CVE-2022-0847

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel symbol '__rt_mutex_init' is exported GPL-only in kernel 4.18.0-348.2.1.rt7.132.el8_5 (BZ#2038423)

• kernel-rt: update RT source tree to the Rocky Linux-8.5.z3 source tree (BZ#2045589)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888)

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel QAT Kernel power up fix (BZ#2016437)

• Rocky Linux8.4 seeing scsi_dma_map failed with mpt3sas driver and affecting performance (BZ#2018928)

• [Lenovo 8.4 bug] audio_HDMI certification failed on Rocky Linux 8.4GA (No hdmi out) (BZ#2027335)

• [Rocky Linux-8.5][4.18.0-323.el8.ppc64le][POWER8/9/10] security_flavor mode is not set back to zero post online migration (BZ#2027448)

• iommu/amd: Fix unable to handle page fault due to AVIC (BZ#2030854)

• [Lenovo 8.4 bug]The VGA display shows no signal (black screen) when install Rocky Linux8.4(beta or rc1) in the legacy BIOS mode. (BZ#2034949)

• Double free of kmalloc-64 cache struct ib_port->pkey_group from module ib_core . (BZ#2038724)

• Bus error with huge pages enabled (BZ#2039015)

• Rocky Linux8 - kvm: floating interrupts may get stuck (BZ#2040769)

• Data corruption on small files served by httpd, which is backed by cifs-mount (BZ#2041529)

• Add a net/mlx5 patch for Hardware Offload Fix (BZ#2042663)

• Windows guest random Bsod when 'hv-tlbflush' enlightenment is enabled (BZ#2043237)

• DNS lookup failures when run two times in a row (BZ#2043548)

• net/sched: Fix ct zone matching for invalid conntrack state (BZ#2043550)

• Kernel 4.18.0-348.2.1 secpath_cache memory leak involving strongswan tunnel (BZ#2047427)

• OCP node XFS metadata corruption after numerous reboots (BZ#2049292)

• Broadcom bnxt_re: RDMA stats are not incrementing (BZ#2049684)

• ice: bug fix series for 8.6 (BZ#2051951)

• panic while looking up a symlink due to NULL i_op->get_link (BZ#2052558)

• ceph omnibus backport for Rocky Linux-8.6.0 (BZ#2053725)

• SCTP peel-off with SELinux and containers in OCP (BZ#2054112)

• Selinux is not allowing SCTP connection setup between inter pod communication in enforcing mode (BZ#2054117)

• dnf fails with fsync() over local repository present on CIFS mount point (BZ#2055824)

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888)

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel QAT Kernel power up fix (BZ#2016437)

• AlmaLinux8.4 seeing scsi_dma_map failed with mpt3sas driver and affecting performance (BZ#2018928)

• [Lenovo 8.4 bug] audio_HDMI certification failed on AlmaLinux 8.4GA (No hdmi out) (BZ#2027335)

• [AlmaLinux-8.5][4.18.0-323.el8.ppc64le][POWER8/9/10] security_flavor mode is not set back to zero post online migration (BZ#2027448)

• iommu/amd: Fix unable to handle page fault due to AVIC (BZ#2030854)

• [Lenovo 8.4 bug]The VGA display shows no signal (black screen) when install AlmaLinux8.4(beta or rc1) in the legacy BIOS mode. (BZ#2034949)

• Double free of kmalloc-64 cache struct ib_port->pkey_group from module ib_core . (BZ#2038724)

• Bus error with huge pages enabled (BZ#2039015)

• AlmaLinux8 - kvm: floating interrupts may get stuck (BZ#2040769)

• Data corruption on small files served by httpd, which is backed by cifs-mount (BZ#2041529)

• Add a net/mlx5 patch for Hardware Offload Fix (BZ#2042663)

• Windows guest random Bsod when 'hv-tlbflush' enlightenment is enabled (BZ#2043237)

• DNS lookup failures when run two times in a row (BZ#2043548)

• net/sched: Fix ct zone matching for invalid conntrack state (BZ#2043550)

• Kernel 4.18.0-348.2.1 secpath_cache memory leak involving strongswan tunnel (BZ#2047427)

• OCP node XFS metadata corruption after numerous reboots (BZ#2049292)

• Broadcom bnxt_re: RDMA stats are not incrementing (BZ#2049684)

