SUSE-SU-2021:1046-1 Security update for the Linux Kernel (Live Patch 16 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-12263 fixes several issues. The following security issues were fixed: - CVE-2021-27365: Fixed an issue where data structures did not have appropriate length constraints or checks, and could exceed the PAGESIZE value bsc1183491. - CVE-2021-27363: Fixed a...

Oracle Linux 7 : kernel (ELSA-2021-1071)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1071 advisory. - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech 1930826 CVE-2021-27365 - scsi: iscsi: Ensure sysfs attributes are limited to PAGESIZE Chr...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9164)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9164 advisory. - audit: fix error handling in auditdatatoentry Paul Moore Orabug: 32608451 CVE-2020-0444 - scsi: iscsi: Ensure sysfs attributes are limited to...

Oracle Linux 8 : kernel (ELSA-2021-1093)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1093 advisory. - futex: Handle faults correctly for PI futexes Waiman Long 1924633 1924635 CVE-2021-3347 - futex: Simplify fixuppistateowner Waiman Long 1924633 19246...

Debian DLA-2610-1 : linux-4.19 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service, or information leaks. CVE-2020-27170, CVE-2020-27171 Piotr Krysiuk discovered flaws in the BPF subsystem's checks for information leaks throu...

iSCSI subsystem Linux Privilege Escalation

The vulnerability of the iSCSI subsystem in Linux operating systems relates to operations that go beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause system failures or increase their privileges through specially created Netlink messages...

iSCSI subsystem Linux Data Compromise

The vulnerability of the iSCSI subsystem in Linux operating systems relates to the writing of data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of data through specially created Netlink messages...

MGASA-2021-0152 Updated kernel-linus packages fix security issues

This kernel-linus update is based on upstream 5.10.25 and fixes at least the following security issues: A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRMIOCTLNOUVEAUCHANNELALLOC. This...

Updated kernel packages fix security issues

This kernel update is based on upstream 5.10.25 and fixes at least the following security issues: Unprivileged BPF programs running on affected systems can bypass the protection and execute speculatively out-of-bounds loads from any location within the kernel memory. This can be abused to extract...

OracleVM 3.4 : kernel-uek (OVMSA-2021-0008)

The remote OracleVM system is missing necessary patches to address security updates: - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsitransport structure. When an iSCSI transport is registered with the iSCSI...

Amazon Linux 2 : kernel (ALAS-2021-1616)

The version of kernel installed on the remote host is prior to 4.14.225-168.357. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1616 advisory. An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2021-9112)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9112 advisory. - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech Orabug: 32634994 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi: Ensure sysfs...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9115)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9115 advisory. - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech Orabug: 32603379 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi: Ensure...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9113)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9113 advisory. - scsi: iscsi: Ensure sysfs attributes are limited to PAGESIZE Chris Leech Orabug: 32603382 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi:...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2021-9114)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9114 advisory. - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech Orabug: 32603379 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi: Ensure...

kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c

A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink.c. The highest threat from thi...

kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c

A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink.c. The highest threat from thi...

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.

...

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI and has a length up to the maximum length of a Netlink message.

...

Linux scsi_transport_iscsi driver DoS

The vulnerability of the drivers/scsi/scsitransportiscsi.c file in the Linux operating system is related to the lack of protection for service data. Exploiting this vulnerability allows an attacker to connect to the iscsi NETLINK socket and send commands to the kernel...