SUSE update for the Linux Kernel
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2021-29155 CVE-2021-29650 |
| CWE-ID | CWE-125 CWE-119 |
| Exploitation vector | Local |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
SUSE Linux Enterprise High Availability Operating systems & Components / Operating system SUSE Linux Enterprise Module for Legacy Software Operating systems & Components / Operating system SUSE Linux Enterprise Workstation Extension Operating systems & Components / Operating system SUSE Linux Enterprise Module for Live Patching Operating systems & Components / Operating system SUSE MicroOS Operating systems & Components / Operating system SUSE Linux Enterprise Module for Development Tools Operating systems & Components / Operating system SUSE Linux Enterprise Module for Basesystem Operating systems & Components / Operating system ocfs2-kmp-default-debuginfo Operating systems & Components / Operating system package or component ocfs2-kmp-default Operating systems & Components / Operating system package or component gfs2-kmp-default-debuginfo Operating systems & Components / Operating system package or component gfs2-kmp-default Operating systems & Components / Operating system package or component dlm-kmp-default-debuginfo Operating systems & Components / Operating system package or component dlm-kmp-default Operating systems & Components / Operating system package or component cluster-md-kmp-default-debuginfo Operating systems & Components / Operating system package or component cluster-md-kmp-default Operating systems & Components / Operating system package or component kernel-macros Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel-preempt Operating systems & Components / Operating system package or component kernel-default-devel-debuginfo Operating systems & Components / Operating system package or component kernel-default-devel Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component kernel-docs Operating systems & Components / Operating system package or component kernel-preempt-devel-debuginfo Operating systems & Components / Operating system package or component kernel-preempt-devel Operating systems & Components / Operating system package or component kernel-preempt-debugsource Operating systems & Components / Operating system package or component kernel-preempt-debuginfo Operating systems & Components / Operating system package or component kernel-syms Operating systems & Components / Operating system package or component kernel-obs-build-debugsource Operating systems & Components / Operating system package or component kernel-obs-build Operating systems & Components / Operating system package or component reiserfs-kmp-default-debuginfo Operating systems & Components / Operating system package or component reiserfs-kmp-default Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_13-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_64-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_64-default Operating systems & Components / Operating system package or component kernel-default-livepatch-devel Operating systems & Components / Operating system package or component kernel-default-livepatch Operating systems & Components / Operating system package or component kernel-preempt-extra-debuginfo Operating systems & Components / Operating system package or component kernel-preempt-extra Operating systems & Components / Operating system package or component kernel-default-extra-debuginfo Operating systems & Components / Operating system package or component kernel-default-extra Operating systems & Components / Operating system package or component kernel-default-debugsource Operating systems & Components / Operating system package or component kernel-default-debuginfo Operating systems & Components / Operating system package or component kernel-default-base Operating systems & Components / Operating system package or component kernel-default Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Out-of-bounds read
EUVDB-ID: #VU67490
Risk: Low
CVSSv4.0: 5.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2021-29155
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists in retrieve_ptr_limit in kernel/bpf/verifier.c in the Linux kernel mechanism. A local, special user privileged (CAP_SYS_ADMIN) BPF program running on affected systems may bypass the protection, and execute speculatively out-of-bounds loads from the kernel memory.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Module for Legacy Software: 15-SP2
SUSE Linux Enterprise Workstation Extension: 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE MicroOS: 5.0
SUSE Linux Enterprise Module for Development Tools: 15-SP2
SUSE Linux Enterprise Module for Basesystem: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-24.64.1
ocfs2-kmp-default: before 5.3.18-24.64.1
gfs2-kmp-default-debuginfo: before 5.3.18-24.64.1
gfs2-kmp-default: before 5.3.18-24.64.1
dlm-kmp-default-debuginfo: before 5.3.18-24.64.1
dlm-kmp-default: before 5.3.18-24.64.1
cluster-md-kmp-default-debuginfo: before 5.3.18-24.64.1
cluster-md-kmp-default: before 5.3.18-24.64.1
kernel-macros: before 5.3.18-24.64.1
kernel-devel: before 5.3.18-24.64.1
kernel-preempt: before 5.3.18-24.64.1
kernel-default-devel-debuginfo: before 5.3.18-24.64.1
kernel-default-devel: before 5.3.18-24.64.1
kernel-source: before 5.3.18-24.64.1