• ice: bug fix series for 8.6 (BZ#2051951)

• panic while looking up a symlink due to NULL i_op->get_link (BZ#2052558)

• ceph omnibus backport for AlmaLinux-8.6.0 (BZ#2053725)

• SCTP peel-off with SELinux and containers in OCP (BZ#2054112)

• Selinux is not allowing SCTP connection setup between inter pod communication in enforcing mode (BZ#2054117)

• dnf fails with fsync() over local repository present on CIFS mount point (BZ#2055824)

In multiple functions of iov_iter.c, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege in system libraries with no additional execution privileges needed. User interaction is not needed for exploitation.

• lib/iov_iter: initialize "flags" in new pipe_buffer (Max Kellermann) {CVE-2022-0847}

• lib/iov_iter: initialize "flags" in new pipe_buffer (Max Kellermann) {CVE-2022-0847}

This kernel update is based on upstream 5.15.25 and fixes at least the following security issues:

A vulnerability in the Linux kernel since version 5.8 due to uninitialized variables. It enables anybody to write arbitrary data to arbitrary files, even if the file is O_RDONLY, immutable or on a MS_RDONLY filesystem. It can be used to inject code into arbitrary processes (CVE-2022-0847).

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur (CVE-2022-25258).

An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (CVE-2022-25375).

net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload (CVE-2022-25636).

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.26 and fixes at least the following security issues:

A vulnerability in the Linux kernel since version 5.8 due to uninitialized variables. It enables anybody to write arbitrary data to arbitrary files, even if the file is O_RDONLY, immutable or on a MS_RDONLY filesystem. It can be used to inject code into arbitrary processes (CVE-2022-0847).

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur (CVE-2022-25258).

An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (CVE-2022-25375).

net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload (CVE-2022-25636).

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Bluetooth: refactor malicious adv data check (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
• IB/umad: Return EIO in case of when device disassociated (git-fixes)
• IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
• Input: wm97xx: Simplify resource management (git-fixes).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFS: Ensure the server had an up to date ctime before renaming (git-fixes).
• NFSD: Fix the behavior of READ near OFFSET_MAX…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bnc#1196235 ).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Drop PCI xgene patch that caused a regression for mxl4 (bsc#1195352)
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957).
• PM: hibernate: Remove register_nosave_region_late() (git-fixes).
• PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes).
• RDMA/cma: Use correct address when leaving multicast group (bsc#1181147).
• RDMA/core: Always release restrack object (git-fixes)
• RDMA/cxgb4: check for ipv6 address properly while destroying listener (git-fixes)
• RDMA/siw: Release xarray entry (git-fixes)
• RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147).
• USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes).
• USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes).
• USB: serial: cp210x: add NCR Retail IO box id (git-fixes).
• USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes).
• USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes).
• USB: serial: option: add ZTE MF286D modem (git-fixes).
• ata: libata-core: Disable TRIM on M88V29 (git-fixes).
• ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes).
• blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787).
• blk-mq: avoid to iterate over stale request (bsc#1193787).
• blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787).
• blk-mq: clearing flush request reference in tags->rqs (bsc#1193787).
• blk-mq:…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

These are all security issues fixed in the kernel-devel-5.16.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Bluetooth: refactor malicious adv data check (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
• IB/umad: Return EIO in case of when device disassociated (git-fixes)
• IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
• Input: wm97xx: Simplify resource management (git-fixes).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFS: Ensure the server had an up to date ctime before renaming (git-fixes).
• NFSD: Fix the behavior of READ near OFFSET_MAX…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934).
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• hv_netvsc: fix network namespace issues with VF support (bsc#1107207).
• hv_netvsc: move VF to same namespace as netvsc device (bsc#1107207).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).
• CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096).
• CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905).

