Bug 1221545 (CVE-2021-47131) - VUL-0: CVE-2021-47131: kernel: net/tls: use-after-free after the TLS device goes down and up
Summary: VUL-0: CVE-2021-47131: kernel: net/tls: use-after-free after the TLS device g...
Status: IN_PROGRESS
Alias: CVE-2021-47131
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P1 - Urgent : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/397865/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-47131:7.8:(AV:...
Keywords:
Depends on:
Blocks: 1222402
  Show dependency tree / graph
 
Reported: 2024-03-18 08:18 UTC by SMASH SMASH
Modified: 2024-06-24 20:30 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-03-18 08:18:20 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net/tls: Fix use-after-free after the TLS device goes down and up

When a netdev with active TLS offload goes down, tls_device_down is
called to stop the offload and tear down the TLS context. However, the
socket stays alive, and it still points to the TLS context, which is now
deallocated. If a netdev goes up, while the connection is still active,
and the data flow resumes after a number of TCP retransmissions, it will
lead to a use-after-free of the TLS context.

This commit addresses this bug by keeping the context alive until its
normal destruction, and implements the necessary fallbacks, so that the
connection can resume in software (non-offloaded) kTLS mode.

On the TX side tls_sw_fallback is used to encrypt all packets. The RX
side already has all the necessary fallbacks, because receiving
non-decrypted packets is supported. The thing needed on the RX side is
to block resync requests, which are normally produced after receiving
non-decrypted packets.

The necessary synchronization is implemented for a graceful teardown:
first the fallbacks are deployed, then the driver resources are released
(it used to be possible to have a tls_dev_resync after tls_dev_del).

A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback
mode. It's used to skip the RX resync logic completely, as it becomes
useless, and some objects may be released (for example, resync_async,
which is allocated and freed by the driver).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47131
https://www.cve.org/CVERecord?id=CVE-2021-47131
https://git.kernel.org/stable/c/0f1e6fe66977a864fe850522316f713d7b926fd9
https://git.kernel.org/stable/c/c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4
https://git.kernel.org/stable/c/f1d4184f128dede82a59a841658ed40d4e6d3aa2
https://bugzilla.redhat.com/show_bug.cgi?id=2269820
Comment 1 Carlos López 2024-03-18 08:24:15 UTC 
Affects cve/linux-5.3, SLE15-SP1-LTSS and SLE12-SP5 (the parent cve/linux-4.12 branch doesn't have CONFIG_TLS_DEVICE nor the bug though). cve/linux-5.14 and newer are already fixed. cve/linux-4.4 and older are already fixed.
Comment 2 Carlos López 2024-03-18 08:24:51 UTC 
This was fixed over a year ago (2021-06-01) so no livepatches are needed.
Comment 3 Joey Lee 2024-03-20 07:48:15 UTC 
commit c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4    [v5.13-rc5]
Author: Maxim Mikityanskiy <maximmi@nvidia.com>
Date:   Tue Jun 1 15:08:00 2021 +0300

    net/tls: Fix use-after-free after the TLS device goes down and up

    Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
    Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
    Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
Comment 4 Joey Lee 2024-03-20 08:05:38 UTC 
The result from check-kernel-fix script:

ACTION NEEDED!
SLE12-SP5: MANUAL: backport c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4 bsc#1221545
cve/linux-5.3: MANUAL: backport c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4 bsc#1221545
Comment 5 Joey Lee 2024-03-20 08:14:12 UTC 
commit c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4    [v5.13-rc5]
Author: Maxim Mikityanskiy <maximmi@nvidia.com>
Date:   Tue Jun 1 15:08:00 2021 +0300

    net/tls: Fix use-after-free after the TLS device goes down and up

    Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")    [v4.18-rc1]
    Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
    Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
Comment 6 Joey Lee 2024-03-20 08:21:47 UTC 
(In reply to Joey Lee from comment #4)
> The result from check-kernel-fix script:
> 
> ACTION NEEDED!
> SLE12-SP5: MANUAL: backport c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4
> bsc#1221545
> cve/linux-5.3: MANUAL: backport c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4
> bsc#1221545

The above result does not include reactive support branches SLE15-SP1-LTSS.
Comment 7 Joey Lee 2024-03-20 09:10:11 UTC 
(In reply to Joey Lee from comment #6)
> (In reply to Joey Lee from comment #4)
> > The result from check-kernel-fix script:
> > 
> > ACTION NEEDED!
> > SLE12-SP5: MANUAL: backport c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4
> > bsc#1221545
> > cve/linux-5.3: MANUAL: backport c55dcdd435aa6c6ad6ccac0a4c636d010ee367a4
> > bsc#1221545
> 
> The above result does not include reactive support branches SLE15-SP1-LTSS.

The SLE15-SP1-LTSS is end of life:

https://confluence.suse.com/pages/viewpage.action?spaceKey=maintenancesecurity&title=Kernel+Scheduling
Comment 9 Joey Lee 2024-03-26 07:00:47 UTC 
Hi Michal,

Because this issue is for net/tls. Could you please help to handle it?

If this is not in your area, just reset bug assigner to kernel-bugs@suse.de. Kernel Security Sentinel will find other expert.

Thanks a lot!
Comment 11 Michal Kubeček 2024-04-18 09:08:15 UTC 
This will be a bit tricky. The patch uses bit 0 for TLS_RX_DEV_DEGRADED
flag it introduces but this is already used by TLS_RX_SYNC_RUNNING which
was removed in 5.13-rc5. Thankfully, these flags seem to be internal for
kernel so that we can simply use e.g. bit 2.

Worse part is adding a pointer into kabi protected struct tls_context.
There used to be some holes but in 5.13-rc1, the structure was reorganized
to better split the members in to cachelines - but no explicit cacheline
alignment was introduced. And a second motivation for the layout update
was to save some space so that now the structure is much tighter and there
do not seem to be any holes big enough for a pointer. :-( The 4.12 backport
should be easier, though, that was before the layout was reshuffled.
Comment 13 Michal Kubeček 2024-05-07 10:02:49 UTC 
introduced              e8f69799810c    4.18-rc1
fixed                   c55dcdd435aa    5.13-rc5

The offending commit has been also backported into SLE15-SP1-LTSS and
SLE12-SP5 (the former is out of support).

cve/linux-5.3-LTSS      aca4b2e5fb01
SLE12-SP5               58c1b254935f

The fix has been submitted to all affected branches. Reassigning back to
security team.
Comment 19 Maintenance Automation 2024-05-14 16:31:40 UTC 
SUSE-SU-2024:1645-1: An update that solves 41 vulnerabilities and has 12 security fixes can now be installed.

Category: security (important)
Bug References: 1190576, 1192145, 1200313, 1201489, 1203906, 1203935, 1204614, 1211592, 1218562, 1218917, 1219169, 1219170, 1219264, 1220513, 1220755, 1220854, 1221113, 1221299, 1221543, 1221545, 1222449, 1222482, 1222503, 1222559, 1222624, 1222666, 1222709, 1222790, 1222792, 1222829, 1222876, 1222881, 1222883, 1222894, 1222976, 1223016, 1223057, 1223111, 1223187, 1223202, 1223475, 1223482, 1223509, 1223513, 1223522, 1223824, 1223921, 1223923, 1223931, 1223941, 1223948, 1223952, 1223963
CVE References: CVE-2021-46955, CVE-2021-47041, CVE-2021-47074, CVE-2021-47113, CVE-2021-47131, CVE-2021-47184, CVE-2021-47194, CVE-2021-47198, CVE-2021-47201, CVE-2021-47203, CVE-2021-47206, CVE-2021-47207, CVE-2021-47212, CVE-2021-47216, CVE-2022-48631, CVE-2022-48638, CVE-2022-48650, CVE-2022-48651, CVE-2022-48654, CVE-2022-48672, CVE-2022-48686, CVE-2022-48687, CVE-2022-48693, CVE-2022-48695, CVE-2022-48701, CVE-2022-48702, CVE-2024-0639, CVE-2024-23307, CVE-2024-26610, CVE-2024-26688, CVE-2024-26689, CVE-2024-26739, CVE-2024-26744, CVE-2024-26816, CVE-2024-26840, CVE-2024-26852, CVE-2024-26862, CVE-2024-26898, CVE-2024-26903, CVE-2024-26906, CVE-2024-27043
Maintenance Incident: [SUSE:Maintenance:33806](https://smelt.suse.de/incident/33806/)
Sources used:
SUSE Linux Enterprise Micro 5.1 (src):
 kernel-source-rt-5.3.18-150300.169.1
SUSE Linux Enterprise Micro 5.2 (src):
 kernel-source-rt-5.3.18-150300.169.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src):
 kernel-source-rt-5.3.18-150300.169.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 20 Maintenance Automation 2024-05-14 16:32:49 UTC 
SUSE-SU-2024:1643-1: An update that solves 201 vulnerabilities, contains one feature and has 22 security fixes can now be installed.

Category: security (important)
Bug References: 1084332, 1141539, 1184509, 1186060, 1190317, 1190576, 1192145, 1194516, 1197894, 1203935, 1209657, 1211592, 1212514, 1213456, 1215221, 1217339, 1217987, 1217988, 1217989, 1218220, 1218336, 1218479, 1218562, 1218917, 1219104, 1219169, 1219170, 1219618, 1219623, 1219847, 1220320, 1220366, 1220394, 1220411, 1220413, 1220416, 1220418, 1220442, 1220445, 1220513, 1220521, 1220528, 1220536, 1220538, 1220554, 1220572, 1220580, 1220611, 1220625, 1220628, 1220637, 1220640, 1220662, 1220687, 1220692, 1220703, 1220706, 1220739, 1220742, 1220743, 1220745, 1220751, 1220768, 1220769, 1220777, 1220790, 1220794, 1220829, 1220836, 1220843, 1220846, 1220850, 1220871, 1220927, 1220960, 1220985, 1220987, 1221044, 1221046, 1221048, 1221058, 1221060, 1221061, 1221077, 1221082, 1221088, 1221162, 1221277, 1221293, 1221337, 1221532, 1221541, 1221543, 1221545, 1221548, 1221575, 1221605, 1221608, 1221617, 1221791, 1221816, 1221825, 1221830, 1221862, 1221934, 1221949, 1221952, 1221953, 1221965, 1221966, 1221967, 1221969, 1221972, 1221973, 1221977, 1221979, 1221988, 1221991, 1221993, 1221994, 1221997, 1221998, 1221999, 1222000, 1222001, 1222002, 1222117, 1222294, 1222300, 1222357, 1222379, 1222422, 1222428, 1222449, 1222503, 1222559, 1222585, 1222609, 1222610, 1222613, 1222618, 1222619, 1222624, 1222630, 1222632, 1222660, 1222662, 1222664, 1222666, 1222669, 1222671, 1222677, 1222706, 1222720, 1222765, 1222770, 1222772, 1222787, 1222790, 1222793, 1222812, 1222836, 1222869, 1222876, 1222878, 1222881, 1222883, 1222888, 1222952, 1222961, 1222975, 1222976, 1223016, 1223035, 1223049, 1223051, 1223057, 1223058, 1223060, 1223119, 1223187, 1223189, 1223198, 1223203, 1223315, 1223432, 1223509, 1223512, 1223513, 1223516, 1223518, 1223539, 1223540, 1223626, 1223627, 1223664, 1223686, 1223693, 1223712, 1223715, 1223735, 1223744, 1223745, 1223770, 1223781, 1223802, 1223819, 1223824, 1223827, 1223837, 1223842, 1223843, 1223844, 1223883, 1223885, 1223921, 1223923, 1223931, 1223941, 1223952, 1223953, 1223954, 1223969
CVE References: CVE-2019-25160, CVE-2020-36312, CVE-2021-23134, CVE-2021-46904, CVE-2021-46905, CVE-2021-46909, CVE-2021-46938, CVE-2021-46939, CVE-2021-46941, CVE-2021-46950, CVE-2021-46955, CVE-2021-46958, CVE-2021-46960, CVE-2021-46963, CVE-2021-46964, CVE-2021-46966, CVE-2021-46981, CVE-2021-46988, CVE-2021-46990, CVE-2021-46998, CVE-2021-47006, CVE-2021-47015, CVE-2021-47024, CVE-2021-47034, CVE-2021-47045, CVE-2021-47049, CVE-2021-47055, CVE-2021-47056, CVE-2021-47060, CVE-2021-47061, CVE-2021-47063, CVE-2021-47068, CVE-2021-47070, CVE-2021-47071, CVE-2021-47073, CVE-2021-47100, CVE-2021-47101, CVE-2021-47104, CVE-2021-47110, CVE-2021-47112, CVE-2021-47113, CVE-2021-47114, CVE-2021-47117, CVE-2021-47118, CVE-2021-47119, CVE-2021-47131, CVE-2021-47138, CVE-2021-47141, CVE-2021-47142, CVE-2021-47143, CVE-2021-47146, CVE-2021-47149, CVE-2021-47150, CVE-2021-47153, CVE-2021-47159, CVE-2021-47161, CVE-2021-47162, CVE-2021-47165, CVE-2021-47166, CVE-2021-47167, CVE-2021-47168, CVE-2021-47169, CVE-2021-47171, CVE-2021-47173, CVE-2021-47177, CVE-2021-47179, CVE-2021-47180, CVE-2021-47181, CVE-2021-47182, CVE-2021-47183, CVE-2021-47184, CVE-2021-47185, CVE-2021-47188, CVE-2021-47189, CVE-2021-47198, CVE-2021-47202, CVE-2021-47203, CVE-2021-47204, CVE-2021-47205, CVE-2021-47207, CVE-2021-47211, CVE-2021-47216, CVE-2021-47217, CVE-2022-0487, CVE-2022-48619, CVE-2022-48626, CVE-2022-48636, CVE-2022-48650, CVE-2022-48651, CVE-2022-48667, CVE-2022-48668, CVE-2022-48672, CVE-2022-48687, CVE-2022-48688, CVE-2022-48695, CVE-2022-48701, CVE-2022-48702, CVE-2023-0160, CVE-2023-28746, CVE-2023-35827, CVE-2023-4881, CVE-2023-52454, CVE-2023-52469, CVE-2023-52470, CVE-2023-52474, CVE-2023-52476, CVE-2023-52477, CVE-2023-52486, CVE-2023-52488, CVE-2023-52509, CVE-2023-52515, CVE-2023-52524, CVE-2023-52528, CVE-2023-52575, CVE-2023-52583, CVE-2023-52587, CVE-2023-52590, CVE-2023-52591, CVE-2023-52595, CVE-2023-52598, CVE-2023-52607, CVE-2023-52614, CVE-2023-52620, CVE-2023-52628, CVE-2023-52635, CVE-2023-52639, CVE-2023-52644, CVE-2023-52646, CVE-2023-52650, CVE-2023-52652, CVE-2023-52653, CVE-2023-6270, CVE-2023-6356, CVE-2023-6535, CVE-2023-6536, CVE-2023-7042, CVE-2023-7192, CVE-2024-0639, CVE-2024-2201, CVE-2024-22099, CVE-2024-23307, CVE-2024-23848, CVE-2024-24855, CVE-2024-24861, CVE-2024-26614, CVE-2024-26642, CVE-2024-26651, CVE-2024-26671, CVE-2024-26675, CVE-2024-26689, CVE-2024-26704, CVE-2024-26733, CVE-2024-26739, CVE-2024-26743, CVE-2024-26744, CVE-2024-26747, CVE-2024-26754, CVE-2024-26763, CVE-2024-26771, CVE-2024-26772, CVE-2024-26773, CVE-2024-26777, CVE-2024-26778, CVE-2024-26779, CVE-2024-26791, CVE-2024-26793, CVE-2024-26805, CVE-2024-26816, CVE-2024-26817, CVE-2024-26839, CVE-2024-26840, CVE-2024-26852, CVE-2024-26855, CVE-2024-26857, CVE-2024-26859, CVE-2024-26876, CVE-2024-26878, CVE-2024-26883, CVE-2024-26884, CVE-2024-26898, CVE-2024-26901, CVE-2024-26903, CVE-2024-26907, CVE-2024-26922, CVE-2024-26929, CVE-2024-26930, CVE-2024-26931, CVE-2024-26948, CVE-2024-26993, CVE-2024-27008, CVE-2024-27013, CVE-2024-27014, CVE-2024-27043, CVE-2024-27046, CVE-2024-27054, CVE-2024-27072, CVE-2024-27073, CVE-2024-27074, CVE-2024-27075, CVE-2024-27078, CVE-2024-27388
Jira References: PED-5759
Maintenance Incident: [SUSE:Maintenance:33343](https://smelt.suse.de/incident/33343/)
Sources used:
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 kernel-syms-azure-4.12.14-16.182.1, kernel-source-azure-4.12.14-16.182.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 kernel-syms-azure-4.12.14-16.182.1, kernel-source-azure-4.12.14-16.182.1
SUSE Linux Enterprise Server 12 SP5 (src):
 kernel-syms-azure-4.12.14-16.182.1, kernel-source-azure-4.12.14-16.182.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 21 Maintenance Automation 2024-05-14 16:33:12 UTC 
SUSE-SU-2024:1642-1: An update that solves 48 vulnerabilities and has eight security fixes can now be installed.

Category: security (important)
Bug References: 1190576, 1192145, 1200313, 1201489, 1203906, 1203935, 1204614, 1211592, 1218562, 1218917, 1219169, 1219170, 1219264, 1220513, 1220755, 1220854, 1221113, 1221299, 1221543, 1221545, 1222449, 1222482, 1222503, 1222559, 1222585, 1222624, 1222666, 1222669, 1222709, 1222790, 1222792, 1222829, 1222876, 1222878, 1222881, 1222883, 1222894, 1222976, 1223016, 1223057, 1223111, 1223187, 1223202, 1223475, 1223482, 1223509, 1223513, 1223522, 1223824, 1223921, 1223923, 1223931, 1223941, 1223948, 1223952, 1223963
CVE References: CVE-2021-46955, CVE-2021-47041, CVE-2021-47074, CVE-2021-47113, CVE-2021-47131, CVE-2021-47184, CVE-2021-47185, CVE-2021-47194, CVE-2021-47198, CVE-2021-47201, CVE-2021-47202, CVE-2021-47203, CVE-2021-47206, CVE-2021-47207, CVE-2021-47212, CVE-2021-47216, CVE-2022-48631, CVE-2022-48638, CVE-2022-48650, CVE-2022-48651, CVE-2022-48654, CVE-2022-48672, CVE-2022-48686, CVE-2022-48687, CVE-2022-48693, CVE-2022-48695, CVE-2022-48701, CVE-2022-48702, CVE-2023-2860, CVE-2023-6270, CVE-2024-0639, CVE-2024-0841, CVE-2024-22099, CVE-2024-23307, CVE-2024-26610, CVE-2024-26688, CVE-2024-26689, CVE-2024-26733, CVE-2024-26739, CVE-2024-26744, CVE-2024-26816, CVE-2024-26840, CVE-2024-26852, CVE-2024-26862, CVE-2024-26898, CVE-2024-26903, CVE-2024-26906, CVE-2024-27043
Maintenance Incident: [SUSE:Maintenance:33776](https://smelt.suse.de/incident/33776/)
Sources used:
openSUSE Leap 15.3 (src):
 kernel-livepatch-SLE15-SP3_Update_44-1-150300.7.3.1, kernel-obs-qa-5.3.18-150300.59.161.1, kernel-default-base-5.3.18-150300.59.161.1.150300.18.94.1, kernel-syms-5.3.18-150300.59.161.1, kernel-obs-build-5.3.18-150300.59.161.1, kernel-source-5.3.18-150300.59.161.1
SUSE Linux Enterprise Live Patching 15-SP3 (src):
 kernel-livepatch-SLE15-SP3_Update_44-1-150300.7.3.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 kernel-default-base-5.3.18-150300.59.161.1.150300.18.94.1, kernel-syms-5.3.18-150300.59.161.1, kernel-obs-build-5.3.18-150300.59.161.1, kernel-source-5.3.18-150300.59.161.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 kernel-default-base-5.3.18-150300.59.161.1.150300.18.94.1, kernel-syms-5.3.18-150300.59.161.1, kernel-obs-build-5.3.18-150300.59.161.1, kernel-source-5.3.18-150300.59.161.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 kernel-default-base-5.3.18-150300.59.161.1.150300.18.94.1, kernel-syms-5.3.18-150300.59.161.1, kernel-obs-build-5.3.18-150300.59.161.1, kernel-source-5.3.18-150300.59.161.1
SUSE Enterprise Storage 7.1 (src):
 kernel-default-base-5.3.18-150300.59.161.1.150300.18.94.1, kernel-syms-5.3.18-150300.59.161.1, kernel-obs-build-5.3.18-150300.59.161.1, kernel-source-5.3.18-150300.59.161.1
SUSE Linux Enterprise Micro 5.1 (src):
 kernel-default-base-5.3.18-150300.59.161.1.150300.18.94.1
SUSE Linux Enterprise Micro 5.2 (src):
 kernel-default-base-5.3.18-150300.59.161.1.150300.18.94.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src):
 kernel-default-base-5.3.18-150300.59.161.1.150300.18.94.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 22 Maintenance Automation 2024-05-15 08:30:04 UTC 
SUSE-SU-2024:1650-1: An update that solves 37 vulnerabilities and has three security fixes can now be installed.

