suse/kernel-livepatch-SLE15_Update_25&distro=SUSE Linux Enterprise Live Patching 15

Vulnerabilities (58)

• CVE-2020-36386Jun 7, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf.

• CVE-2020-36385Jun 7, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.

• CVE-2021-3491Jun 4, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem. This could be used to create a heap overflow leading to arbitrary code executi

• CVE-2021-33200May 27, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular,

• CVE-2021-22543May 26, 2021
  affected < 2-2.1fixed 2-2.1

  An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pag

• CVE-2020-26558May 24, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evide

• CVE-2021-33034May 14, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.

• CVE-2021-23134May 12, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.

• CVE-2020-26147MedMay 11, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends

• CVE-2020-26145MedMay 11, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitra

• CVE-2020-26141MedMay 11, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 network

• CVE-2020-26139MedMay 11, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against c

• CVE-2020-24588LowMay 11, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is manda

• CVE-2020-24587May 11, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends f

• CVE-2020-24586May 11, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented

• CVE-2021-32399May 10, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.

• CVE-2021-23133Apr 22, 2021
  affected < 1-1.3.1fixed 1-1.3.1

  A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is re

• CVE-2020-3702Sep 8, 2020
  affected < 7-2.2fixed 7-2.2

  u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapd