SUSE SLES15 Security Update : kernel (SUSE-SU-2022:1407-1)

high Nessus Plugin ID 160222

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1407-1 advisory.

- In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file. (CVE-2021-45868)

- A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace. (CVE-2022-0850)

- A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

- A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. (CVE-2022-1011)

- A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

- A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1048)

- A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

- A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early. (CVE-2022-1195)

- A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
(CVE-2022-1198)

- A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability. (CVE-2022-1199)

- A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.
(CVE-2022-1205)

- A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat. (CVE-2022-27666)

- usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free. (CVE-2022-28388)

- mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free. (CVE-2022-28389)

- ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
(CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1065729

https://bugzilla.suse.com/1156395

https://bugzilla.suse.com/1175667

https://bugzilla.suse.com/1177028

https://bugzilla.suse.com/1178134

https://bugzilla.suse.com/1179639

https://bugzilla.suse.com/1180153

https://bugzilla.suse.com/1189562

https://bugzilla.suse.com/1194625

https://bugzilla.suse.com/1194649

https://bugzilla.suse.com/1195640

https://bugzilla.suse.com/1195926

https://bugzilla.suse.com/1196018

https://bugzilla.suse.com/1196196

https://bugzilla.suse.com/1196478

https://bugzilla.suse.com/1196761

https://bugzilla.suse.com/1196823

https://bugzilla.suse.com/1197227

https://bugzilla.suse.com/1197243

https://bugzilla.suse.com/1197300

https://bugzilla.suse.com/1197302

https://bugzilla.suse.com/1197331

https://bugzilla.suse.com/1197343

https://bugzilla.suse.com/1197366

https://bugzilla.suse.com/1197389

https://bugzilla.suse.com/1197462

https://bugzilla.suse.com/1197501

https://bugzilla.suse.com/1197534

https://bugzilla.suse.com/1197661

https://bugzilla.suse.com/1197675

https://bugzilla.suse.com/1197677

https://bugzilla.suse.com/1197702

https://bugzilla.suse.com/1197811

https://bugzilla.suse.com/1197812

https://bugzilla.suse.com/1197815

https://bugzilla.suse.com/1197817

https://bugzilla.suse.com/1197819

https://bugzilla.suse.com/1197820

https://bugzilla.suse.com/1197888

https://bugzilla.suse.com/1197889

https://bugzilla.suse.com/1197894

https://bugzilla.suse.com/1198027

https://bugzilla.suse.com/1198028

https://bugzilla.suse.com/1198029

https://bugzilla.suse.com/1198030

https://bugzilla.suse.com/1198031

https://bugzilla.suse.com/1198032

https://bugzilla.suse.com/1198033

https://bugzilla.suse.com/1198077

https://www.suse.com/security/cve/CVE-2021-45868

https://www.suse.com/security/cve/CVE-2022-0850

https://www.suse.com/security/cve/CVE-2022-0854

https://www.suse.com/security/cve/CVE-2022-1011

https://www.suse.com/security/cve/CVE-2022-1016

https://www.suse.com/security/cve/CVE-2022-1048

https://www.suse.com/security/cve/CVE-2022-1055

https://www.suse.com/security/cve/CVE-2022-1195

https://www.suse.com/security/cve/CVE-2022-1198

https://www.suse.com/security/cve/CVE-2022-1199

https://www.suse.com/security/cve/CVE-2022-1205

https://www.suse.com/security/cve/CVE-2022-27666

https://www.suse.com/security/cve/CVE-2022-28388

https://www.suse.com/security/cve/CVE-2022-28389

https://www.suse.com/security/cve/CVE-2022-28390

http://www.nessus.org/u?d0969113

Plugin Details

Severity: High

ID: 160222

File Name: suse_SU-2022-1407-1.nasl

Version: 1.9

Type: local

Agent: unix

Published: 4/27/2022

Updated: 7/13/2023

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.9

Temporal Score: 5.7

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-1048

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS Score Source: CVE-2022-28390

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:cluster-md-kmp-rt, p-cpe:/a:novell:suse_linux:dlm-kmp-rt, p-cpe:/a:novell:suse_linux:gfs2-kmp-rt, p-cpe:/a:novell:suse_linux:kernel-devel-rt, p-cpe:/a:novell:suse_linux:kernel-rt, p-cpe:/a:novell:suse_linux:kernel-rt-devel, p-cpe:/a:novell:suse_linux:kernel-rt_debug-devel, p-cpe:/a:novell:suse_linux:kernel-source-rt, p-cpe:/a:novell:suse_linux:kernel-syms-rt, p-cpe:/a:novell:suse_linux:ocfs2-kmp-rt, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/26/2022

Vulnerability Publication Date: 3/18/2022

Exploitable With

CANVAS (CANVAS)

Reference Information

CVE: CVE-2021-45868, CVE-2022-0850, CVE-2022-0854, CVE-2022-1011, CVE-2022-1016, CVE-2022-1048, CVE-2022-1055, CVE-2022-1195, CVE-2022-1198, CVE-2022-1199, CVE-2022-1205, CVE-2022-27666, CVE-2022-28388, CVE-2022-28389, CVE-2022-28390

SuSE: SUSE-SU-2022:1407-1