (bsc#1113295     git-fixes).

  - powerpc/pseries/ras: Remove unused variable 'status'     (bsc#1065729).

  - powerpc/sstep: Check instruction validity against ISA     version before emulation (bsc#1156395).

  - powerpc/sstep: Fix darn emulation (bsc#1156395).

  - powerpc/sstep: Fix incorrect return from analyze_instr()     (bsc#1156395).

  - powerpc/sstep: Fix load-store and update emulation     (bsc#1156395).

  - qlcnic: fix error return code in     qlcnic_83xx_restart_hw() (git-fixes).

  - RAS/CEC: Correct ce_add_elem()'s returned values     (bsc#1152489).

  - regulator: bd9571mwv: Fix AVS and DVFS voltage range     (git-fixes).

  - rpm/check-for-config-changes: Also ignore AS_VERSION     added in 5.12.

  - rpm/kernel-binary.spec.in: Fix dependency of     kernel-*-devel package (bsc#1184514) The devel package     requires the kernel binary package itself for building     modules externally.

  - samples/bpf: Fix possible hang in xdpsock with multiple     threads (bsc#1155518).

  - scsi: ibmvfc: Fix invalid state machine BUG_ON()     (bsc#1184647 ltc#191231).

  - smb3: add dynamic trace point to trace when credits     obtained (bsc#1181507).

  - smb3: fix crediting for compounding when only one     request in flight (bsc#1181507).

  - soc/fsl: qbman: fix conflicting alignment attributes     (git-fixes).

  - staging: comedi: cb_pcidas64: fix request_irq() warn     (git-fixes).

  - staging: comedi: cb_pcidas: fix request_irq() warn     (git-fixes).

  - thermal/core: Add NULL pointer check before using     cooling device stats (git-fixes).

  - USB: cdc-acm: downgrade message to debug (git-fixes).

  - USB: cdc-acm: untangle a circular dependency between     callback and softint (git-fixes).

  - usbip: vhci_hcd fix shift out-of-bounds in     vhci_hub_control() (git-fixes).

  - USB: quirks: ignore remote wake-up on Fibocom L850-GL     LTE modem (git-fixes).

  - x86: Introduce TS_COMPAT_RESTART to fix     get_nr_restart_syscall() (bsc#1152489).

  - x86/ioapic: Ignore IRQ2 again (bsc#1152489).

  - x86/mem_encrypt: Correct physical address calculation in
    __set_clr_pte_enc() (bsc#1152489).

  - xen/events: fix setting irq affinity (bsc#1184583).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A memory leak vulnerability was found in Linux kernel in llcp_sock_connect (CVE-2020-25672)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
149491	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:1596-1)	Nessus	SuSE Local Security Checks	5/14/2021	1/2/2024	high
149605	openSUSE Security Update : the Linux Kernel (openSUSE-2021-579)	Nessus	SuSE Local Security Checks	5/18/2021	1/1/2024	high
246294	Linux Distros Unpatched Vulnerability : CVE-2020-25672	Nessus	Misc.	8/8/2025	5/21/2026	high

Detections

Analytics

Plugins Search

high

high

high