SUSE update for the Linux Kernel
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 12 |
| CVE-ID | CVE-2018-13405 CVE-2021-33033 CVE-2021-34556 CVE-2021-35477 CVE-2021-3655 CVE-2021-3715 CVE-2021-37159 CVE-2021-3760 CVE-2021-41864 CVE-2021-42008 CVE-2021-42252 CVE-2021-42739 |
| CWE-ID | CWE-264 CWE-416 CWE-200 CWE-203 CWE-909 CWE-415 CWE-787 CWE-119 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #10 is available. |
| Vulnerable software |
SUSE Linux Enterprise High Availability Operating systems & Components / Operating system SUSE Linux Enterprise Live Patching Operating systems & Components / Operating system SUSE Linux Enterprise Workstation Extension Operating systems & Components / Operating system SUSE Linux Enterprise Software Development Kit Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system ocfs2-kmp-default-debuginfo Operating systems & Components / Operating system package or component ocfs2-kmp-default Operating systems & Components / Operating system package or component gfs2-kmp-default-debuginfo Operating systems & Components / Operating system package or component gfs2-kmp-default Operating systems & Components / Operating system package or component dlm-kmp-default-debuginfo Operating systems & Components / Operating system package or component dlm-kmp-default Operating systems & Components / Operating system package or component cluster-md-kmp-default-debuginfo Operating systems & Components / Operating system package or component cluster-md-kmp-default Operating systems & Components / Operating system package or component kgraft-patch-4_12_14-122_98-default Operating systems & Components / Operating system package or component kernel-default-kgraft-devel Operating systems & Components / Operating system package or component kernel-default-kgraft Operating systems & Components / Operating system package or component kernel-default-man Operating systems & Components / Operating system package or component kernel-source Operating systems & Components / Operating system package or component kernel-macros Operating systems & Components / Operating system package or component kernel-devel Operating systems & Components / Operating system package or component kernel-default-devel-debuginfo Operating systems & Components / Operating system package or component kernel-syms Operating systems & Components / Operating system package or component kernel-default-devel Operating systems & Components / Operating system package or component kernel-default-base-debuginfo Operating systems & Components / Operating system package or component kernel-default-base Operating systems & Components / Operating system package or component kernel-default Operating systems & Components / Operating system package or component kernel-docs Operating systems & Components / Operating system package or component kernel-obs-build-debugsource Operating systems & Components / Operating system package or component kernel-obs-build Operating systems & Components / Operating system package or component kernel-default-extra-debuginfo Operating systems & Components / Operating system package or component kernel-default-extra Operating systems & Components / Operating system package or component kernel-default-debugsource Operating systems & Components / Operating system package or component kernel-default-debuginfo Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 12 vulnerabilities.
1) Security restrictions bypass
EUVDB-ID: #VU13631
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2018-13405
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to create arbitrary files on the target system.
