Bug 1180676 (CVE-2021-3139)

Summary: VUL-0: CVE-2021-3139: tcmu-runner: LIO security issue
Product: [Novell Products] SUSE Security Incidents Reporter: David Disseldorp <ddiss>
Component: IncidentsAssignee: David Disseldorp <ddiss>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P3 - Medium CC: cathy.hu, ceph-bugs, ddiss, hare, holgi, jan.fajerski, jdouglas, lduncan, lmb, meissner, mkubecek, mlatimer, security-team, tiwai
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/270735/
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on: 1178372    
Bug Blocks: 1178684    
Attachments: 0001-EMBARGOED-tcmur-fail-cross-device-XCOPY-requests.patch

Comment 1 David Disseldorp 2021-01-08 00:24:41 UTC 
Created attachment 844924 [details]
0001-EMBARGOED-tcmur-fail-cross-device-XCOPY-requests.patch

tcmu-runner fixes are staged at:
  https://build.suse.de/package/show/home:dmdiss:embargoed_tcmur_15/tcmu-runner
  https://build.suse.de/package/show/home:dmdiss:embargoed_tcmur_15sp2/tcmu-runner
Comment 4 Marcus Meissner 2021-01-12 18:02:38 UTC 
is public now
Comment 5 Swamp Workflow Management 2021-01-12 23:30:43 UTC 
SUSE-SU-2021:0093-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1180676
CVE References: CVE-2020-28374
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    tcmu-runner-1.5.2-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Marcus Meissner 2021-01-13 15:39:23 UTC 
A new CVE was allocated for this as we cannot use the kernel CVE due to CVE allocation rules:

CVE-2021-3139
Comment 7 Swamp Workflow Management 2021-01-15 20:16:48 UTC 
SUSE-SU-2021:0143-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1138443,1180676
CVE References: CVE-2021-3139
JIRA References: 
Sources used:
SUSE Enterprise Storage 6 (src):    tcmu-runner-1.4.0-4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 David Disseldorp 2021-01-16 01:04:35 UTC 
The upstream fix was merged via https://github.com/open-iscsi/tcmu-runner/pull/644 . 
Closing...
Comment 9 Swamp Workflow Management 2021-01-16 14:24:57 UTC 
openSUSE-SU-2021:0075-1: An update that solves 17 vulnerabilities and has 62 fixes is now available.

Category: security (important)
Bug References: 1040855,1044120,1044767,1055117,1065729,1094840,1109695,1112178,1115431,1129770,1138374,1139944,1144912,1152457,1163727,1164780,1168952,1171078,1172145,1172538,1172694,1174784,1176558,1176559,1176846,1176956,1177666,1178049,1178270,1178372,1178401,1178590,1178634,1178762,1178900,1179014,1179015,1179045,1179082,1179107,1179142,1179204,1179444,1179508,1179509,1179520,1179575,1179578,1179601,1179663,1179670,1179671,1179672,1179673,1179711,1179713,1179714,1179715,1179716,1179722,1179723,1179724,1179745,1179810,1179888,1179895,1179896,1179960,1179963,1180027,1180029,1180031,1180052,1180086,1180117,1180258,1180506,1180559,1180676
CVE References: CVE-2019-20934,CVE-2020-0444,CVE-2020-0465,CVE-2020-0466,CVE-2020-11668,CVE-2020-25639,CVE-2020-27068,CVE-2020-27777,CVE-2020-27786,CVE-2020-27825,CVE-2020-28374,CVE-2020-29568,CVE-2020-29569,CVE-2020-29660,CVE-2020-29661,CVE-2020-36158,CVE-2020-4788
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    kernel-debug-4.12.14-lp151.28.91.1, kernel-default-4.12.14-lp151.28.91.1, kernel-docs-4.12.14-lp151.28.91.1, kernel-kvmsmall-4.12.14-lp151.28.91.1, kernel-obs-build-4.12.14-lp151.28.91.1, kernel-obs-qa-4.12.14-lp151.28.91.1, kernel-source-4.12.14-lp151.28.91.1, kernel-syms-4.12.14-lp151.28.91.1, kernel-vanilla-4.12.14-lp151.28.91.1
Comment 10 Swamp Workflow Management 2021-01-17 14:16:03 UTC 
openSUSE-SU-2021:0097-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1180676
CVE References: CVE-2021-3139
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    tcmu-runner-1.5.2-lp152.2.3.1
Comment 11 Swamp Workflow Management 2021-01-18 14:16:30 UTC 
SUSE-SU-2021:0158-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1180676
CVE References: CVE-2021-3139
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    tcmu-runner-1.4.0-3.9.1
SUSE Manager Retail Branch Server 4.0 (src):    tcmu-runner-1.4.0-3.9.1
SUSE Manager Proxy 4.0 (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise Server for SAP 15 (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise Server 15-LTSS (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    tcmu-runner-1.4.0-3.9.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    tcmu-runner-1.4.0-3.9.1
SUSE Enterprise Storage 6 (src):    tcmu-runner-1.4.0-3.9.1
SUSE CaaS Platform 4.0 (src):    tcmu-runner-1.4.0-3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2021-01-20 20:15:46 UTC 
openSUSE-SU-2021:0128-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1180676
CVE References: CVE-2021-3139
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    tcmu-runner-1.4.0-lp151.3.9.1
Comment 13 Swamp Workflow Management 2021-02-09 14:21:50 UTC 
SUSE-SU-2021:0347-1: An update that solves 11 vulnerabilities and has 62 fixes is now available.