The following non-security bugs were fixed:

• btrfs: check for missing device in btrfs_trim_fs (bsc#1195701).
• gve: Add RX context (jsc#SLE-23652).
• gve: Add a jumbo-frame device option (jsc#SLE-23652).
• gve: Add consumed counts to ethtool stats (jsc#SLE-23652).
• gve: Add optional metadata descriptor type GVE_TXD_MTD (jsc#SLE-23652).
• gve: Correct order of processing device options (jsc#SLE-23652).
• gve: Fix GFP flags when allocing pages (jsc#SLE-23652).
• gve: Implement packet continuation for RX (jsc#SLE-23652).
• gve: Implement suspend/resume/shutdown (jsc#SLE-23652).
• gve: Move the irq db indexes out of the ntfy block struct (jsc#SLE-23652).
• gve: Recording rx queue before sending to napi (jsc#SLE-23652).
• gve: Update gve_free_queue_page_list signature (jsc#SLE-23652).
• gve: Use kvcalloc() instead of kvzalloc() (jsc#SLE-23652).
• gve: fix for null pointer dereference (jsc#SLE-23652).
• gve: fix the wrong AdminQ buffer queue index check (jsc#SLE-23652).
• gve: fix unmatched u64_stats_update_end() (jsc#SLE-23652).
• gve: remove memory barrier around seqno (jsc#SLE-23652).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).
• net: tipc: validate domain record count on input (bsc#1195254).
• nfsd: allow delegation state ids to be revoked and then freed (bsc#1192483).
• nfsd: allow lock state ids to be revoked and then freed (bsc#1192483).
• nfsd: allow open state ids to be revoked and then freed (bsc#1192483).
• nfsd: do not admin-revoke NSv4.0 state ids (bsc#1192483).
• nfsd: prepare for supporting admin-revocation of state (bsc#1192483). -…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bnc#1196235 ).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Drop PCI xgene patch that caused a regression for mxl4 (bsc#1195352)
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957).
• PM: hibernate: Remove register_nosave_region_late() (git-fixes).
• PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes).
• RDMA/cma: Use correct address when leaving multicast group (bsc#1181147).
• RDMA/core: Always release restrack object (git-fixes)
• RDMA/cxgb4: check for ipv6 address properly while destroying listener (git-fixes)
• RDMA/siw: Release xarray entry (git-fixes)
• RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147).
• USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes).
• USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes).
• USB: serial: cp210x: add NCR Retail IO box id (git-fixes).
• USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes).
• USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes).
• USB: serial: option: add ZTE MF286D modem (git-fixes).
• ata: libata-core: Disable TRIM on M88V29 (git-fixes).
• ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes).
• blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787).
• blk-mq: avoid to iterate over stale request (bsc#1193787).
• blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787).
• blk-mq: clearing flush request reference in tags->rqs (bsc#1193787).
• blk-mq:…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

The following non-security bugs were fixed:

