SUSE update for the Linux Kernel (Live Patch 43 for SLE 12 SP3)

1) Improper Initialization

EUVDB-ID: #VU63658

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28688

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to improper initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. A local user can perform a denial of service attack.

Mitigation

Update the affected package the Linux Kernel (Live Patch 43 for SLE 12 SP3) to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 12-SP3

SUSE Linux Enterprise Server: 12-SP3-LTSS

kgraft-patch-4_4_180-94_156-default-debuginfo: before 2-2.1

kgraft-patch-4_4_180-94_156-default: before 2-2.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221003-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.