CVE-2022-27666

The Linux Kernel, the operating system core itself.

Security Fix(es):

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.(CVE-2022-27666)

In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel(CVE-2021-39698)

Vulnerability Summary for CVE-2022-1198.(CVE-2022-1198)

ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.(CVE-2022-28390)

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle return with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.(CVE-2022-1016)

Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel.(CVE-2021-39713)

A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5.(CVE-2022-1055)

Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042.(CVE-2022-23039)

Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

• kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• weird port mapping with asymmetric traffic (BZ#2065266)

• HBR3 is malfunction via MST HUB against Intel ADL-HX CPU (BZ#2066644)

• openvswitch connection tracking sends incorrect flow key for some upcalls (BZ#2068476)

• sctp connection abort unexpected. (BZ#2070959)

• soft quota cannot exceed more the 5 warns which breaks timer functionality (BZ#2071713)

• VirtIO Throughput for VM on host with OVS HW-Offload is very low (BZ#2074221)

• SR-IOV performance > 50% degradation (BZ#2074829)

• Call trace with parallel rules insertion and deletion (BZ#2075553)

• Enable nested virtualization (BZ#2079069)

• iscsi_ttx (iSERT) completions hung while waiting for mlx5_ib_drain_sq (BZ#2079433)

• WARNING: CPU: 2 PID: 969 at kernel/locking/lockdep.c:895 register_lock_class+0x234/0x1640 (BZ#2079856)

• mlx5: Some rule are not offloaded to HW in OVN K8s Pod 2 External use case (BZ#2079918)

• OCP node kernel crash due to ceph_fsync - unsafe_request_wait+0x143 (BZ#2080071)

• TCP doesn't retransmit if in reorder state and waits for RTO (BZ#2080972)

• pnfs NFSv4.1 IO causes a soft lockup (after a server reboot) and an unresponsive client (BZ#2080998)

• BlueField2: DPU can't switch to switchdev mode (BZ#2081011)

• Important ice bug fixes (BZ#2081794)

• For isolated CPUs (with nohz_full enabled for isolated CPUs) CPU utilization statistics are not getting reflected continuously (BZ#2084138)

• Host is getting crash/abrupt reboot while the guest has been assigned with more than 128 GB RAM while it is using NVIDIA proprietary module. (BZ#2085572)

• s_pf0vf2: hw csum failure for mlx5 (BZ#2086549)

• kernel memory leak while freeing nested actions (BZ#2086590)

• Regression: Bluetooth will not activate after 8.5 update (BZ#2087641)

• mlx5,Internal port - traffic not offloaded on tunnel interface rules on chain > 0 when internal port is the vtep device. (BZ#2088610)

• rule not offloaded on server side with syndrome(0x389e56) when direction is in (BZ#2088611)

• TTL decrease only on the first packet (BZ#2088638)

• TC HWOL of inbound traffic over geneve with ovs bridge as VTEP is not working (BZ#2088639)

• Audio No Function on Orchid Bay(Mini Config) (BZ#2090423)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

• kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-8.6.z0 Batch (BZ#2081704)

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es):

• kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012)
• kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)
• kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-1966)
• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• make SHA512_arch algos and CRYPTO_USER built-ins (BZ#2072643)
• SR-IOV performance > 50% degradation (BZ#2074830)
• fix data corruption caused by dm-integrity (BZ#2082187)
• SCTP client-side peeloff issues [almalinux-9] (BZ#2084044)
• TCP connection fails in a asymmetric routing situation (BZ#2085480)
• Fails to boot Multiple RT VMs each with multiple vCPUs (BZ#2086963)
• spec: Fix separate tools build (BZ#2090852)
• call traces related to eeh_pseries observed and vmcore is not captured, when kdump is triggered (BZ#2092255)
• Mark ThunderX NIC driver as unmaintained (BZ#2092638)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es):

• kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012)
• kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)
• kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-1966)
• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• kernel-rt: update RT source tree to the latest AlmaLinux-9.0.z1 Batch (BZ#2089492)