• Bluetooth: bfusb: fix division by zero in send path (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1114648).
• IB/rdmavt: Validate remote_addr during loopback atomic tests (bsc#1114685).
• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934). Make this work-around optional
• NFSv42: Do not fail clone() unless the OP_CLONE operation failed (git-fixes).
• NFSv42: Fix pagecache invalidation after COPY/CLONE (git-fixes).
• NFSv4: Handle case where the lookup of a directory fails (git-fixes).
• NFSv4: nfs_atomic_open() can race when looking up a non-regular file (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/bnxt_re: Fix query SRQ failure (bsc#1050244).
• RDMA/mlx5: Set user priority for DCT (bsc#1103991).
• RDMA/netlink: Add __maybe_unused to static inline in C file (bsc#1046306).
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• cxgb4: fix eeprom len when diagnostics not implemented (bsc#1097585 bsc#1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584).
• e1000e: Fix packet loss on Tiger Lake and later (bsc#1158533).
• ext4: avoid trim error on fs with small groups (bsc#1191271).
• fuse: annotate lock in fuse_reverse_inval_entry() (bsc#1195795).
• gve: Add RX context (bsc#1191655).
• gve: Add a jumbo-frame device option (bsc#1191655).
• gve: Add consumed counts to ethtool stats (bsc#1191655).
• gve: Add netif_set_xps_queue call (bsc#1191655).
• gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655).
• gve: Add rx buffer pagecnt bias (bsc#1191655).
• gve: Allow pageflips on larger pages (bsc#1191655).
• gve: Avoid freeing NULL pointer (bsc#1191655).
• gve: Correct available tx qpl check (bsc#1191655).
• gve: Correct order of processing device options (bsc#1191655).
• gve: DQO: avoid unused variable warnings (bsc#1191655).
• gve: Do lazy cleanup in TX path (bsc#1191655).
• gve: Fix GFP flags when allocing pages (bsc#1191655).
• gve: Implement packet continuation for RX (bsc#1191655).
• gve: Implement suspend/resume/shutdown (bsc#1191655).
• gve: Move the irq db indexes out of the ntfy block struct (bsc#1191655).
• gve: Properly handle errors in gve_assign_qpl (bsc#1191655).
• gve: Recording rx queue before sending to napi (bsc#1191655).
• gve: Switch to use napi_complete_done (bsc#1191655).
• gve: Track RX buffer allocation failures (bsc#1191655).
• gve: Update gve_free_queue_page_list signature (bsc#1191655).
• gve: Use kvcalloc() instead of kvzalloc() (bsc#1191655).
• gve: fix for null pointer dereference (bsc#1191655).
• gve: fix gve_get_stats() (bsc#1191655).
• gve: fix the wrong AdminQ buffer queue index check (bsc#1191655).
• gve: fix unmatched u64_stats_update_end() (bsc#1191655).
• gve: remove memory…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bnc#1196235 ).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494). CONFIG_NVME_TARGET=m CONFIG_NVME_TARGET_PASSTHRU=y CONFIG_NVME_TARGET_LOOP=m CONFIG_NVME_TARGET_RDMA=m CONFIG_NVME_TARGET_FC=m CONFIG_NVME_TARGET_FCLOOP=m CONFIG_NVME_TARGET_TCP=m
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957).
• PM: hibernate: Remove register_nosave_region_late() (git-fixes).
• PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes).
• RDMA/cma: Use correct address when leaving multicast group (bsc#1181147).
• RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147).
• USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes).
• USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes).
• USB: serial: cp210x: add NCR Retail IO box id (git-fixes).
• USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes).
• USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes).
• USB: serial: option: add ZTE MF286D modem (git-fixes).
• ata: libata-core: Disable TRIM on M88V29 (git-fixes).
• ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes).
• blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787).
• blk-mq: avoid to iterate over stale request (bsc#1193787).
• blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787).
• blk-mq: clearing flush request reference in tags->rqs (bsc#1193787).
• blk-mq: do not grab rq's refcount in blk_mq_check_expired() (bsc#1193787 git-fixes).
• blk-mq: fix is_flush_rq (bsc#1193787 git-fixes).
• blk-mq: fix kernel panic during iterating over flush request (bsc#1193787 git-fixes).
• blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter (bsc#1193787).
• blk-mq: mark flush request as IDLE in…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).

The following non-security bugs were fixed:

• btrfs: check for missing device in btrfs_trim_fs (bsc#1195701).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).
• nfsd: allow delegation state ids to be revoked and then freed (bsc#1192483).
• nfsd: allow open state ids to be revoked and then freed (bsc#1192483).
• nfsd: do not admin-revoke NSv4.0 state ids (bsc#1192483).
• nfsd: prepare for supporting admin-revocation of state (bsc#1192483).
• powerpc/pseries/ddw: Revert 'Extend upper limit for huge DMA window for persistent memory' (bsc#1195995 ltc#196394).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bsc#1193867).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• Bluetooth: bfusb: fix division by zero in send path (git-fixes).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1114648).
• IB/rdmavt: Validate remote_addr during loopback atomic tests (bsc#1114685).
• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934). Make this work-around optional
• NFSv42: Do not fail clone() unless the OP_CLONE operation failed (git-fixes).
• NFSv42: Fix pagecache invalidation after COPY/CLONE (git-fixes).
• NFSv4: Handle case where the lookup of a directory fails (git-fixes).
• NFSv4: nfs_atomic_open() can race when looking up a non-regular file (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/bnxt_re: Fix query SRQ failure (bsc#1050244).
• RDMA/mlx5: Set user priority for DCT (bsc#1103991).
• RDMA/netlink: Add __maybe_unused to static inline in C file (bsc#1046306).
• Replace with an alternative fix for bsc#1185377
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• cxgb4: fix eeprom len when diagnostics not implemented (bsc#1097585 bsc#1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584).
• e1000e: Fix packet loss on Tiger Lake and later (bsc#1158533).
• ext4: avoid trim error on fs with small groups (bsc#1191271).
• fuse: annotate lock in fuse_reverse_inval_entry() (bsc#1195795).
• gve: Add RX context (bsc#1191655).
• gve: Add a jumbo-frame device option (bsc#1191655).
• gve: Add consumed counts to ethtool stats (bsc#1191655).
• gve: Add netif_set_xps_queue call (bsc#1191655).
• gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655).
• gve: Add rx buffer pagecnt bias (bsc#1191655).
• gve: Allow pageflips on larger pages (bsc#1191655).
• gve: Avoid freeing NULL pointer (bsc#1191655).
• gve: Correct available tx qpl check (bsc#1191655).
• gve: Correct order of processing device options (bsc#1191655).
• gve: DQO: avoid unused variable warnings (bsc#1191655).
• gve: Do lazy…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• hv_netvsc: fix network namespace issues with VF support (bsc#1107207).
• hv_netvsc: move VF to same namespace as netvsc device (bsc#1107207).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bsc#1193867).

