SB2022111709 - SUSE update for the Linux Kernel (Live Patch 31 for SLE 15 SP2)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022111709

SB2022111709 - SUSE update for the Linux Kernel (Live Patch 31 for SLE 15 SP2)

Published: November 17, 2022

Security Bulletin ID SB2022111709
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2021-39698)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Linux kernel. A local user can run a specially crafted program to trigger the use-after-free error and execute arbitrary code with elevated privileges.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-39189)

The vulnerability allows a guest user to escalate privileges on the system.

The vulnerability exists due to incorrect handling of TLB flush operations in certain KVM_VCPU_PREEMPTED situations in the x86 KVM subsystem in the Linux kernel. An attacker with unprivileged access to the guest OS can escalate privileges on the guest.


Remediation

Install update from vendor's website.

References