CVE-2022-30594

The Linux Kernel, the operating system core itself.

Security Fix(es):

There are use-after-free vulnerabilities in net/ax25/af_ax25.c of linux that allow attacker to crash linux kernel by simulating ax25 device from user space.(CVE-2022-1204)

The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.(CVE-2022-30594)

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-33981. Reason: This candidate is a reservation duplicate of CVE-2022-33981. Notes: All CVE users should reference CVE-2022-33981 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2022-1836)

With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.(CVE-2022-1789)

Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.(CVE-2021-33135)

perf: Fix sys_perf_event_open() race against self(CVE-2022-1729)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585)

• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel crash after reboot of T14/G2 AMD laptop (mt7921e module) (BZ#2095653)

• execve exit tracepoint not called (BZ#2106661)

• Matrox black screen on VGA output on some systems. (BZ#2112017)

• The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (BZ#2121129)

• watchdog BUG: soft lockup - CPU#30 stuck for 34s! [swapper/30:0] (BZ#2127857)

• Update cifs to 5.16 (BZ#2127858)

• Bad page state in process qemu-kvm pfn:68a74600 (BZ#2127859)

• vfio zero page mappings fail after 2M instances (BZ#2128791)

• The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (part 2) (BZ#2128970)

Enhancement(s):

• Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129453)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585)

• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Update RT source tree to the latest Rocky Linux-9.0.z4 Batch (BZ#2123498)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863)

• kernel-rt: update RT source tree to the latest Rocky Linux-9.1.z1 Batch (BZ#2141817)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)

• vfio zero page mappings fail after 2M instances (BZ#2128514)

• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

• ice: Driver Update to 5.19 (BZ#2132070)

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

• No signal showed in the VGA monitor when installing Rocky Linux9 in the legacy bios mode (BZ#2140153)

• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)

• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

• fatal error: error in backend: Branch target out of insn range (BZ#2144902)

• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)

• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)

• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)

• vfio zero page mappings fail after 2M instances (BZ#2128514)

• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

• ice: Driver Update to 5.19 (BZ#2132070)

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

• No signal showed in the VGA monitor when installing Rocky Linux SIG Cloud9 in the legacy bios mode (BZ#2140153)

• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)

• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

• fatal error: error in backend: Branch target out of insn range (BZ#2144902)

• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)

• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)

• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585)
• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel crash after reboot of T14/G2 AMD laptop (mt7921e module) (BZ#2095653)
• execve exit tracepoint not called (BZ#2106661)
• Matrox black screen on VGA output on some systems. (BZ#2112017)
• The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (BZ#2121129)
• watchdog BUG: soft lockup - CPU#30 stuck for 34s! [swapper/30:0] (BZ#2127857)
• Update cifs to 5.16 (BZ#2127858)
• Bad page state in process qemu-kvm pfn:68a74600 (BZ#2127859)
• vfio zero page mappings fail after 2M instances (BZ#2128791)
• The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (part 2) (BZ#2128970)

Enhancement(s):

• Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129453)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585)
• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Update RT source tree to the latest AlmaLinux-9.0.z4 Batch (BZ#2123498)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)
• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)
• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863)
• kernel-rt: update RT source tree to the latest AlmaLinux-9.1.z1 Batch (BZ#2141817)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)
• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)
• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)
• vfio zero page mappings fail after 2M instances (BZ#2128514)
• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)
• ice: Driver Update to 5.19 (BZ#2132070)
• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)
• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)
• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)
• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)
• No signal showed in the VGA monitor when installing AlmaLinux9 in the legacy bios mode (BZ#2140153)
• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)
• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)
• fatal error: error in backend: Branch target out of insn range (BZ#2144902)
• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)
• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)
• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)
• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds (CVE-2021-33656)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• media: em28xx: initialize refcount before kref_get (CVE-2022-3239)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• Executable Space Protection Bypass (CVE-2022-25265)
• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• Soft lockup occurred during __page_mapcount (CVE-2023-1582)
• slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2122230, BZ#2122267)

Security Fix(es):

• use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)
• net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
• hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
• malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
• when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds (CVE-2021-33656)
• possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)
• KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
• netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)
• race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)
• media: em28xx: initialize refcount before kref_get (CVE-2022-3239)
• race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)
• memory leak in ipv6_renew_options() (CVE-2022-3524)
• data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)
• data races around sk->sk_prot (CVE-2022-3567)
• memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
• denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
• use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)
• USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
• Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)
• l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)
• igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)
• Executable Space Protection Bypass (CVE-2022-25265)
• Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)
• unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
• TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189)
• Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)
• u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)
• use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
• use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)
• BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)
• Denial of service in beacon protection for P2P-device (CVE-2022-42722)
• memory corruption in usbmon driver (CVE-2022-43750)
• NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
• NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)
• use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
• Soft lockup occurred during __page_mapcount (CVE-2023-1582)
• slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
• net: mpls: fix stale pointer if allocation fails during device rename {CVE-2023-26545}
• net/ulp: prevent ULP without clone op from entering the LISTEN status {CVE-2023-0461}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() {CVE-2022-3640}
• mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
• usb: mon: make mmapped memory read only {CVE-2022-43750}
• ath9k: fix use-after-free in ath9k_hif_usb_rx_cb {CVE-2022-1679}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• netfilter: nf_tables: disallow non-stateful expression in sets earlier {CVE-2022-32250}
• perf: Fix sys_perf_event_open() race against self {CVE-2022-1729}
• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28388}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• media: em28xx: initialize refcount before kref_get {CVE-2022-3239}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE {CVE-2022-30594}
• af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
• Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() {CVE-2021-3640}
• igmp: Add ip_mc_list lock in ip_check_mc_rcu {CVE-2022-20141}
• af_unix: fix garbage collect vs MSG_PEEK {CVE-2021-0920}
• r8152: Rate limit overflow messages {CVE-2022-3594}

• media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
• net: mpls: fix stale pointer if allocation fails during device rename {CVE-2023-26545}
• net/ulp: prevent ULP without clone op from entering the LISTEN status {CVE-2023-0461}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() {CVE-2022-3640}
• mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
• usb: mon: make mmapped memory read only {CVE-2022-43750}
• ath9k: fix use-after-free in ath9k_hif_usb_rx_cb {CVE-2022-1679}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• netfilter: nf_tables: disallow non-stateful expression in sets earlier {CVE-2022-32250}
• perf: Fix sys_perf_event_open() race against self {CVE-2022-1729}
• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28388}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• media: em28xx: initialize refcount before kref_get {CVE-2022-3239}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE {CVE-2022-30594}
• af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
• Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() {CVE-2021-3640}
• igmp: Add ip_mc_list lock in ip_check_mc_rcu {CVE-2022-20141}
• af_unix: fix garbage collect vs MSG_PEEK {CVE-2021-0920}

The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.

It was discovered that a race condition existed in the network scheduling subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2021-39713)

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges.(CVE-2022-0492)

It was discovered that the network traffic control implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2022-1055)

Bing-Jhong Billy Jheng discovered that the io_uring subsystem in the Linux kernel contained in integer overflow. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-1116)

It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot restrictions.(CVE-2022-21499)

Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-29581)

Jann Horn discovered that the Linux kernel did not properly enforce seccomp restrictions in some situations. A local attacker could use this to bypass intended seccomp sandbox restrictions.(CVE-2022-30594)

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-20141: Fixwed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes). -…

This update for the Linux Kernel 4.12.14-95_88 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 4.12.14-95_96 fixes several issues.

The following security issue was fixed:

• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 4.12.14-122_103 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 4.12.14-197_102 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 5.3.18-24_107 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).

This update for the Linux Kernel 5.3.18-150300_59_60 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).

This update for the Linux Kernel 4.12.14-150100_197_111 fixes several issues.

The following security issue was fixed:

• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 5.3.18-59_16 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 5.3.18-150300_59_46 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).

This update for the Linux Kernel 5.3.18-150300_59_63 fixes several issues.

The following security issue was fixed:

• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 5.3.18-57 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 4.4.180-94_156 fixes several issues.

The following security issues were fixed:

• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197597).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

This update for the Linux Kernel 4.4.180-94_161 fixes several issues.

The following security issue was fixed:

• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199602).
• Add missing module_mutex lock to module notifier for previous live patches (bsc#1199834).

The SUSE Linux Enterprise 12 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel (bnc#1198031).
• CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel (bnc#1198032).
• CVE-2018-20784: Fixed a denial of service (infinite loop in update_blocked_averages) by mishandled leaf cfs_rq in kernel/sched/fair.c (bnc#1126703).
• CVE-2018-7755: Fixed an issue in the fd_locked_ioctl function in drivers/block/floppy.c. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (bnc#1084513).
• CVE-2020-10769: Fixed a buffer over-read flaw in the IPsec Cryptographic algorithm's module. This flaw allowed a local attacker with user privileges to cause a denial of service. (bnc#1173265)
• CVE-2021-28688: Fixed XSA-365 that includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains (bnc#1183646).
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2017-13695: Fixed a bug that caused a stack dump allowing local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table. (bnc#1055710)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2021-20321: Fixed…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).

The following non-security bugs were fixed:

• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes).
• ALSA: usb-audio: Configure sync endpoints before data (git-fixes).
• ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant (git-fixes).
• ALSA: usb-audio: Restore Rane SL-1 quirk (git-fixes).
• ALSA: wavefront: Proper check of get_user() error (git-fixes).
• ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling (git-fixes)
• ARM: 9170/1: fix panic when kasan and kprobe are enabled (git-fixes)
• ARM: 9187/1: JIVE: fix return value of __setup handler (git-fixes)
• ARM: config: u8500: Re-enable AB8500 battery charging (git-fixes)
• ARM: davinci: da850-evm: Avoid NULL pointer dereference (git-fixes)
• ARM: dts: am3517-evm: Fix misc pinmuxing (git-fixes)
• ARM: dts: armada-38x: Add generic compatible to UART nodes (git-fixes)
• ARM: dts: at91: fix pinctrl phandles (git-fixes)
• ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek (git-fixes)
• ARM: dts: at91: sama5d2: Fix PMERRLOC resource size (git-fixes)
• ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name (git-fixes)
• ARM: dts: bcm2835-rpi-b: Fix GPIO line names…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes).
• ALSA: usb-audio: Configure sync endpoints before data (git-fixes).
• ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant (git-fixes).
• ALSA: usb-audio: Restore Rane SL-1 quirk (git-fixes).
• ALSA: wavefront: Proper check of get_user() error (git-fixes).
• ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling (git-fixes)
• ARM: 9170/1: fix panic when kasan and kprobe are enabled (git-fixes)
• ARM: 9187/1: JIVE: fix return value of __setup handler (git-fixes)
• ARM: config: u8500: Re-enable AB8500 battery charging (git-fixes)
• ARM: davinci: da850-evm: Avoid NULL pointer dereference (git-fixes)
• ARM: dts: am3517-evm: Fix misc pinmuxing (git-fixes)
• ARM: dts: armada-38x: Add generic compatible to UART nodes (git-fixes)
• ARM:…

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2021-39711: In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to Incorrect Size Value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1197219).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).

The following non-security bugs were fixed:

• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ARM: 9110/1: oabi-compat: fix oabi epoll sparse warning (bsc#1129770)
• arm64: set plt* section addresses to 0x0 (git-fixes)
• arm64: Add missing ISB after invalidating TLB in __primary_switch (git-fixes)
• arm64: armv8_deprecated: Fix undef_hook mask for thumb setend (git-fixes)
• arm64: avoid -Woverride-init warning (git-fixes)
• arm64: berlin: Select DW_APB_TIMER_OF (git-fixes) Update arm64 default config too.
• arm64: Clear OSDLR_EL1 on CPU boot (git-fixes)
• arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1 (git-fixes).
• arm64: compat: Allow single-byte watchpoints on all addresses (git-fixes)
• arm64: compat: Reduce address limit (git-fixes)
• arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} (git-fixes)
• arm64: cpufeature: Fix the type of no FP/SIMD capability (git-fixes)
• arm64: cpufeature:…

The SUSE Linux Enterprise 12 SP3 kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
• CVE-2017-13695: Fixed a bug that caused a stack dump allowing local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table. (bnc#1055710)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-28688: Fixed XSA-365 that includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains (bnc#1183646).
• CVE-2020-10769: Fixed a buffer over-read flaw in the IPsec Cryptographic algorithm's module. This flaw allowed a local attacker with user privileges to cause a denial of service. (bnc#1173265)
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2018-7755: Fixed an issue in the fd_locked_ioctl function in drivers/block/floppy.c. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (bnc#1084513).
• CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
• CVE-2021-38208: Fixed a denial of service (NULL…

The SUSE Linux Enterprise 12 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)
• CVE-2021-39711: Fixed a possible out of bounds read due to Incorrect Size Value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1197219).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
• CVE-2021-43389: Fixed an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958).
• CVE-2019-20811: Fixed issue in rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, where a reference count is mishandled (bnc#1172456).
• CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055).
• CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c. (bnc#1198516)
• CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
• CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems. (bnc#1197343)

The following non-security bugs were fixed:

• btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized (bsc#1199399).
• btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized (bsc#1199399).
• debug: Lock down kgdb (bsc#1199426).
• dimlib: make DIMLIB a hidden symbol (bsc#1197099 jsc#SLE-24124).
• lib/dim: Fix -Wunused-const-variable warnings (bsc#1197099 jsc#SLE-24124).
• lib/dim: fix help text typos (bsc#1197099 jsc#SLE-24124).
• linux/dim: Add completions count to dim_sample (bsc#1197099 jsc#SLE-24124).
• linux/dim: Fix overflow in dim calculation (bsc#1197099 jsc#SLE-24124).
• linux/dim: Implement RDMA adaptive moderation (DIM) (bsc#1197099 jsc#SLE-24124).
• linux/dim: Move implementation to .c files (bsc#1197099 jsc#SLE-24124).
• linux/dim: Move logic to dim.h (bsc#1197099 jsc#SLE-24124).
• linux/dim: Remove 'net' prefix from internal DIM…

The SUSE Linux Enterprise 15 kernel was updated.

The following security bugs were fixed:

• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2017-13695: Fixed a bug that caused a stack dump allowing local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted ACPI table. (bnc#1055710)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2021-39711: In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to Incorrect Size Value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1197219).
• CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
• CVE-2021-43389: Fixed an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. (bnc#1191958)
• CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055).
• CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c. (bnc#1198516)
• CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
• CVE-2022-1011: Fixed an use-after-free vulnerability which could allow a local attacker to retireve (partial) /etc/shadow hashes or any other data from filesystem when he can mount a FUSE filesystems. (bnc#1197343)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2019-20811: Fixed issue in rx_queue_add_kobject() and…