Bugzilla – Bug 1193842
VUL-0: CVE-2021-4154: kernel: security issue in cgroups
Last modified: 2022-10-27 14:49:17 UTC
seems untracked so far. can you check +++ This bug was initially created as a clone of Bug #1193839 +++ Kernels containing commit https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8d2451f4994f but not commit https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0462726e7ef281c35a7a4ae33e93ee2bc9975b are affected by a local privilege escalation in the Linux kernel by exploiting the fsconfig syscall parameter. The effect is a container breakout in kubernetes. A researcher has already made this public (https://twitter.com/Markak_/status/1470599501522030593). We *think* that the SLES kernels are already patched. However, we would like to verify with you.
The buggy commit is 8d2451f4994f ("cgroup1: switch to option-by-option parsing") v5.1-rc1~12^2~15, i.e. SLE15-SP2 (and derivatives) would be affected, it's not backported earlier. SLE15-SP4 has the fix commit 3b0462726e7e + cleanups from upstream already. The fixing commit was submitted into SLE15-SP2 (and eventually into derivatives) as a git-fix back then in bug 1190131. As far as the fsconfig source parameter is concerned this is patched in SLES.
From the report that I can see the vulnerability relies on UAF because of mis-parsing fs_context's "source" parameter. The fs_context API was added in > 9bc61ab18b1d ("vfs: Introduce fs_context, switch vfs_kern_mount() to it.") v5.1-rc1~12^2~38 I checked that: - our pre-v5.1 branches don't have this fs_context stuff, - v5.3 based branches have the patches backported already, - v5.14 branches have it directly from upstream, - (cursory look at other filesytems in SLE15-SP3 and only cgroup v1 seems to have fallen for this fs_context abuse). Therefore no new backports are necessary. Resetting the assignee per process.
Closing since SLE15-SP{2, 3, 4} are already fixed, and the other branches are not affected.
I cannot see the CVE reference (at least) in SLE15-SP3 log. Was it forgotten or am I missing something? People asked why there is a live patch available but no kernel patch.
can you add the CVE to the metadata of the patch?
I've pushed the metadata update via cve/linux-5.3. The fix in released affected kernels was tracked only as bug 1190131 (before CVE assignment). Resetting assignee (to close this bug?).
SUSE-SU-2022:1669-1: An update that solves 16 vulnerabilities, contains 6 features and has 29 fixes is now available. Category: security (important) Bug References: 1028340,1071995,1137728,1152472,1152489,1177028,1179878,1182073,1183723,1187055,1191647,1193556,1193842,1194625,1195651,1195926,1196018,1196114,1196367,1196514,1196639,1196942,1197157,1197391,1197656,1197660,1197677,1197914,1197926,1198077,1198217,1198330,1198400,1198413,1198437,1198448,1198484,1198515,1198516,1198534,1198742,1198825,1198989,1199012,1199024 CVE References: CVE-2020-27835,CVE-2021-0707,CVE-2021-20292,CVE-2021-20321,CVE-2021-38208,CVE-2021-4154,CVE-2022-0812,CVE-2022-1158,CVE-2022-1280,CVE-2022-1353,CVE-2022-1419,CVE-2022-1516,CVE-2022-28356,CVE-2022-28748,CVE-2022-28893,CVE-2022-29156 JIRA References: SLE-13208,SLE-13513,SLE-15172,SLE-15175,SLE-18234,SLE-8449 Sources used: SUSE Linux Enterprise Realtime Extension 15-SP3 (src): release-notes-sle_rt-15.3.20220422-150300.3.3.2 SUSE Linux Enterprise Module for Realtime 15-SP3 (src): kernel-rt-5.3.18-150300.88.2, kernel-rt_debug-5.3.18-150300.88.2, kernel-source-rt-5.3.18-150300.88.2, kernel-syms-rt-5.3.18-150300.88.1, release-notes-sle_rt-15.3.20220422-150300.3.3.2 SUSE Linux Enterprise Micro 5.2 (src): kernel-rt-5.3.18-150300.88.2 SUSE Linux Enterprise Micro 5.1 (src): kernel-rt-5.3.18-150300.88.