Category: security (important)
Bug References: 1065600,1149032,1152472,1152489,1153274,1154353,1155518,1163727,1163930,1165545,1167773,1172355,1175389,1176395,1176831,1176846,1178142,1178372,1178631,1178684,1179142,1179396,1179508,1179509,1179567,1179572,1179575,1179878,1180008,1180130,1180264,1180412,1180541,1180559,1180562,1180566,1180676,1180759,1180765,1180773,1180809,1180812,1180848,1180859,1180889,1180891,1180971,1181014,1181018,1181077,1181104,1181148,1181158,1181161,1181169,1181203,1181217,1181218,1181219,1181220,1181237,1181318,1181335,1181346,1181349,1181425,1181494,1181504,1181511,1181538,1181553,1181584,1181645
CVE References: CVE-2020-25211,CVE-2020-25639,CVE-2020-27835,CVE-2020-28374,CVE-2020-29568,CVE-2020-29569,CVE-2020-36158,CVE-2021-0342,CVE-2021-20177,CVE-2021-3347,CVE-2021-3348
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Public Cloud 15-SP2 (src):    kernel-azure-5.3.18-18.35.2, kernel-source-azure-5.3.18-18.35.2, kernel-syms-azure-5.3.18-18.35.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2021-02-09 14:38:22 UTC 
SUSE-SU-2021:0348-1: An update that solves 9 vulnerabilities and has 75 fixes is now available.

Category: security (important)
Bug References: 1046305,1046306,1046540,1046542,1046648,1050242,1050244,1050536,1050538,1050545,1056653,1056657,1056787,1064802,1066129,1073513,1074220,1075020,1086282,1086301,1086313,1086314,1098633,1103990,1103991,1103992,1104270,1104277,1104279,1104353,1104427,1104742,1104745,1109837,1111981,1112178,1112374,1113956,1119113,1126206,1126390,1127354,1127371,1129770,1136348,1144912,1149032,1163727,1172145,1174206,1176831,1176846,1178036,1178049,1178372,1178631,1178684,1178900,1179093,1179508,1179509,1179563,1179573,1179575,1179878,1180008,1180130,1180559,1180562,1180676,1180765,1180812,1180859,1180891,1180912,1181001,1181018,1181170,1181230,1181231,1181349,1181425,1181553,901327
CVE References: CVE-2020-25639,CVE-2020-27835,CVE-2020-28374,CVE-2020-29568,CVE-2020-29569,CVE-2020-36158,CVE-2021-0342,CVE-2021-20177,CVE-2021-3347
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    kernel-azure-4.12.14-16.44.1, kernel-source-azure-4.12.14-16.44.1, kernel-syms-azure-4.12.14-16.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2021-02-10 20:26:38 UTC 
SUSE-SU-2021:0427-1: An update that solves 10 vulnerabilities and has 61 fixes is now available.

