SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    SUSE-SU-2021:2409-1
Rating:             important
References:         #1152489 #1182470 #1185486 #1187927 #1187972 
                    #1187980 #1188062 #1188116 
Cross-References:   CVE-2021-22555 CVE-2021-33909
CVSS scores:
                    CVE-2021-22555 (NVD) : 7.8
 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-22555 (SUSE): 7.8
 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2021-33909 (SUSE): 7.8
 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:
                    SUSE Linux Enterprise Module for Public Cloud 15-SP3
______________________________________________________________________________

   An update that solves two vulnerabilities and has 6 fixes
   is now available.

Description:


   The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive
   various security and bugfixes.

   The following security bugs were fixed:

   - CVE-2021-22555: A heap out-of-bounds write affecting Linux since
     v2.6.19-rc1 was discovered in net/netfilter/x_tables.c (bnc#1188116 ).
   - CVE-2021-33909: Fixed an out-of-bounds write in the filesystem layer
     that allows to obtain full root privileges (bsc#1188062).

   The following non-security bugs were fixed:

   - ceph: must hold snap_rwsem when filling inode for async create
     (bsc#1187927).
   - cgroup1: do not allow '\n' in renaming (bsc#1187972).
   - qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
     bsc#1185486).
   - scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
   - usb: dwc3: Fix debugfs creation flow (git-fixes).
   - x86/pkru: Write hardware init value to PKRU when xstate is init
     (bsc#1152489).
   - x86/process: Check PF_KTHREAD and not current->mm for kernel threads
     (bsc#1152489).


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation
 methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Public Cloud 15-SP3:

      zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP3-2021-2409=1



Package List:

   - SUSE Linux Enterprise Module for Public Cloud 15-SP3 (x86_64):

      kernel-azure-5.3.18-38.14.1
      kernel-azure-debuginfo-5.3.18-38.14.1
      kernel-azure-debugsource-5.3.18-38.14.1
      kernel-azure-devel-5.3.18-38.14.1
      kernel-azure-devel-debuginfo-5.3.18-38.14.1
      kernel-syms-azure-5.3.18-38.14.1

   - SUSE Linux Enterprise Module for Public Cloud 15-SP3 (noarch):

      kernel-devel-azure-5.3.18-38.14.1
      kernel-source-azure-5.3.18-38.14.1


References:

   https://www.suse.com/security/cve/CVE-2021-22555.html
   https://www.suse.com/security/cve/CVE-2021-33909.html
   https://bugzilla.suse.com/1152489
   https://bugzilla.suse.com/1182470
   https://bugzilla.suse.com/1185486
   https://bugzilla.suse.com/1187927
   https://bugzilla.suse.com/1187972
   https://bugzilla.suse.com/1187980
   https://bugzilla.suse.com/1188062
   https://bugzilla.suse.com/1188116