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1676-1: An update that solves 16 vulnerabilities, contains 6 features and has 25 fixes is now available. Category: security (important) Bug References: 1028340,1065729,1071995,1121726,1137728,1152489,1177028,1179878,1182073,1183723,1187055,1191647,1193556,1193842,1195926,1196018,1196114,1196367,1196514,1196639,1196942,1197157,1197391,1197656,1197660,1197914,1197926,1198217,1198330,1198400,1198413,1198437,1198448,1198484,1198515,1198516,1198660,1198742,1198825,1199012,1199024 CVE References: CVE-2020-27835,CVE-2021-0707,CVE-2021-20292,CVE-2021-20321,CVE-2021-38208,CVE-2021-4154,CVE-2022-0812,CVE-2022-1158,CVE-2022-1280,CVE-2022-1353,CVE-2022-1419,CVE-2022-1516,CVE-2022-28356,CVE-2022-28748,CVE-2022-28893,CVE-2022-29156 JIRA References: SLE-13208,SLE-13513,SLE-15172,SLE-15175,SLE-15176,SLE-8449 Sources used: openSUSE Leap 15.3 (src): kernel-azure-5.3.18-150300.38.56.1, kernel-source-azure-5.3.18-150300.38.56.1, kernel-syms-azure-5.3.18-150300.38.56.1 SUSE Linux Enterprise Module for Public Cloud 15-SP3 (src): kernel-azure-5.3.18-150300.38.56.1, kernel-source-azure-5.3.18-150300.38.56.1, kernel-syms-azure-5.3.18-150300.38.56.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1687-1: An update that solves 16 vulnerabilities, contains 6 features and has 29 fixes is now available. Category: security (important) Bug References: 1028340,1071995,1137728,1152472,1152489,1177028,1179878,1182073,1183723,1187055,1191647,1193556,1193842,1194625,1195651,1195926,1196018,1196114,1196367,1196514,1196639,1196942,1197157,1197391,1197656,1197660,1197677,1197914,1197926,1198077,1198217,1198330,1198400,1198413,1198437,1198448,1198484,1198515,1198516,1198534,1198742,1198825,1198989,1199012,1199024 CVE References: CVE-2020-27835,CVE-2021-0707,CVE-2021-20292,CVE-2021-20321,CVE-2021-38208,CVE-2021-4154,CVE-2022-0812,CVE-2022-1158,CVE-2022-1280,CVE-2022-1353,CVE-2022-1419,CVE-2022-1516,CVE-2022-28356,CVE-2022-28748,CVE-2022-28893,CVE-2022-29156 JIRA References: SLE-13208,SLE-13513,SLE-15172,SLE-15175,SLE-18234,SLE-8449 Sources used: openSUSE Leap 15.4 (src): dtb-aarch64-5.3.18-150300.59.68.1, kernel-preempt-5.3.18-150300.59.68.1 openSUSE Leap 15.3 (src): dtb-aarch64-5.3.18-150300.59.68.1, kernel-64kb-5.3.18-150300.59.68.1, kernel-debug-5.3.18-150300.59.68.1, kernel-default-5.3.18-150300.59.68.1, kernel-default-base-5.3.18-150300.59.68.1.150300.18.41.3, kernel-docs-5.3.18-150300.59.68.1, kernel-kvmsmall-5.3.18-150300.59.68.1, kernel-obs-build-5.3.18-150300.59.68.1, kernel-obs-qa-5.3.18-150300.59.68.1, kernel-preempt-5.3.18-150300.59.68.1, kernel-source-5.3.18-150300.59.68.1, kernel-syms-5.3.18-150300.59.68.1, kernel-zfcpdump-5.3.18-150300.59.68.1 SUSE Linux Enterprise Workstation Extension 15-SP3 (src): kernel-default-5.3.18-150300.59.68.1, kernel-preempt-5.3.18-150300.59.68.1 SUSE Linux Enterprise Module for Live Patching 15-SP3 (src): kernel-default-5.3.18-150300.59.68.1, kernel-livepatch-SLE15-SP3_Update_18-1-150300.7.5.1 SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src): kernel-default-5.3.18-150300.59.68.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): kernel-docs-5.3.18-150300.59.68.1, kernel-obs-build-5.3.18-150300.59.68.1, kernel-preempt-5.3.18-150300.59.68.1, kernel-source-5.3.18-150300.59.68.1, kernel-syms-5.3.18-150300.59.68.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): kernel-64kb-5.3.18-150300.59.68.1, kernel-default-5.3.18-150300.59.68.1, kernel-default-base-5.3.18-150300.59.68.1.150300.18.41.3, kernel-preempt-5.3.18-150300.59.68.1, kernel-source-5.3.18-150300.59.68.1, kernel-zfcpdump-5.3.18-150300.59.68.1 SUSE Linux Enterprise Micro 5.2 (src): kernel-default-5.3.18-150300.59.68.1, kernel-default-base-5.3.18-150300.59.68.1.150300.18.41.3 SUSE Linux Enterprise Micro 5.1 (src): kernel-default-5.3.18-150300.59.68.1, kernel-default-base-5.3.18-150300.59.68.1.150300.18.41.3 SUSE Linux Enterprise High Availability 15-SP3 (src): kernel-default-5.3.18-150300.59.68.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Done.