SUSE update for kernel-firmware



Published: 2022-03-04
Risk Medium
Patch available YES
Number of vulnerabilities 17
CVE-ID CVE-2021-0066
CVE-2021-0072
CVE-2021-0076
CVE-2021-0161
CVE-2021-0164
CVE-2021-0165
CVE-2021-0166
CVE-2021-0168
CVE-2021-0170
CVE-2021-0172
CVE-2021-0173
CVE-2021-0174
CVE-2021-0175
CVE-2021-0176
CVE-2021-0183
CVE-2021-33139
CVE-2021-33155
CWE-ID CWE-20
CWE-200
CWE-284
CWE-754
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		SUSE Linux Enterprise Realtime Extension
Operating systems & Components / Operating system

SUSE Linux Enterprise Micro
Operating systems & Components / Operating system

SUSE Enterprise Storage
Operating systems & Components / Operating system

SUSE Manager Server
Operating systems & Components / Operating system

SUSE Manager Retail Branch Server
Operating systems & Components / Operating system

SUSE Manager Proxy
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP
Operating systems & Components / Operating system

SUSE Linux Enterprise Server
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing
Operating systems & Components / Operating system

SUSE CaaS Platform
Operating systems & Components / Operating system

ucode-amd
Operating systems & Components / Operating system package or component

kernel-firmware
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 17 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU60516

Risk: Low

CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0066

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local attacker can pass specially crafted input to the application and gain elevated privileges.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU60515

Risk: Low

CVSSv3.1: 3.6 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0072

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU60509

Risk: Low

CVSSv3.1: 4.5 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0076

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of specified index, position, or offset in Input in firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU60496

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0161

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator on the local network can pass specially crafted input to the application and gain elevated privileges on the target system.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper access control

EUVDB-ID: #VU60497

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0164

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in firmware. A local user can bypass implemented security restrictions and gain elevated privileges on the system.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU60498

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0165

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU60499

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0166

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in firmware. A local administrator can enable escalation of privileges.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU60502

Risk: Low

CVSSv3.1: 3.6 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0168

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator can enable escalation of privileges.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU60503

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0170

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in firmware. A local user can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU60505

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0172

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU60506

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0173

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of consistency within input in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Input validation error

EUVDB-ID: #VU60507

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0174

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper use of validation framework in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Input validation error

EUVDB-ID: #VU60508

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0175

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of specified index, position, or offset in Input in firmware. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Input validation error

EUVDB-ID: #VU60510

Risk: Low

CVSSv3.1: 4.5 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0176

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A local administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Input validation error

EUVDB-ID: #VU60514

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-0183

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of specified index, position, or offset in Input in software. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper Check for Unusual or Exceptional Conditions

EUVDB-ID: #VU60467

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33139

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper check for unusual or exceptional conditions in firmware. A remote authenticated attacker on the local network can perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Input validation error

EUVDB-ID: #VU60468

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33155

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in firmware. A remote authenticated attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package kernel-firmware to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Micro: 5.0

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

ucode-amd: before 20200107-3.26.1

kernel-firmware: before 20200107-3.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20220721-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###