Security update for the Linux Kernel (Live Patch 19 for SLE 15 SP2) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:0238-1 Final 1 1 2022-01-31T09:36:18Z current 2022-01-31T09:36:18Z 2022-01-31T09:36:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 19 for SLE 15 SP2) This update for the Linux Kernel 5.3.18-24_83 fixes several issues. The following security issues were fixed: - CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517). - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking (bsc#1184673). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-238,SUSE-SLE-Module-Live-Patching-15-SP2-2022-229,SUSE-SLE-Module-Live-Patching-15-SP2-2022-238 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20220238-1/ Link for SUSE-SU-2022:0238-1 https://lists.suse.com/pipermail/sle-security-updates/2022-January/010148.html E-Mail link for SUSE-SU-2022:0238-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1192036 SUSE Bug 1192036 https://bugzilla.suse.com/1194737 SUSE Bug 1194737 https://www.suse.com/security/cve/CVE-2021-42739/ SUSE CVE CVE-2021-42739 page https://www.suse.com/security/cve/CVE-2022-0185/ SUSE CVE CVE-2022-0185 page SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_83-default-4-2.2 kernel-livepatch-5_3_18-24_83-preempt-4-2.2 kernel-livepatch-5_3_18-24_86-default-4-2.3 kernel-livepatch-5_3_18-24_86-default-4-2.3 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-24_83-default-4-2.2 as a component of SUSE Linux Enterprise Live Patching 15 SP2 The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking. CVE-2021-42739 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_83-default-4-2.2 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_86-default-4-2.3 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220238-1/ https://www.suse.com/security/cve/CVE-2021-42739.html CVE-2021-42739 https://bugzilla.suse.com/1184673 SUSE Bug 1184673 https://bugzilla.suse.com/1192036 SUSE Bug 1192036 https://bugzilla.suse.com/1196722 SUSE Bug 1196722 https://bugzilla.suse.com/1196914 SUSE Bug 1196914 A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. CVE-2022-0185 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_83-default-4-2.2 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-24_86-default-4-2.3 important 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220238-1/ https://www.suse.com/security/cve/CVE-2022-0185.html CVE-2022-0185 https://bugzilla.suse.com/1194517 SUSE Bug 1194517 https://bugzilla.suse.com/1194737 SUSE Bug 1194737