SUSE update for the Linux Kernel (Live Patch 29 for SLE 15 SP2)

Published: 2022-10-19

Risk	High
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2022-39189 CVE-2022-41222 CVE-2022-41674 CVE-2022-42719 CVE-2022-42720 CVE-2022-42721
CWE-ID	CWE-264 CWE-416 CWE-119
Exploitation vector	Local network
Public exploit	N/A
Vulnerable software	SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise Module for Live Patching Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system kernel-livepatch-SLE15-SP2_Update_25-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_29-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_27-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_26-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_24-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_23-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_22-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_21-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP2_Update_20-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_99-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_99-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_96-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_96-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_93-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_93-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_86-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_86-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_107-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_107-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_102-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-24_102-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150200_24_126-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150200_24_126-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150200_24_115-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150200_24_115-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150200_24_112-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150200_24_112-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-59_40-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP3_Update_9-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP3_Update_7-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-SLE15-SP3_Update_10-debugsource Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-59_40-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-59_37-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-59_37-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-59_34-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-59_34-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-59_27-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-59_27-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_90-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_87-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_76-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_71-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_68-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_63-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_60-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_49-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_46-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_46-default Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_43-default-debuginfo Operating systems & Components / Operating system package or component kernel-livepatch-5_3_18-150300_59_43-default Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU68110

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-39189

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a guest user to escalate privileges on the system.

The vulnerability exists due to incorrect handling of TLB flush operations in certain KVM_VCPU_PREEMPTED situations in the x86 KVM subsystem in the Linux kernel. An attacker with unprivileged access to the guest OS can escalate privileges on the guest.

Mitigation

Update the affected package the Linux Kernel (Live Patch 29 for SLE 15 SP2) to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications: 15-SP2 - 15-SP3

SUSE Linux Enterprise Server: 15-SP2 - 15-SP3

SUSE Linux Enterprise Module for Live Patching: 15-SP2 - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP2 - 15-SP3

SUSE Linux Enterprise Micro: 5.1

kernel-livepatch-SLE15-SP2_Update_25-debugsource: before 13-150200.2.2

kernel-livepatch-SLE15-SP2_Update_29-debugsource: before 4-150200.2.1

kernel-livepatch-SLE15-SP2_Update_27-debugsource: before 7-150200.2.1

kernel-livepatch-SLE15-SP2_Update_26-debugsource: before 9-150200.2.2

kernel-livepatch-SLE15-SP2_Update_24-debugsource: before 14-150200.2.2

kernel-livepatch-SLE15-SP2_Update_23-debugsource: before 15-150200.2.2

kernel-livepatch-SLE15-SP2_Update_22-debugsource: before 16-150200.2.2

kernel-livepatch-SLE15-SP2_Update_21-debugsource: before 17-150200.2.2

kernel-livepatch-SLE15-SP2_Update_20-debugsource: before 18-150200.2.2

kernel-livepatch-5_3_18-24_99-default-debuginfo: before 15-150200.2.2

kernel-livepatch-5_3_18-24_99-default: before 15-150200.2.2

kernel-livepatch-5_3_18-24_96-default-debuginfo: before 16-150200.2.2

kernel-livepatch-5_3_18-24_96-default: before 16-150200.2.2

kernel-livepatch-5_3_18-24_93-default-debuginfo: before 17-150200.2.2

kernel-livepatch-5_3_18-24_93-default: before 17-150200.2.2

kernel-livepatch-5_3_18-24_86-default-debuginfo: before 18-150200.2.2

kernel-livepatch-5_3_18-24_86-default: before 18-150200.2.2

kernel-livepatch-5_3_18-24_107-default-debuginfo: before 13-150200.2.2

kernel-livepatch-5_3_18-24_107-default: before 13-150200.2.2

kernel-livepatch-5_3_18-24_102-default-debuginfo: before 14-150200.2.2

kernel-livepatch-5_3_18-24_102-default: before 14-150200.2.2

kernel-livepatch-5_3_18-150200_24_126-default-debuginfo: before 4-150200.2.1

kernel-livepatch-5_3_18-150200_24_126-default: before 4-150200.2.1

kernel-livepatch-5_3_18-150200_24_115-default-debuginfo: before 7-150200.2.1

kernel-livepatch-5_3_18-150200_24_115-default: before 7-150200.2.1

kernel-livepatch-5_3_18-150200_24_112-default-debuginfo: before 9-150200.2.2

kernel-livepatch-5_3_18-150200_24_112-default: before 9-150200.2.2

kernel-livepatch-5_3_18-59_40-default-debuginfo: before 16-150300.2.2

kernel-livepatch-SLE15-SP3_Update_9-debugsource: before 17-150300.2.2

kernel-livepatch-SLE15-SP3_Update_7-debugsource: before 18-150300.2.2

kernel-livepatch-SLE15-SP3_Update_10-debugsource: before 16-150300.2.2

kernel-livepatch-5_3_18-59_40-default: before 16-150300.2.2

kernel-livepatch-5_3_18-59_37-default-debuginfo: before 16-150300.2.2

kernel-livepatch-5_3_18-59_37-default: before 16-150300.2.2

kernel-livepatch-5_3_18-59_34-default-debuginfo: before 17-150300.2.2

kernel-livepatch-5_3_18-59_34-default: before 17-150300.2.2

kernel-livepatch-5_3_18-59_27-default-debuginfo: before 18-150300.2.2

kernel-livepatch-5_3_18-59_27-default: before 18-150300.2.2

kernel-livepatch-5_3_18-150300_59_90-default: before 4-150300.2.1

kernel-livepatch-5_3_18-150300_59_87-default: before 5-150300.2.1

kernel-livepatch-5_3_18-150300_59_76-default: before 6-150300.2.1

kernel-livepatch-5_3_18-150300_59_71-default: before 7-150300.2.1

kernel-livepatch-5_3_18-150300_59_68-default: before 8-150300.2.2

kernel-livepatch-5_3_18-150300_59_63-default: before 9-150300.2.2

kernel-livepatch-5_3_18-150300_59_60-default: before 12-150300.2.2

kernel-livepatch-5_3_18-150300_59_49-default: before 14-150300.2.2

kernel-livepatch-5_3_18-150300_59_46-default-debuginfo: before 15-150300.2.2

kernel-livepatch-5_3_18-150300_59_46-default: before 15-150300.2.2

kernel-livepatch-5_3_18-150300_59_43-default-debuginfo: before 15-150300.2.2

kernel-livepatch-5_3_18-150300_59_43-default: before 15-150300.2.2

CPE2.3

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20223648-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU68422

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-41222

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error caused by a stale TLB in mm/mremap.c, because an rmap lock is not held during a PUD move. A local user can gain access to sensitive information.