Category: security (important)
Bug References: 1190576, 1192145, 1204614, 1211592, 1218562, 1218917, 1219169, 1219170, 1219264, 1220513, 1220755, 1220854, 1221543, 1221545, 1222449, 1222482, 1222503, 1222559, 1222585, 1222624, 1222666, 1222669, 1222709, 1222790, 1222792, 1222829, 1222881, 1222883, 1222894, 1222976, 1223016, 1223057, 1223111, 1223187, 1223202, 1223475, 1223482, 1223513, 1223824, 1223952
CVE References: CVE-2021-46955, CVE-2021-47041, CVE-2021-47074, CVE-2021-47113, CVE-2021-47131, CVE-2021-47184, CVE-2021-47185, CVE-2021-47194, CVE-2021-47198, CVE-2021-47201, CVE-2021-47203, CVE-2021-47206, CVE-2021-47207, CVE-2021-47212, CVE-2022-48631, CVE-2022-48651, CVE-2022-48654, CVE-2022-48687, CVE-2023-2860, CVE-2023-6270, CVE-2024-0639, CVE-2024-0841, CVE-2024-22099, CVE-2024-23307, CVE-2024-26688, CVE-2024-26689, CVE-2024-26733, CVE-2024-26739, CVE-2024-26744, CVE-2024-26816, CVE-2024-26840, CVE-2024-26852, CVE-2024-26862, CVE-2024-26898, CVE-2024-26903, CVE-2024-26906, CVE-2024-27043
Maintenance Incident: [SUSE:Maintenance:33791](https://smelt.suse.de/incident/33791/)
Sources used:
SUSE Linux Enterprise Live Patching 15-SP2 (src):
 kernel-livepatch-SLE15-SP2_Update_48-1-150200.5.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 kernel-syms-5.3.18-150200.24.191.1, kernel-default-base-5.3.18-150200.24.191.1.150200.9.97.1, kernel-source-5.3.18-150200.24.191.1, kernel-obs-build-5.3.18-150200.24.191.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 kernel-syms-5.3.18-150200.24.191.1, kernel-default-base-5.3.18-150200.24.191.1.150200.9.97.1, kernel-source-5.3.18-150200.24.191.1, kernel-obs-build-5.3.18-150200.24.191.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 kernel-syms-5.3.18-150200.24.191.1, kernel-default-base-5.3.18-150200.24.191.1.150200.9.97.1, kernel-source-5.3.18-150200.24.191.1, kernel-obs-build-5.3.18-150200.24.191.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 28 Maintenance Automation 2024-06-11 12:30:32 UTC 
SUSE-SU-2024:1983-1: An update that solves 199 vulnerabilities and has 26 security fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1101816, 1141539, 1181674, 1185902, 1187716, 1188616, 1190317, 1190795, 1191452, 1194591, 1197760, 1197894, 1203935, 1206213, 1206646, 1207186, 1209657, 1210335, 1215702, 1216702, 1217169, 1217519, 1218917, 1220487, 1220513, 1220854, 1220928, 1221044, 1221081, 1221086, 1221543, 1221545, 1221816, 1221977, 1221994, 1222559, 1222619, 1222627, 1222667, 1222671, 1222793, 1222893, 1222894, 1223023, 1223046, 1223048, 1223084, 1223119, 1223138, 1223207, 1223360, 1223384, 1223432, 1223509, 1223512, 1223539, 1223540, 1223626, 1223627, 1223633, 1223653, 1223666, 1223671, 1223712, 1223715, 1223738, 1223744, 1223752, 1223802, 1223819, 1223834, 1223922, 1223923, 1223931, 1223932, 1223948, 1223969, 1224096, 1224174, 1224181, 1224347, 1224482, 1224511, 1224525, 1224566, 1224580, 1224592, 1224601, 1224607, 1224621, 1224644, 1224645, 1224648, 1224650, 1224663, 1224671, 1224676, 1224680, 1224682, 1224725, 1224728, 1224733, 1224738, 1224747, 1224749, 1224759, 1224803, 1224827, 1224830, 1224831, 1224834, 1224838, 1224841, 1224844, 1224846, 1224847, 1224849, 1224854, 1224859, 1224867, 1224880, 1224882, 1224888, 1224889, 1224892, 1224893, 1224899, 1224904, 1224907, 1224916, 1224917, 1224922, 1224926, 1224930, 1224931, 1224942, 1224954, 1224956, 1224957, 1224959, 1224960, 1224961, 1224963, 1224966, 