The vulnerability exists due to the inode_init_owner function, as defined in the fs/inode.c source code file, allows the creation of arbitrary files in set-group identification (SGID) directories. A local attacker can create arbitrary files with unintended group ownership.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Use-after-free
EUVDB-ID: #VU55261
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-33033
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper handling of the CIPSO and CALIPSO refcounting for the DOI definitions in cipso_v4_genopt(0 function in net/ipv4/cipso_ipv4.c in Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code with escalated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Information disclosure
EUVDB-ID: #VU64203
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-34556
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A local user can gain unauthorized access to sensitive information on the system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Observable discrepancy
EUVDB-ID: #VU92412
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-35477
CWE-ID:
CWE-203 - Observable discrepancy
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to observable discrepancy error. A local user can gain access to sensitive information.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Missing initialization of resource
EUVDB-ID: #VU61098
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-3655
CWE-ID:
CWE-909 - Missing initialization of resource
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to missing initialization of resource in the Linux kernel when processing inbound SCTP packets. A remote attacker can send specially crafted SCTP packets to the system and force the kernel to read uninitialized memory.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Use-after-free
EUVDB-ID: #VU56393
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-3715
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem (route4_change() function in net/sched/cls_route.c) in the way it handled changing of classification filters. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Double Free
EUVDB-ID: #VU63575
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-37159
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to hso_free_net_device() function in drivers/net/usb/hso.c in the Linux kernel calls unregister_netdev without checking for the NETREG_REGISTERED state. A local user can trigger double free and use-after-free errors and execute arbitrary code with elevated privileges.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Use-after-free
EUVDB-ID: #VU63816
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-3760
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error in the NFC stack. A local user can trigger use-after-free error to escalate privileges on the system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Out-of-bounds write
EUVDB-ID: #VU63855
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-41864
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing untrusted input. A local user can gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Out-of-bounds write
EUVDB-ID: #VU63669
Risk: Low
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2021-42008
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the decode_data() function in drivers/net/hamradio/6pack.c in the Linux kernel. A local user can send input from a process that has the CAP_NET_ADMIN capability and escalate privileges on the system.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
11) Out-of-bounds write
EUVDB-ID: #VU93833
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-42252
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write within the aspeed_lpc_ctrl_mmap() function in drivers/soc/aspeed/aspeed-lpc-ctrl.c. A local user can execute arbitrary code.
MitigationUpdate the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Buffer overflow
EUVDB-ID: #VU59474
Risk: Low
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-42739
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary within the firewire subsystem in the Linux kernel in drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c files. A local privileged user can run a specially crafted program tat calls avc_ca_pmt() function to trigger memory corruption and execute arbitrary code with elevated privileges.
Update the affected package the Linux Kernel to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Availability: 12-SP5
SUSE Linux Enterprise Live Patching: 12-SP5
SUSE Linux Enterprise Workstation Extension: 12-SP5
SUSE Linux Enterprise Software Development Kit: 12-SP5
SUSE Linux Enterprise Server: 12-SP5
ocfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
ocfs2-kmp-default: before 4.12.14-122.98.1
gfs2-kmp-default-debuginfo: before 4.12.14-122.98.1
gfs2-kmp-default: before 4.12.14-122.98.1
dlm-kmp-default-debuginfo: before 4.12.14-122.98.1
dlm-kmp-default: before 4.12.14-122.98.1
cluster-md-kmp-default-debuginfo: before 4.12.14-122.98.1
cluster-md-kmp-default: before 4.12.14-122.98.1
kgraft-patch-4_12_14-122_98-default: before 1-8.7.1
kernel-default-kgraft-devel: before 4.12.14-122.98.1
kernel-default-kgraft: before 4.12.14-122.98.1
kernel-default-man: before 4.12.14-122.98.1
kernel-source: before 4.12.14-122.98.1
kernel-macros: before 4.12.14-122.98.1
kernel-devel: before 4.12.14-122.98.1
kernel-default-devel-debuginfo: before 4.12.14-122.98.1
kernel-syms: before 4.12.14-122.98.1
kernel-default-devel: before 4.12.14-122.98.1
kernel-default-base-debuginfo: before 4.12.14-122.98.1
kernel-default-base: before 4.12.14-122.98.1
kernel-default: before 4.12.14-122.98.1
kernel-docs: before 4.12.14-122.98.1
kernel-obs-build-debugsource: before 4.12.14-122.98.1
kernel-obs-build: before 4.12.14-122.98.1
kernel-default-extra-debuginfo: before 4.12.14-122.98.1
kernel-default-extra: before 4.12.14-122.98.1
kernel-default-debugsource: before 4.12.14-122.98.1
kernel-default-debuginfo: before 4.12.14-122.98.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_availability:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_live_patching:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_workstation_extension:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:ocfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:gfs2-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dlm-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:cluster-md-kmp-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kgraft-patch-4_12_14-122_98-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-kgraft:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-man:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-source:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-macros:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-syms:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-base:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-docs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-obs-build:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-extra:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:kernel-default-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213748-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
