Security update for the Linux Kernel (Live Patch 41 for SLE 15 SP3) SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3648-1 Final 1 1 2024-10-16T10:03:55Z current 2024-10-16T10:03:55Z 2024-10-16T10:03:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel (Live Patch 41 for SLE 15 SP3) This update for the Linux Kernel 5.3.18-150300_59_150 fixes several issues. The following security issues were fixed: - CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312). - CVE-2021-47291: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions (bsc#1227651). - CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573). - CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-3648,SUSE-2024-3650,SUSE-SLE-Module-Live-Patching-15-SP2-2024-3648,SUSE-SLE-Module-Live-Patching-15-SP3-2024-3650 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243648-1/ Link for SUSE-SU-2024:3648-1 https://lists.suse.com/pipermail/sle-updates/2024-October/037264.html E-Mail link for SUSE-SU-2024:3648-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1225312 SUSE Bug 1225312 https://bugzilla.suse.com/1226325 SUSE Bug 1226325 https://bugzilla.suse.com/1227651 SUSE Bug 1227651 https://bugzilla.suse.com/1228573 SUSE Bug 1228573 https://www.suse.com/security/cve/CVE-2021-47291/ SUSE CVE CVE-2021-47291 page https://www.suse.com/security/cve/CVE-2024-35861/ SUSE CVE CVE-2024-35861 page https://www.suse.com/security/cve/CVE-2024-36964/ SUSE CVE CVE-2024-36964 page https://www.suse.com/security/cve/CVE-2024-41059/ SUSE CVE CVE-2024-41059 page SUSE Linux Enterprise Live Patching 15 SP2 SUSE Linux Enterprise Live Patching 15 SP3 kernel-livepatch-5_3_18-150200_24_166-default-14-150200.2.1 kernel-livepatch-5_3_18-150200_24_166-preempt-14-150200.2.1 kernel-livepatch-5_3_18-150300_59_150-default-11-150300.2.1 kernel-livepatch-5_3_18-150300_59_150-preempt-11-150300.2.1 kernel-livepatch-5_3_18-150200_24_166-default-14-150200.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP2 kernel-livepatch-5_3_18-150300_59_150-default-11-150300.2.1 as a component of SUSE Linux Enterprise Live Patching 15 SP3 In the Linux kernel, the following vulnerability has been resolved: ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions While running the self-tests on a KASAN enabled kernel, I observed a slab-out-of-bounds splat very similar to the one reported in commit 821bbf79fe46 ("ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions"). We additionally need to take care of fib6_metrics initialization failure when the caller provides an nh. The fix is similar, explicitly free the route instead of calling fib6_info_release on a half-initialized object. CVE-2021-47291 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-150200_24_166-default-14-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP3:kernel-livepatch-5_3_18-150300_59_150-default-11-150300.2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243648-1/ https://www.suse.com/security/cve/CVE-2021-47291.html CVE-2021-47291 https://bugzilla.suse.com/1224918 SUSE Bug 1224918 https://bugzilla.suse.com/1227651 SUSE Bug 1227651 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. CVE-2024-35861 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-150200_24_166-default-14-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP3:kernel-livepatch-5_3_18-150300_59_150-default-11-150300.2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243648-1/ https://www.suse.com/security/cve/CVE-2024-35861.html CVE-2024-35861 https://bugzilla.suse.com/1224766 SUSE Bug 1224766 https://bugzilla.suse.com/1225312 SUSE Bug 1225312 In the Linux kernel, the following vulnerability has been resolved: fs/9p: only translate RWX permissions for plain 9P2000 Garbage in plain 9P2000's perm bits is allowed through, which causes it to be able to set (among others) the suid bit. This was presumably not the intent since the unix extended bits are handled explicitly and conditionally on .u. CVE-2024-36964 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-150200_24_166-default-14-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP3:kernel-livepatch-5_3_18-150300_59_150-default-11-150300.2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243648-1/ https://www.suse.com/security/cve/CVE-2024-36964.html CVE-2024-36964 https://bugzilla.suse.com/1225866 SUSE Bug 1225866 https://bugzilla.suse.com/1226325 SUSE Bug 1226325 In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 hfsplus_listxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750 vfs_listxattr fs/xattr.c:493 [inline] listxattr+0x1f3/0x6b0 fs/xattr.c:840 path_listxattr fs/xattr.c:864 [inline] __do_sys_listxattr fs/xattr.c:876 [inline] __se_sys_listxattr fs/xattr.c:873 [inline] __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873 x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3877 [inline] slab_alloc_node mm/slub.c:3918 [inline] kmalloc_trace+0x57b/0xbe0 mm/slub.c:4065 kmalloc include/linux/slab.h:628 [inline] hfsplus_listxattr+0x4cc/0x1a50 fs/hfsplus/xattr.c:699 vfs_listxattr fs/xattr.c:493 [inline] listxattr+0x1f3/0x6b0 fs/xattr.c:840 path_listxattr fs/xattr.c:864 [inline] __do_sys_listxattr fs/xattr.c:876 [inline] __se_sys_listxattr fs/xattr.c:873 [inline] __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873 x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [Fix] When allocating memory to strbuf, initialize memory to 0. CVE-2024-41059 SUSE Linux Enterprise Live Patching 15 SP2:kernel-livepatch-5_3_18-150200_24_166-default-14-150200.2.1 SUSE Linux Enterprise Live Patching 15 SP3:kernel-livepatch-5_3_18-150300_59_150-default-11-150300.2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243648-1/ https://www.suse.com/security/cve/CVE-2024-41059.html CVE-2024-41059 https://bugzilla.suse.com/1228561 SUSE Bug 1228561 https://bugzilla.suse.com/1228573 SUSE Bug 1228573