1224968, 1224981, 1224982, 1224983, 1224987, 1224990, 1224996, 1225008, 1225009, 1225010, 1225022, 1225026, 1225030, 1225054, 1225058, 1225059, 1225060, 1225062, 1225082, 1225084, 1225086, 1225092, 1225096, 1225112, 1225124, 1225128, 1225132, 1225141, 1225143, 1225144, 1225151, 1225153, 1225155, 1225157, 1225164, 1225177, 1225189, 1225192, 1225193, 1225198, 1225201, 1225207, 1225208, 1225222, 1225230, 1225242, 1225244, 1225247, 1225251, 1225252, 1225256, 1225303, 1225318, 1225322, 1225329, 1225330, 1225336, 1225347, 1225351, 1225354, 1225355, 1225360, 1225366, 1225367, 1225384, 1225390, 1225404, 1225409, 1225411, 1225438, 1225453, 1225479, 1225482, 1225506, 1225549, 1225560, 1225572, 1225640, 1225708, 1225764
CVE References: CVE-2021-46933, CVE-2021-46955, CVE-2021-47074, CVE-2021-47113, CVE-2021-47131, CVE-2021-47162, CVE-2021-47171, CVE-2021-47188, CVE-2021-47206, CVE-2021-47220, CVE-2021-47229, CVE-2021-47231, CVE-2021-47235, CVE-2021-47236, CVE-2021-47237, CVE-2021-47238, CVE-2021-47239, CVE-2021-47245, CVE-2021-47246, CVE-2021-47248, CVE-2021-47249, CVE-2021-47250, CVE-2021-47252, CVE-2021-47254, CVE-2021-47258, CVE-2021-47260, CVE-2021-47261, CVE-2021-47265, CVE-2021-47269, CVE-2021-47274, CVE-2021-47276, CVE-2021-47277, CVE-2021-47280, CVE-2021-47281, CVE-2021-47284, CVE-2021-47285, CVE-2021-47288, CVE-2021-47301, CVE-2021-47302, CVE-2021-47305, CVE-2021-47307, CVE-2021-47308, CVE-2021-47310, CVE-2021-47311, CVE-2021-47314, CVE-2021-47315, CVE-2021-47319, CVE-2021-47320, CVE-2021-47321, CVE-2021-47323, CVE-2021-47324, CVE-2021-47330, CVE-2021-47334, CVE-2021-47337, CVE-2021-47343, CVE-2021-47344, CVE-2021-47345, CVE-2021-47347, CVE-2021-47352, CVE-2021-47353, CVE-2021-47355, CVE-2021-47356, CVE-2021-47357, CVE-2021-47361, CVE-2021-47362, CVE-2021-47369, CVE-2021-47375, CVE-2021-47378, CVE-2021-47382, CVE-2021-47383, CVE-2021-47391, CVE-2021-47397, CVE-2021-47400, CVE-2021-47401, CVE-2021-47404, CVE-2021-47409, CVE-2021-47416, CVE-2021-47423, CVE-2021-47424, CVE-2021-47431, CVE-2021-47435, CVE-2021-47436, CVE-2021-47456, CVE-2021-47458, CVE-2021-47460, CVE-2021-47469, CVE-2021-47472, CVE-2021-47473, CVE-2021-47478, CVE-2021-47480, CVE-2021-47483, CVE-2021-47485, CVE-2021-47495, CVE-2021-47496, CVE-2021-47497, CVE-2021-47500, CVE-2021-47506, CVE-2021-47509, CVE-2021-47511, CVE-2021-47523, CVE-2021-47541, CVE-2021-47548, CVE-2021-47565, CVE-2022-48636, CVE-2022-48650, CVE-2022-48672, CVE-2022-48686, CVE-2022-48697, CVE-2022-48702, CVE-2022-48704, CVE-2022-48708, CVE-2022-48710, CVE-2023-0160, CVE-2023-1829, CVE-2023-42755, CVE-2023-47233, CVE-2023-52527, CVE-2023-52586, CVE-2023-52591, CVE-2023-52646, CVE-2023-52653, CVE-2023-52655, CVE-2023-52664, CVE-2023-52685, CVE-2023-52686, CVE-2023-52691, CVE-2023-52696, CVE-2023-52698, CVE-2023-52703, CVE-2023-52730, CVE-2023-52732, CVE-2023-52741, CVE-2023-52742, CVE-2023-52747, CVE-2023-52759, CVE-2023-52774, CVE-2023-52781, CVE-2023-52796, CVE-2023-52803, CVE-2023-52821, CVE-2023-52864, CVE-2023-52865, CVE-2023-52867, CVE-2023-52875, CVE-2023-52880, CVE-2024-0639, CVE-2024-26625, CVE-2024-26739, CVE-2024-26752, CVE-2024-26775, CVE-2024-26791, CVE-2024-26828, CVE-2024-26846, CVE-2024-26874, CVE-2024-26876, CVE-2024-26900, CVE-2024-26915, CVE-2024-26920, CVE-2024-26921, CVE-2024-26929, CVE-2024-26930, CVE-2024-26931, CVE-2024-26934, CVE-2024-26957, CVE-2024-26958, CVE-2024-26984, CVE-2024-26996, CVE-2024-27008, CVE-2024-27054, CVE-2024-27059, CVE-2024-27062, CVE-2024-27388, CVE-2024-27396, CVE-2024-27398, CVE-2024-27401, CVE-2024-27419, CVE-2024-27436, CVE-2024-35789, CVE-2024-35791, CVE-2024-35809, CVE-2024-35811, CVE-2024-35830, CVE-2024-35849, CVE-2024-35877, CVE-2024-35878, CVE-2024-35887, CVE-2024-35895, CVE-2024-35914, CVE-2024-35932, CVE-2024-35935, CVE-2024-35936, CVE-2024-35944, CVE-2024-35955, CVE-2024-35969, CVE-2024-35982, CVE-2024-35984, CVE-2024-36015, CVE-2024-36029, CVE-2024-36954