Category: security (important)
Bug References: 1065600,1149032,1152472,1152489,1153274,1154353,1155518,1163930,1165545,1167773,1172355,1175389,1176395,1176831,1176846,1178142,1178372,1178631,1178684,1178995,1179142,1179396,1179508,1179509,1179567,1179572,1179575,1179878,1180008,1180130,1180264,1180412,1180676,1180759,1180765,1180773,1180809,1180812,1180848,1180859,1180889,1180891,1180964,1180971,1181014,1181018,1181077,1181104,1181148,1181158,1181161,1181169,1181203,1181217,1181218,1181219,1181220,1181237,1181318,1181335,1181346,1181349,1181425,1181494,1181504,1181511,1181538,1181544,1181553,1181584,1181645
CVE References: CVE-2020-25211,CVE-2020-25639,CVE-2020-27835,CVE-2020-28374,CVE-2020-29568,CVE-2020-29569,CVE-2021-0342,CVE-2021-20177,CVE-2021-3347,CVE-2021-3348
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Realtime 15-SP2 (src):    kernel-rt-5.3.18-25.1, kernel-rt_debug-5.3.18-25.1, kernel-source-rt-5.3.18-25.1, kernel-syms-rt-5.3.18-25.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2021-02-11 14:23:11 UTC 
SUSE-SU-2021:0434-1: An update that solves 26 vulnerabilities and has 27 fixes is now available.

Category: security (important)
Bug References: 1144912,1149032,1158775,1163727,1171979,1176395,1176846,1176962,1177304,1177666,1178036,1178182,1178198,1178372,1178589,1178590,1178684,1178886,1179107,1179140,1179141,1179419,1179429,1179508,1179509,1179601,1179616,1179663,1179666,1179745,1179877,1179878,1179895,1179960,1179961,1180008,1180027,1180028,1180029,1180030,1180031,1180032,1180052,1180086,1180559,1180562,1180676,1181001,1181158,1181349,1181504,1181553,1181645
CVE References: CVE-2019-20934,CVE-2020-0444,CVE-2020-0465,CVE-2020-0466,CVE-2020-15436,CVE-2020-15437,CVE-2020-25211,CVE-2020-25639,CVE-2020-25669,CVE-2020-27068,CVE-2020-27777,CVE-2020-27786,CVE-2020-27825,CVE-2020-27835,CVE-2020-28374,CVE-2020-28915,CVE-2020-28974,CVE-2020-29371,CVE-2020-29568,CVE-2020-29569,CVE-2020-29660,CVE-2020-29661,CVE-2020-36158,CVE-2020-4788,CVE-2021-3347,CVE-2021-3348
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    kernel-default-4.12.14-95.68.1, kernel-source-4.12.14-95.68.1, kernel-syms-4.12.14-95.68.1
SUSE OpenStack Cloud 9 (src):    kernel-default-4.12.14-95.68.1, kernel-source-4.12.14-95.68.1, kernel-syms-4.12.14-95.68.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    kernel-default-4.12.14-95.68.1, kernel-source-4.12.14-95.68.1, kernel-syms-4.12.14-95.68.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    kernel-default-4.12.14-95.68.1, kernel-source-4.12.14-95.68.1, kernel-syms-4.12.14-95.68.1
SUSE Linux Enterprise Live Patching 12-SP4 (src):    kernel-default-4.12.14-95.68.1, kgraft-patch-SLE12-SP4_Update_18-1-6.3.1
SUSE Linux Enterprise High Availability 12-SP4 (src):    kernel-default-4.12.14-95.68.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Swamp Workflow Management 2021-02-11 14:34:02 UTC 
SUSE-SU-2021:0433-1: An update that solves 10 vulnerabilities and has 75 fixes is now available.