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es):

• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)
• kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• weird port mapping with asymmetric traffic (BZ#2065266)
• HBR3 is malfunction via MST HUB against Intel ADL-HX CPU (BZ#2066644)
• openvswitch connection tracking sends incorrect flow key for some upcalls (BZ#2068476)
• sctp connection abort unexpected. (BZ#2070959)
• soft quota cannot exceed more the 5 warns which breaks timer functionality (BZ#2071713)
• VirtIO Throughput for VM on host with OVS HW-Offload is very low (BZ#2074221)
• SR-IOV performance > 50% degradation (BZ#2074829)
• Call trace with parallel rules insertion and deletion (BZ#2075553)
• Enable nested virtualization (BZ#2079069)
• iscsi_ttx (iSERT) completions hung while waiting for mlx5_ib_drain_sq (BZ#2079433)
• WARNING: CPU: 2 PID: 969 at kernel/locking/lockdep.c:895 register_lock_class+0x234/0x1640 (BZ#2079856)
• mlx5: Some rule are not offloaded to HW in OVN K8s Pod 2 External use case (BZ#2079918)
• OCP node kernel crash due to ceph_fsync - unsafe_request_wait+0x143 (BZ#2080071)
• TCP doesn't retransmit if in reorder state and waits for RTO (BZ#2080972)
• pnfs NFSv4.1 IO causes a soft lockup (after a server reboot) and an unresponsive client (BZ#2080998)
• BlueField2: DPU can't switch to switchdev mode (BZ#2081011)
• Important ice bug fixes (BZ#2081794)
• For isolated CPUs (with nohz_full enabled for isolated CPUs) CPU utilization statistics are not getting reflected continuously (BZ#2084138)
• Host is getting crash/abrupt reboot while the guest has been assigned with more than 128 GB RAM while it is using NVIDIA proprietary module. (BZ#2085572)
• s_pf0vf2: hw csum failure for mlx5 (BZ#2086549)
• kernel memory leak while freeing nested actions (BZ#2086590)
• Regression: Bluetooth will not activate after 8.5 update (BZ#2087641)
• mlx5,Internal port - traffic not offloaded on tunnel interface rules on chain > 0 when internal port is the vtep device. (BZ#2088610)
• rule not offloaded on server side with syndrome(0x389e56) when direction is in (BZ#2088611)
• TTL decrease only on the first packet (BZ#2088638)
• TC HWOL of inbound traffic over geneve with ovs bridge as VTEP is not working (BZ#2088639)
• Audio No Function on Orchid Bay(Mini Config) (BZ#2090423)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es):

• kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)
• kernel: out-of-bounds read in fbcon_get_font function (CVE-2020-28915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• kernel-rt: update RT source tree to the latest AlmaLinux-8.6.z0 Batch (BZ#2081704)

• net: qrtr: fix another OOB Read in qrtr_endpoint_post {CVE-2021-3743}
• vt: keyboard: avoid signed integer overflow in k_ascii {CVE-2020-13974}
• pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() {CVE-2021-4157}
• esp: Fix possible buffer overflow in ESP transformation {CVE-2022-27666}
• sock: remove one redundant SKB_FRAG_PAGE_ORDER macro
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl {CVE-2021-3612}

• net: qrtr: fix another OOB Read in qrtr_endpoint_post {CVE-2021-3743}
• vt: keyboard: avoid signed integer overflow in k_ascii {CVE-2020-13974}
• pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() {CVE-2021-4157}
• esp: Fix possible buffer overflow in ESP transformation {CVE-2022-27666}
• sock: remove one redundant SKB_FRAG_PAGE_ORDER macro
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl {CVE-2021-3612}

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• drm/i915: Fix the GT fence revocation runtime PM logic {CVE-2022-0330}
• PM: runtime: Add pm_runtime_get_if_active() {CVE-2022-0330}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• bpf: In bpf_task_fd_query use fget_task {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}
• vfs, fdtable: Add fget_task helper {CVE-2021-4083}

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

This kernel update is based on upstream 5.15.32 and fixes at least the following security issues:

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system (CVE-2022-0995).

