SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2424-1)

high Nessus Plugin ID 163360

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2424-1 advisory.

- Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. (CVE-2021-26341)

- An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

- A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem. (CVE-2022-1012)

- A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

- In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel (CVE-2022-20132)

- In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel (CVE-2022-20154)

- Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-29900)

- Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-29901)

- drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
(CVE-2022-33981)

- An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1065729

https://bugzilla.suse.com/1179195

https://bugzilla.suse.com/1180814

https://bugzilla.suse.com/1184924

https://bugzilla.suse.com/1185762

https://bugzilla.suse.com/1192761

https://bugzilla.suse.com/1193629

https://bugzilla.suse.com/1194013

https://bugzilla.suse.com/1195504

https://bugzilla.suse.com/1195775

https://bugzilla.suse.com/1196901

https://bugzilla.suse.com/1197362

https://bugzilla.suse.com/1197754

https://bugzilla.suse.com/1198020

https://bugzilla.suse.com/1198924

https://bugzilla.suse.com/1199482

https://bugzilla.suse.com/1199487

https://bugzilla.suse.com/1199489

https://bugzilla.suse.com/1199657

https://bugzilla.suse.com/1200217

https://bugzilla.suse.com/1200263

https://bugzilla.suse.com/1200343

https://bugzilla.suse.com/1200442

https://bugzilla.suse.com/1200571

https://bugzilla.suse.com/1200599

https://bugzilla.suse.com/1200600

https://bugzilla.suse.com/1200608

https://bugzilla.suse.com/1200619

https://bugzilla.suse.com/1200622

https://bugzilla.suse.com/1200692

https://bugzilla.suse.com/1200806

https://bugzilla.suse.com/1200807

https://bugzilla.suse.com/1200809

https://bugzilla.suse.com/1200810

https://bugzilla.suse.com/1200813

https://bugzilla.suse.com/1200816

https://bugzilla.suse.com/1200820

https://bugzilla.suse.com/1200821

https://bugzilla.suse.com/1200822

https://bugzilla.suse.com/1200825

https://bugzilla.suse.com/1200828

https://bugzilla.suse.com/1200829

https://bugzilla.suse.com/1200925

https://bugzilla.suse.com/1201050

https://bugzilla.suse.com/1201080

https://bugzilla.suse.com/1201143

https://bugzilla.suse.com/1201147

https://bugzilla.suse.com/1201149

https://bugzilla.suse.com/1201160

https://bugzilla.suse.com/1201171

https://bugzilla.suse.com/1201177

https://bugzilla.suse.com/1201193

https://bugzilla.suse.com/1201222

https://www.suse.com/security/cve/CVE-2021-26341

https://www.suse.com/security/cve/CVE-2021-4157

https://www.suse.com/security/cve/CVE-2022-1012

https://www.suse.com/security/cve/CVE-2022-1679

https://www.suse.com/security/cve/CVE-2022-20132

https://www.suse.com/security/cve/CVE-2022-20154

https://www.suse.com/security/cve/CVE-2022-29900

https://www.suse.com/security/cve/CVE-2022-29901

https://www.suse.com/security/cve/CVE-2022-33981

https://www.suse.com/security/cve/CVE-2022-34918

http://www.nessus.org/u?3cd02af7

Plugin Details

Severity: High

ID: 163360

File Name: suse_SU-2022-2424-1.nasl

Version: 1.10

Type: local

Agent: unix

Published: 7/21/2022

Updated: 7/13/2023

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.7

CVSS v2

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS2#AV:A/AC:M/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2021-4157

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2022-1012

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:cluster-md-kmp-rt, p-cpe:/a:novell:suse_linux:dlm-kmp-rt, p-cpe:/a:novell:suse_linux:gfs2-kmp-rt, p-cpe:/a:novell:suse_linux:kernel-devel-rt, p-cpe:/a:novell:suse_linux:kernel-rt, p-cpe:/a:novell:suse_linux:kernel-rt-devel, p-cpe:/a:novell:suse_linux:kernel-rt_debug-devel, p-cpe:/a:novell:suse_linux:kernel-source-rt, p-cpe:/a:novell:suse_linux:kernel-syms-rt, p-cpe:/a:novell:suse_linux:ocfs2-kmp-rt, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/18/2022

Vulnerability Publication Date: 3/11/2022

Exploitable With

Core Impact

Metasploit (Netfilter nft_set_elem_init Heap Overflow Privilege Escalation)

Reference Information

CVE: CVE-2021-26341, CVE-2021-4157, CVE-2022-1012, CVE-2022-1679, CVE-2022-20132, CVE-2022-20154, CVE-2022-29900, CVE-2022-29901, CVE-2022-33981, CVE-2022-34918

SuSE: SUSE-SU-2022:2424-1