Category: security (important)
Bug References: 1046305,1046306,1046540,1046542,1046648,1050242,1050244,1050536,1050538,1050545,1056653,1056657,1056787,1064802,1066129,1073513,1074220,1075020,1086282,1086301,1086313,1086314,1098633,1103990,1103991,1103992,1104270,1104277,1104279,1104353,1104427,1104742,1104745,1109837,1111981,1112178,1112374,1113956,1119113,1126206,1126390,1127354,1127371,1129770,1136348,1144912,1149032,1163727,1172145,1174206,1176831,1176846,1178036,1178049,1178372,1178631,1178684,1178900,1179093,1179508,1179509,1179563,1179573,1179575,1179878,1180008,1180130,1180559,1180562,1180676,1180765,1180812,1180859,1180891,1180912,1181001,1181018,1181170,1181230,1181231,1181349,1181425,1181504,1181553,1181645
CVE References: CVE-2020-25639,CVE-2020-27835,CVE-2020-28374,CVE-2020-29568,CVE-2020-29569,CVE-2020-36158,CVE-2021-0342,CVE-2021-20177,CVE-2021-3347,CVE-2021-3348
JIRA References: 
Sources used:
SUSE Linux Enterprise Real Time Extension 12-SP5 (src):    kernel-rt-4.12.14-10.31.1, kernel-rt_debug-4.12.14-10.31.1, kernel-source-rt-4.12.14-10.31.1, kernel-syms-rt-4.12.14-10.31.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 18 Swamp Workflow Management 2021-02-11 20:37:57 UTC 
SUSE-SU-2021:0438-1: An update that solves 29 vulnerabilities and has 24 fixes is now available.

Category: security (important)
Bug References: 1144912,1149032,1163840,1168952,1172199,1173074,1173942,1176395,1176846,1177666,1178182,1178272,1178372,1178589,1178590,1178684,1178886,1179071,1179107,1179140,1179141,1179419,1179429,1179508,1179509,1179601,1179616,1179663,1179666,1179745,1179877,1179878,1179895,1179960,1179961,1180008,1180027,1180028,1180029,1180030,1180031,1180032,1180052,1180086,1180559,1180562,1180676,1181001,1181158,1181349,1181504,1181553,1181645
CVE References: CVE-2019-20806,CVE-2019-20934,CVE-2020-0444,CVE-2020-0465,CVE-2020-0466,CVE-2020-10781,CVE-2020-11668,CVE-2020-15436,CVE-2020-15437,CVE-2020-25211,CVE-2020-25639,CVE-2020-25669,CVE-2020-27068,CVE-2020-27777,CVE-2020-27786,CVE-2020-27825,CVE-2020-27835,CVE-2020-28374,CVE-2020-28915,CVE-2020-28974,CVE-2020-29371,CVE-2020-29568,CVE-2020-29569,CVE-2020-29660,CVE-2020-29661,CVE-2020-36158,CVE-2020-4788,CVE-2021-3347,CVE-2021-3348
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    kernel-default-4.12.14-150.66.1, kernel-docs-4.12.14-150.66.1, kernel-obs-build-4.12.14-150.66.1, kernel-source-4.12.14-150.66.1, kernel-syms-4.12.14-150.66.1, kernel-vanilla-4.12.14-150.66.1
SUSE Linux Enterprise Server 15-LTSS (src):    kernel-default-4.12.14-150.66.1, kernel-docs-4.12.14-150.66.1, kernel-obs-build-4.12.14-150.66.1, kernel-source-4.12.14-150.66.1, kernel-syms-4.12.14-150.66.1, kernel-vanilla-4.12.14-150.66.1, kernel-zfcpdump-4.12.14-150.66.1
SUSE Linux Enterprise Module for Live Patching 15 (src):    kernel-default-4.12.14-150.66.1, kernel-livepatch-SLE15_Update_22-1-1.3.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    kernel-default-4.12.14-150.66.1, kernel-docs-4.12.14-150.66.1, kernel-obs-build-4.12.14-150.66.1, kernel-source-4.12.14-150.66.1, kernel-syms-4.12.14-150.66.1, kernel-vanilla-4.12.14-150.66.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    kernel-default-4.12.14-150.66.1, kernel-docs-4.12.14-150.66.1, kernel-obs-build-4.12.14-150.66.1, kernel-source-4.12.14-150.66.1, kernel-syms-4.12.14-150.66.1, kernel-vanilla-4.12.14-150.66.1
SUSE Linux Enterprise High Availability 15 (src):    kernel-default-4.12.14-150.66.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 22 Cathy Hu 2022-08-30 07:22:31 UTC 
Thanks, closing.