Maintenance Incident: [SUSE:Maintenance:34218](https://smelt.suse.de/incident/34218/)
Sources used:
SUSE Linux Enterprise Real Time 12 SP5 (src):
 kernel-syms-rt-4.12.14-10.188.1, kernel-source-rt-4.12.14-10.188.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 31 Maintenance Automation 2024-06-24 20:30:27 UTC 
SUSE-SU-2024:2184-1: An update that solves 198 vulnerabilities and has 28 security fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1101816, 1141539, 1181674, 1185902, 1187716, 1188616, 1190317, 1190795, 1191452, 1194591, 1197760, 1197894, 1203935, 1206213, 1206646, 1207186, 1209657, 1210335, 1215702, 1216702, 1217169, 1217519, 1218917, 1220487, 1220513, 1220854, 1220928, 1221044, 1221081, 1221086, 1221543, 1221545, 1221816, 1221977, 1221994, 1222559, 1222619, 1222627, 1222667, 1222671, 1222793, 1222893, 1222894, 1223023, 1223046, 1223048, 1223062, 1223084, 1223119, 1223138, 1223207, 1223360, 1223384, 1223432, 1223509, 1223512, 1223539, 1223540, 1223626, 1223627, 1223633, 1223653, 1223666, 1223671, 1223712, 1223715, 1223738, 1223744, 1223752, 1223802, 1223819, 1223834, 1223922, 1223923, 1223931, 1223932, 1223948, 1223969, 1224096, 1224174, 1224181, 1224347, 1224482, 1224511, 1224525, 1224566, 1224580, 1224592, 1224601, 1224607, 1224621, 1224644, 1224645, 1224648, 1224650, 1224663, 1224671, 1224676, 1224680, 1224682, 1224725, 1224728, 1224733, 1224738, 1224747, 1224749, 1224759, 1224803, 1224827, 1224830, 1224831, 1224834, 1224838, 1224841, 1224844, 1224846, 1224847, 1224849, 1224854, 1224859, 1224867, 1224880, 1224882, 1224888, 1224889, 1224892, 1224893, 1224899, 1224904, 1224907, 1224916, 1224917, 1224922, 1224926, 1224930, 1224931, 1224942, 1224954, 1224956, 1224957, 1224959, 1224960, 1224961, 1224963, 1224966, 1224968, 1224981, 1224982, 1224983, 1224987, 1224990, 1224996, 1225008, 1225009, 1225010, 1225022, 1225026, 1225030, 1225054, 1225058, 1225059, 1225060, 1225062, 1225082, 1225084, 1225086, 1225092, 1225096, 1225112, 1225124, 1225128, 1225132, 1225141, 1225143, 1225144, 1225151, 1225153, 1225155, 1225157, 1225164, 1225177, 1225189, 1225192, 1225193, 1225198, 1225201, 1225207, 1225208, 1225222, 1225230, 1225242, 1225244, 1225247, 1225251, 1225252, 1225256, 1225303, 1225318, 1225322, 1225329, 1225330, 1225336, 1225347, 1225351, 1225354, 1225355, 1225360, 1225366, 1225367, 1225384, 1225390, 1225404, 1225409, 1225411, 1225438, 1225453, 1225479, 1225482, 1225506, 1225549, 1225560, 1225572, 1225640, 1225708, 1225764
CVE References: CVE-2021-46933, CVE-2021-46955, CVE-2021-47074, CVE-2021-47113, CVE-2021-47131, CVE-2021-47162, CVE-2021-47171, CVE-2021-47188, CVE-2021-47206, CVE-2021-47220, CVE-2021-47229, CVE-2021-47231, CVE-2021-47235, CVE-2021-47236, CVE-2021-47237, CVE-2021-47238, CVE-2021-47239, CVE-2021-47245, CVE-2021-47246, CVE-2021-47248, CVE-2021-47249, CVE-2021-47250, CVE-2021-47252, CVE-2021-47254, CVE-2021-47258, CVE-2021-47260, CVE-2021-47261, CVE-2021-47265, CVE-2021-47269, CVE-2021-47274, CVE-2021-47276, CVE-2021-47277, CVE-2021-47280, CVE-2021-47281, CVE-2021-47284, CVE-2021-47285, CVE-2021-47288, CVE-2021-47301, CVE-2021-47302, CVE-2021-47305, CVE-2021-47307, CVE-2021-47308, CVE-2021-47310, CVE-2021-47311, CVE-2021-47314, CVE-2021-47315, CVE-2021-47319, CVE-2021-47320, CVE-2021-47321, CVE-2021-47323, CVE-2021-47324, CVE-2021-47330, CVE-2021-47334, CVE-2021-47337, CVE-2021-47343, CVE-2021-47344, CVE-2021-47345, CVE-2021-47347, CVE-2021-47352, CVE-2021-47353, CVE-2021-47355, CVE-2021-47356, CVE-2021-47357, CVE-2021-47361, CVE-2021-47362, CVE-2021-47369, CVE-2021-47375, CVE-2021-47378, CVE-2021-47382, CVE-2021-47383, CVE-2021-47391, CVE-2021-47397, CVE-2021-47400, CVE-2021-47401, CVE-2021-47404, CVE-2021-47409, CVE-2021-47416, CVE-2021-47423, CVE-2021-47424, CVE-2021-47431, CVE-2021-47435, CVE-2021-47436, CVE-2021-47456, CVE-2021-47458, CVE-2021-47460, CVE-2021-47469, CVE-2021-47472, CVE-2021-47473, CVE-2021-47478, CVE-2021-47480, CVE-2021-47483, CVE-2021-47485, CVE-2021-47495, CVE-2021-47496, CVE-2021-47497, CVE-2021-47500, CVE-2021-47506, CVE-2021-47509, CVE-2021-47511, CVE-2021-47523, CVE-2021-47541, CVE-2021-47548, CVE-2021-47565, CVE-2022-48636, CVE-2022-48650, CVE-2022-48672, CVE-2022-48686, CVE-2022-48697, CVE-2022-48702, CVE-2022-48704, CVE-2022-48708, CVE-2022-48710, CVE-2023-0160, CVE-2023-1829, CVE-2023-42755, CVE-2023-47233, CVE-2023-52527, CVE-2023-52586, CVE-2023-52591, CVE-2023-52646, CVE-2023-52653, CVE-2023-52655, CVE-2023-52664, CVE-2023-52685, CVE-2023-52686, CVE-2023-52691, CVE-2023-52696, CVE-2023-52698, CVE-2023-52703, CVE-2023-52730, CVE-2023-52732, CVE-2023-52741, CVE-2023-52742, CVE-2023-52747, CVE-2023-52759, CVE-2023-52774, CVE-2023-52781, CVE-2023-52796, CVE-2023-52803, CVE-2023-52821, CVE-2023-52864, CVE-2023-52865, CVE-2023-52867, CVE-2023-52875, CVE-2023-52880, CVE-2024-0639, CVE-2024-26625, CVE-2024-26739, CVE-2024-26752, CVE-2024-26775, CVE-2024-26791, CVE-2024-26828, CVE-2024-26846, CVE-2024-26874, CVE-2024-26876, CVE-2024-26900, CVE-2024-26915, CVE-2024-26920, CVE-2024-26921, CVE-2024-26929, CVE-2024-26930, CVE-2024-26931, CVE-2024-26934, CVE-2024-26957, CVE-2024-26958, CVE-2024-26984, CVE-2024-26996, CVE-2024-27008, CVE-2024-27054, CVE-2024-27059, CVE-2024-27062, CVE-2024-27388, CVE-2024-27396, CVE-2024-27398, CVE-2024-27401, CVE-2024-27419, CVE-2024-27436, CVE-2024-35789, CVE-2024-35791, CVE-2024-35809, CVE-2024-35811, CVE-2024-35830, CVE-2024-35849, CVE-2024-35877, CVE-2024-35878, CVE-2024-35887, CVE-2024-35895, CVE-2024-35914, CVE-2024-35932, CVE-2024-35935, CVE-2024-35936, CVE-2024-35944, CVE-2024-35955, CVE-2024-35969, CVE-2024-35982, CVE-2024-36015, CVE-2024-36029, CVE-2024-36954
Maintenance Incident: [SUSE:Maintenance:34269](https://smelt.suse.de/incident/34269/)
Sources used:
SUSE Linux Enterprise Live Patching 12-SP5 (src):
 kgraft-patch-SLE12-SP5_Update_57-1-8.3.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 kernel-obs-build-4.12.14-122.219.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 kernel-source-4.12.14-122.219.1, kernel-syms-4.12.14-122.219.1
SUSE Linux Enterprise Server 12 SP5 (src):
 kernel-source-4.12.14-122.219.1, kernel-syms-4.12.14-122.219.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 kernel-source-4.12.14-122.219.1, kernel-syms-4.12.14-122.219.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.