Security update for the Linux Kernel (Live Patch 48 for SLE 12 SP5) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3021-1 Final 1 1 2024-08-27T10:03:55Z current 2024-08-27T10:03:55Z 2024-08-27T10:03:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 48 for SLE 12 SP5) This update for the Linux Kernel 4.12.14-122_176 fixes one issue. The following security issue was fixed: - CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp (bsc#1225202). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-3021,SUSE-SLE-Live-Patching-12-SP5-2024-3021 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243021-1/ Link for SUSE-SU-2024:3021-1 https://lists.suse.com/pipermail/sle-updates/2024-August/036683.html E-Mail link for SUSE-SU-2024:3021-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1225202 SUSE Bug 1225202 https://www.suse.com/security/cve/CVE-2021-47378/ SUSE CVE CVE-2021-47378 page SUSE Linux Enterprise Live Patching 12 SP5 kgraft-patch-4_12_14-122_176-default-13-2.1 kgraft-patch-4_12_14-122_176-default-13-2.1 as a component of SUSE Linux Enterprise Live Patching 12 SP5 In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id. CVE-2021-47378 SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_176-default-13-2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243021-1/ https://www.suse.com/security/cve/CVE-2021-47378.html CVE-2021-47378 https://bugzilla.suse.com/1225201 SUSE Bug 1225201 https://bugzilla.suse.com/1225202 SUSE Bug 1225202