The following non-security bugs were fixed:

• Bluetooth: bfusb: fix division by zero in send path (git-fixes).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1114648).
• IB/rdmavt: Validate remote_addr during loopback atomic tests (bsc#1114685).
• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934). Make this work-around optional
• NFSv42: Do not fail clone() unless the OP_CLONE operation failed (git-fixes).
• NFSv42: Fix pagecache invalidation after COPY/CLONE (git-fixes).
• NFSv4: Handle case where the lookup of a directory fails (git-fixes).
• NFSv4: nfs_atomic_open() can race when looking up a non-regular file (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/bnxt_re: Fix query SRQ failure (bsc#1050244).
• RDMA/mlx5: Set user priority for DCT (bsc#1103991).
• RDMA/netlink: Add __maybe_unused to static inline in C file (bsc#1046306).
• Replace with an alternative fix for bsc#1185377
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• cxgb4: fix eeprom len when diagnostics not implemented (bsc#1097585 bsc#1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584).
• e1000e: Fix packet loss on Tiger Lake and later (bsc#1158533).
• ext4: avoid trim error on fs with small groups (bsc#1191271).
• fuse: annotate lock in fuse_reverse_inval_entry() (bsc#1195795).
• gve: Add RX context (bsc#1191655).
• gve: Add a jumbo-frame device option (bsc#1191655).
• gve: Add consumed counts to ethtool stats (bsc#1191655).
• gve: Add netif_set_xps_queue call (bsc#1191655).
• gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655).
• gve: Add rx buffer pagecnt bias (bsc#1191655).
• gve: Allow pageflips on larger pages (bsc#1191655).
• gve: Avoid freeing NULL pointer (bsc#1191655).
• gve: Correct available tx qpl check (bsc#1191655).
• gve: Correct order of processing device options (bsc#1191655).
• gve: DQO: avoid unused variable warnings (bsc#1191655).
• gve: Do lazy cleanup in…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-25636)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by ARM to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-23960)

Max Kellermann discovered that the Linux kernel incorrectly handled Unix pipes. A local attacker could potentially use this to modify any file that could be opened for reading. (CVE-2022-0847)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-0001, CVE-2022-0002)

Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-25636)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by ARM to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-23960)

It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in certain situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-23222)

Max Kellermann discovered that the Linux kernel incorrectly handled Unix pipes. A local attacker could potentially use this to modify any file that could be opened for reading. (CVE-2022-0847)

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. (CVE-2022-0492)

William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-0185)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-0001)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

It was discovered that the NFS server implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4090)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

It was discovered that the AMD Radeon GPU driver in the Linux kernel did not properly validate writes in the debugfs file system. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-42327)

Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330)

Samuel Page discovered that the Transparent Inter-Process Communication (TIPC) protocol implementation in the Linux kernel contained a stack-based buffer overflow. A remote attacker could use this to cause a denial of service (system crash) for systems that have a TIPC bearer configured. (CVE-2022-0435)

It was discovered that the KVM implementation for s390 systems in the Linux kernel did not properly prevent memory operations on PVM guests that were in non-protected mode. A local attacker could use this to obtain unauthorized memory write access. (CVE-2022-0516)

It was discovered that the ICMPv6 implementation in the Linux kernel did not properly deallocate memory in certain situations. A remote attacker could possibly use this to cause a denial of service (memory exhaustion). (CVE-2022-0742)

It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain failure…