A flaw use after free in the Linux kernel FUSE filesystem was found in the way user triggers write(). A local user could use this flaw to get some unauthorized access to some data from the FUSE filesystem and as result potentially privilege escalation too (CVE-2022-1011).

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue (CVE-2022-1015).

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c: nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker (CVE-2022-1016).

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1048).

st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c has EVT_TRANSACTION buffer overflows because of untrusted length parameters (CVE-2022-26490).

There is a buffer overflow in ESP transformation in net/ipv4/esp4.c and net/ipv6/esp6.c via a large message. In some configurations, local users can gain privileges by overwriting kernel heap objects (CVE-2022-27666).

A refcount leak bug was found in net/llc/af_llc.c (CVE-2022-28356).

Other fixes in this update:

• locking/lockdep: Avoid potential access of invalid memory in lock_class
• mm: kfence: fix missing objcg housekeeping for SLAB
• net: ipv6: fix skb_over_panic in __ip6_append_data
• rtw88: Add support for Realtek 8821CE RFE Type 6
• revert: "swiotlb: rework 'fix info leak with DMA_FROM_DEVICE'" as it breaks atleast ath9k

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.32 and fixes at least the following security issues:

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system (CVE-2022-0995).

A flaw use after free in the Linux kernel FUSE filesystem was found in the way user triggers write(). A local user could use this flaw to get some unauthorized access to some data from the FUSE filesystem and as result potentially privilege escalation too (CVE-2022-1011).

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue (CVE-2022-1015).

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c: nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker (CVE-2022-1016).

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1048).

st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c has EVT_TRANSACTION buffer overflows because of untrusted length parameters (CVE-2022-26490).

There is a buffer overflow in ESP transformation in net/ipv4/esp4.c and net/ipv6/esp6.c via a large message. In some configurations, local users can gain privileges by overwriting kernel heap objects (CVE-2022-27666).

A refcount leak bug was found in net/llc/af_llc.c (CVE-2022-28356).

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0854: Fixed a memory leak flaw was found in the Linux kernels DMA subsystem. This flaw allowed a local user to read random memory from the kernel space. (bnc#1196823)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-1199: Fixed null-ptr-deref and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. (bsc#1198028)
• CVE-2022-1205: Fixed null pointer dereference and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. (bsc#1198027)
• CVE-2022-1198: Fixed an use-after-free vulnerability that allow an attacker to crash the linux kernel by simulating Amateur Radio (bsc#1198030).
• CVE-2022-1195: Fixed an use-after-free vulnerability which could allow a local attacker with a user privilege to execute a denial of service. (bsc#1198029)
• CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel. (bnc#1198033)
• CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel. (bnc#1198032)
• CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel. (bnc#1198031)
• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock. (bsc#1197331)
• CVE-2022-1055: Fixed a use-after-free in tc_new_tfilter that could allow a local attacker to gain privilege escalation. (bnc#1197702)
• CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file. (bnc#1197366)
• CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems. (bnc#1197343)
• CVE-2022-27223: Fixed an out-of-array access in /usb/gadget/udc/udc-xilinx.c. (bsc#1197245)
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)
• CVE-2021-45402: Fixed a pointer leak in check_alu_op() of kernel/bpf/verifier.c. (bsc#1196130).
• CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers. (bsc#1196488)

The following non-security bugs were fixed:

• ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board (git-fixes).
• ACPI: APEI: fix return value of __setup handlers (git-fixes).
• ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 (git-fixes).
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (git-fixes).
• ACPI: docs: enumeration: Discourage to use custom _DSM methods (git-fixes).
• ACPI: docs: enumeration: Remove redundant .owner assignment (git-fixes).
• ACPI: properties: Consistently return -ENOENT if there are no more references (git-fixes).
• ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU (git-fixes).
• ALSA: cmipci:…

This update for the Linux Kernel 4.12.14-197_108 fixes several issues.

