Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory (SUSE-SU-2021:0347-1)
Summary:The remote host is missing an update for the 'Linux Kernel' package(s) announced via the SUSE-SU-2021:0347-1 advisory.
The remote host is missing an update for the 'Linux Kernel' package(s) announced via the SUSE-SU-2021:0347-1 advisory.

Vulnerability Insight:
The SUSE Linux Enterprise 15 SP2 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

CVE-2021-3347: A use-after-free was discovered in the PI futexes during
fault handling, allowing local users to execute code in the kernel

CVE-2021-3348: Fixed a use-after-free in nbd_add_socket that could be
triggered by local attackers (with access to the nbd device) via an I/O
request at a certain point during device setup (bnc#1181504).

CVE-2021-20177: Fixed a kernel panic related to iptables string matching
rules. A privileged user could insert a rule which could lead to denial
of service (bnc#1180765).

CVE-2021-0342: In tun_get_user of tun.c, there is possible memory
corruption due to a use after free. This could lead to local escalation
of privilege with System execution privileges required. (bnc#1180812)

CVE-2020-27835: A use-after-free in the infiniband hfi1 driver was
found, specifically in the way user calls Ioctl after open dev file and
fork. A local user could use this flaw to crash the system (bnc#1179878).

CVE-2020-25639: Fixed a NULL pointer dereference via nouveau ioctl

CVE-2020-29569: Fixed a potential privilege escalation and information
leaks related to the PV block backend, as used by Xen (bnc#1179509).

CVE-2020-29568: Fixed a denial of service issue, related to processing
watch events (bnc#1179508).

CVE-2020-25211: Fixed a flaw where a local attacker was able to inject
conntrack netlink configuration that could cause a denial of service or
trigger the use of incorrect protocol numbers in
ctnetlink_parse_tuple_filter (bnc#1176395).

CVE-2020-36158: Fixed an issue wich might have allowed a remote
attacker to execute arbitrary code via a long SSID value in
mwifiex_cmd_802_11_ad_hoc_start() (bnc#1180559).

CVE-2020-28374: Fixed a vulnerability caused by insufficient identifier
checking in the LIO SCSI target code. This could have been used by a
remote attacker to read or write files via directory traversal in an
XCOPY request (bnc#1178372).

The following non-security bugs were fixed:

ACPI/IORT: Do not blindly trust DMA masks from firmware (git-fixes).

ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI

ACPI: scan: Harden acpi_device_add() against device ID overflows

ACPI: scan: Make acpi_bus_get_device() clear return pointer on error

ACPI: sysfs: Prefer 'compatible' modalias (git-fixes).

ALSA: doc: Fix reference to mixart.rst (git-fixes).

ALSA: fireface: Fix integer overflow in transmit_midi_msg() (git-fixes).

ALSA: firewire-tascam: Fix integer overflow in midi_port_work()

ALSA: hda: Add Cometlake-R PCI ID (git-fixes).

ALSA: hda/conexant: add a new hda codec CX11970 (git-fixes).

ALSA: hda/hdmi - enable runtime pm for CI AMD display audio (git-fixes).

ALSA: hda/realtek: Ad... [Please see the references for more information on the vulnerabilities]

Affected Software/OS:
'Linux Kernel' package(s) on SUSE Linux Enterprise Module for Public Cloud 15-SP2

Please install the updated package(s).

CVSS Score:

CVSS Vector:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2021-0342
Common Vulnerability Exposure (CVE) ID: CVE-2021-3347
Debian Security Information: DSA-4843 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2021-3348
CopyrightCopyright (C) 2021 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2021 E-Soft Inc. All rights reserved.