kernel-docs: before 5.3.18-24.64.2
kernel-preempt-devel-debuginfo: before 5.3.18-24.64.1
kernel-preempt-devel: before 5.3.18-24.64.1
kernel-preempt-debugsource: before 5.3.18-24.64.1
kernel-preempt-debuginfo: before 5.3.18-24.64.1
kernel-syms: before 5.3.18-24.64.1
kernel-obs-build-debugsource: before 5.3.18-24.64.1
kernel-obs-build: before 5.3.18-24.64.1
reiserfs-kmp-default-debuginfo: before 5.3.18-24.64.1
reiserfs-kmp-default: before 5.3.18-24.64.1
kernel-livepatch-SLE15-SP2_Update_13-debugsource: before 1-5.3.1
kernel-livepatch-5_3_18-24_64-default-debuginfo: before 1-5.3.1
kernel-livepatch-5_3_18-24_64-default: before 1-5.3.1
kernel-default-livepatch-devel: before 5.3.18-24.64.1
kernel-default-livepatch: before 5.3.18-24.64.1
kernel-preempt-extra-debuginfo: before 5.3.18-24.64.1
kernel-preempt-extra: before 5.3.18-24.64.1
kernel-default-extra-debuginfo: before 5.3.18-24.64.1
kernel-default-extra: before 5.3.18-24.64.1
kernel-default-debugsource: before 5.3.18-24.64.1
kernel-default-debuginfo: before 5.3.18-24.64.1
kernel-default-base: before 5.3.18-24.64.1.9.28.1
kernel-default: before 5.3.18-24.64.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_legacy_software:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_live_patching:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_microos:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_development_tools:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:reiserfs-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:reiserfs-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-livepatch-sle15-sp2_update_13-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-livepatch-5_3_18-24_64-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-livepatch-5_3_18-24_64-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-livepatch-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-livepatch:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20211574-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Buffer overflow
EUVDB-ID: #VU56240
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-29650
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the netfilter subsystem in net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h. A local user can trigger memory corruption upon the assignment of a new table value and cause denial of service.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 15-SP2
SUSE Linux Enterprise Module for Legacy Software: 15-SP2
SUSE Linux Enterprise Workstation Extension: 15-SP2
SUSE Linux Enterprise Module for Live Patching: 15-SP2
SUSE MicroOS: 5.0
SUSE Linux Enterprise Module for Development Tools: 15-SP2
SUSE Linux Enterprise Module for Basesystem: 15-SP2
ocfs2-kmp-default-debuginfo: before 5.3.18-24.64.1
ocfs2-kmp-default: before 5.3.18-24.64.1
gfs2-kmp-default-debuginfo: before 5.3.18-24.64.1
gfs2-kmp-default: before 5.3.18-24.64.1
dlm-kmp-default-debuginfo: before 5.3.18-24.64.1
dlm-kmp-default: before 5.3.18-24.64.1
cluster-md-kmp-default-debuginfo: before 5.3.18-24.64.1
cluster-md-kmp-default: before 5.3.18-24.64.1
kernel-macros: before 5.3.18-24.64.1
kernel-devel: before 5.3.18-24.64.1
kernel-preempt: before 5.3.18-24.64.1
kernel-default-devel-debuginfo: before 5.3.18-24.64.1
kernel-default-devel: before 5.3.18-24.64.1
kernel-source: before 5.3.18-24.64.1
kernel-docs: before 5.3.18-24.64.2
kernel-preempt-devel-debuginfo: before 5.3.18-24.64.1
kernel-preempt-devel: before 5.3.18-24.64.1
kernel-preempt-debugsource: before 5.3.18-24.64.1
kernel-preempt-debuginfo: before 5.3.18-24.64.1
kernel-syms: before 5.3.18-24.64.1
kernel-obs-build-debugsource: before 5.3.18-24.64.1
kernel-obs-build: before 5.3.18-24.64.1
reiserfs-kmp-default-debuginfo: before 5.3.18-24.64.1
reiserfs-kmp-default: before 5.3.18-24.64.1
kernel-livepatch-SLE15-SP2_Update_13-debugsource: before 1-5.3.1
kernel-livepatch-5_3_18-24_64-default-debuginfo: before 1-5.3.1
kernel-livepatch-5_3_18-24_64-default: before 1-5.3.1
kernel-default-livepatch-devel: before 5.3.18-24.64.1
kernel-default-livepatch: before 5.3.18-24.64.1
kernel-preempt-extra-debuginfo: before 5.3.18-24.64.1
kernel-preempt-extra: before 5.3.18-24.64.1
kernel-default-extra-debuginfo: before 5.3.18-24.64.1
kernel-default-extra: before 5.3.18-24.64.1
kernel-default-debugsource: before 5.3.18-24.64.1
kernel-default-debuginfo: before 5.3.18-24.64.1
kernel-default-base: before 5.3.18-24.64.1.9.28.1
kernel-default: before 5.3.18-24.64.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_legacy_software:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_live_patching:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_microos:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_development_tools:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:reiserfs-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:reiserfs-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-livepatch-sle15-sp2_update_13-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-livepatch-5_3_18-24_64-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-livepatch-5_3_18-24_64-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-livepatch-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-livepatch:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-preempt-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20211574-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