The following security issues were fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy. (bsc#1195065)

This update for the Linux Kernel 4.12.14-95_83 fixes one issue.

The following security issue was fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-0854: Fixed a memory leak flaw was found in the Linux kernels DMA subsystem. This flaw allowed a local user to read random memory from the kernel space. (bnc#1196823)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel. (bnc#1198031)
• CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel. (bnc#1198032)
• CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel. (bnc#1198033)
• CVE-2022-1055: Fixed a use-after-free in tc_new_tfilter that could allow a local attacker to gain privilege escalation. (bnc#1197702)
• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock. (bsc#1197331)
• CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file. (bnc#1197366)
• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
• CVE-2022-1199: Fixed null-ptr-deref and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. (bsc#1198028)
• CVE-2022-1205: Fixed null pointer dereference and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. (bsc#1198027)
• CVE-2022-1198: Fixed an use-after-free vulnerability that allow an attacker to crash the linux kernel by simulating Amateur Radio (bsc#1198030).
• CVE-2022-1195: Fixed an use-after-free vulnerability which could allow a local attacker with a user privilege to execute a denial of service. (bsc#1198029)
• CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems. (bnc#1197343)

The following non-security bugs were fixed:

• ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board (git-fixes).
• ACPI: APEI: fix return value of __setup handlers (git-fixes).
• ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 (git-fixes).
• ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (git-fixes).
• ACPI: docs: enumeration: Discourage to use custom _DSM methods (git-fixes).
• ACPI: docs: enumeration: Remove redundant .owner assignment (git-fixes).
• ACPI: docs: enumeration: Update UART serial bus resource documentation (git-fixes).
• ACPI: properties: Consistently return -ENOENT if there are no more references (git-fixes).
• ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU (git-fixes).
• ALSA: cmipci: Restore aux vol on suspend/resume (git-fixes).
• ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (git-fixes).
• ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GA402 (git-fixes).
• ALSA: oss: Fix PCM OSS buffer allocation overflow (git-fixes).
• ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec (git-fixes).
• ALSA: pcm: Add stream lock during PCM reset ioctl operations (git-fixes).
• ALSA: spi: Add check for clk_enable() (git-fixes).
• ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB (git-fixes).
• ASoC:…

This update for the Linux Kernel 4.12.14-122_106 fixes several issues.

The following security issues were fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy. (bsc#1195065)

This update for the Linux Kernel 4.12.14-122_113 fixes one issue.

The following security issue was fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)

This update for the Linux Kernel 4.12.14-197_89 fixes several issues.

The following security issues were fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy. (bsc#1195065)

This update for the Linux Kernel 5.3.18-24_86 fixes several issues.

The following security issues were fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy. (bsc#1195065)

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel. (bnc#1198033)
• CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel. (bnc#1198031)
• CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel. (bnc#1198032)
• CVE-2022-0812: Fixed an incorrect header size calculations which could lead to a memory leak. (bsc#1196639)
• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock. (bsc#1197331)
• CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
• CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from the memory via crafted frame lengths from a USB device. (bsc#1196836)
• CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file. (bnc#1197366)
• CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-after-free. (bnc#1196973)
• CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers. (bsc#1196488)
• CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could crash the system or corrupt the system memory. (bsc#1196830)
• CVE-2022-0001,CVE-2022-0002,CVE-2022-23960: Fixed a new kind of speculation issues, exploitable via JITed eBPF for instance. (bsc#1191580)
• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)

The following non-security bugs were fixed:

• asix: Add rx->ax_skb = NULL after usbnet_skb_return() (git-fixes).
• asix: Ensure asix_rx_fixup_info members are all reset (git-fixes).
• asix: Fix small memory leak in ax88772_unbind() (git-fixes).
• asix: fix uninit-value in asix_mdio_read() (git-fixes).
• asix: fix wrong return value in asix_check_host_enable() (git-fixes).
• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 (bsc#1196018).
• block: bfq: fix bfq_set_next_ioprio_data() (bsc#1191451).
• block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) (bsc#1194586).
• can: dev: can_restart: fix use after free bug (git-fixes).
• cgroup: Correct privileges check in release_agent writes (bsc#1196723).
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv (bsc#1196723).
• cgroup: Use open-time cgroup namespace for process migration perm checks (bsc#1196723).
• dax: update to new mmu_notifier semantic (bsc#1184207).
• drm: add a locked version of drm_is_current_master (bsc#1197914).
• drm: drm_file struct kABI compatibility workaround (bsc#1197914).
• drm: protect drm_master pointers in drm_lease.c (bsc#1197914).
• drm: serialize drm_file.master with a new spinlock (bsc#1197914).
• drm: use the lookup lock in drm_is_current_master (bsc#1197914).
• EDAC: Fix calculation of returned address and next offset in edac_align_ptr() (bsc#1114648).
• ena_netdev: use generic power management (bsc#1197099 jsc#SLE-24125).
• ena: Remove rcu_read_lock() around XDP program invocation (bsc#1197099 jsc#SLE-24125).
• ethernet: amazon: ena: A typo fix in…

The SUSE Linux Enterprise 15 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file. (bnc#1197366)
• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
• CVE-2022-1055: Fixed a use-after-free in tc_new_tfilter that could allow a local attacker to gain privilege escalation. (bnc#1197702)
• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock. (bsc#1197331)
• CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel. (bnc#1198031)
• CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel. (bnc#1198032)
• CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel. (bnc#1198033)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-0854: Fixed a memory leak flaw was found in the Linux kernels DMA subsystem. This flaw allowed a local user to read random memory from the kernel space. (bnc#1196823)
• CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from the memory via crafted frame lengths from a USB device. (bsc#1196836)
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)
• CVE-2021-0920: Fixed a race condition during UNIX socket garbage collection that could lead to local privilege escalation. (bsc#119373)
• CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers. (bsc#1196488)
• CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could crash the system or corrupt the system memory. (bsc#1196830)

The following non-security bugs were fixed:

• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 (bsc#1196018).
• cifs: use the correct max-length for dentry_path_raw() (bsc1196196).
• drm: add a locked version of drm_is_current_master (bsc#1197914).
• drm: drm_file struct kABI compatibility workaround (bsc#1197914).
• drm: protect drm_master pointers in drm_lease.c (bsc#1197914).
• drm: serialize drm_file.master with a new spinlock (bsc#1197914).
• drm: use the lookup lock in drm_is_current_master (bsc#1197914).
• net: tipc: validate domain record count on input (bsc#1195254).
• llc: fix netdevice reference leaks in llc_ui_bind() (git-fixes).
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (bsc#1196018).
• net/mlx5e: Fix page DMA map/unmap attributes (bsc#1196468).
• netfilter: conntrack: do not refresh sctp entries in closed state (bsc#1197389).
• powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() (bsc#1179639 ltc#189002 git-fixes).
• SUNRPC: avoid race between mod_timer() and del_timer_sync() (bnc#1195403).
• usb: host: xen-hcd: add missing unlock in error path (git-fixes).
• xen/usb: do not use gnttab_end_foreign_access() in xenhcd_gnttab_done() (bsc#1196488, XSA-396).

This update for the Linux Kernel 4.12.14-197_99 fixes several issues.

The following security issues were fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy. (bsc#1195065)

This update for the Linux Kernel 4.12.14-150_86 fixes one issue.

The following security issue was fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)

This update for the Linux Kernel 5.3.18-150300_59_46 fixes several issues.

The following security issues were fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy. (bsc#1195065)

This update for the Linux Kernel 5.3.18-150300_59_60 fixes several issues.

The following security issues were fixed:

• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)