CVE-2022-0330

The Linux Kernel, the operating system core itself.

Security Fix(es):

A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.(CVE-2022-0487)

A random memory access flaw was found in the Linux kernel’s GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.(CVE-2022-0330)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel symbol '__rt_mutex_init' is exported GPL-only in kernel 4.18.0-348.2.1.rt7.132.el8_5 (BZ#2038423)

• kernel-rt: update RT source tree to the Rocky Linux-8.5.z3 source tree (BZ#2045589)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888)

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel QAT Kernel power up fix (BZ#2016437)

• Rocky Linux8.4 seeing scsi_dma_map failed with mpt3sas driver and affecting performance (BZ#2018928)

• [Lenovo 8.4 bug] audio_HDMI certification failed on Rocky Linux 8.4GA (No hdmi out) (BZ#2027335)

• [Rocky Linux-8.5][4.18.0-323.el8.ppc64le][POWER8/9/10] security_flavor mode is not set back to zero post online migration (BZ#2027448)

• iommu/amd: Fix unable to handle page fault due to AVIC (BZ#2030854)

• [Lenovo 8.4 bug]The VGA display shows no signal (black screen) when install Rocky Linux8.4(beta or rc1) in the legacy BIOS mode. (BZ#2034949)

• Double free of kmalloc-64 cache struct ib_port->pkey_group from module ib_core . (BZ#2038724)

• Bus error with huge pages enabled (BZ#2039015)

• Rocky Linux8 - kvm: floating interrupts may get stuck (BZ#2040769)

• Data corruption on small files served by httpd, which is backed by cifs-mount (BZ#2041529)

• Add a net/mlx5 patch for Hardware Offload Fix (BZ#2042663)

• Windows guest random Bsod when 'hv-tlbflush' enlightenment is enabled (BZ#2043237)

• DNS lookup failures when run two times in a row (BZ#2043548)

• net/sched: Fix ct zone matching for invalid conntrack state (BZ#2043550)

• Kernel 4.18.0-348.2.1 secpath_cache memory leak involving strongswan tunnel (BZ#2047427)

• OCP node XFS metadata corruption after numerous reboots (BZ#2049292)

• Broadcom bnxt_re: RDMA stats are not incrementing (BZ#2049684)

• ice: bug fix series for 8.6 (BZ#2051951)

• panic while looking up a symlink due to NULL i_op->get_link (BZ#2052558)

• ceph omnibus backport for Rocky Linux-8.6.0 (BZ#2053725)

• SCTP peel-off with SELinux and containers in OCP (BZ#2054112)

• Selinux is not allowing SCTP connection setup between inter pod communication in enforcing mode (BZ#2054117)

• dnf fails with fsync() over local repository present on CIFS mount point (BZ#2055824)

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888)

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel QAT Kernel power up fix (BZ#2016437)

• AlmaLinux8.4 seeing scsi_dma_map failed with mpt3sas driver and affecting performance (BZ#2018928)

• [Lenovo 8.4 bug] audio_HDMI certification failed on AlmaLinux 8.4GA (No hdmi out) (BZ#2027335)

• [AlmaLinux-8.5][4.18.0-323.el8.ppc64le][POWER8/9/10] security_flavor mode is not set back to zero post online migration (BZ#2027448)

• iommu/amd: Fix unable to handle page fault due to AVIC (BZ#2030854)

• [Lenovo 8.4 bug]The VGA display shows no signal (black screen) when install AlmaLinux8.4(beta or rc1) in the legacy BIOS mode. (BZ#2034949)

• Double free of kmalloc-64 cache struct ib_port->pkey_group from module ib_core . (BZ#2038724)

• Bus error with huge pages enabled (BZ#2039015)

• AlmaLinux8 - kvm: floating interrupts may get stuck (BZ#2040769)

• Data corruption on small files served by httpd, which is backed by cifs-mount (BZ#2041529)

• Add a net/mlx5 patch for Hardware Offload Fix (BZ#2042663)

• Windows guest random Bsod when 'hv-tlbflush' enlightenment is enabled (BZ#2043237)

• DNS lookup failures when run two times in a row (BZ#2043548)

• net/sched: Fix ct zone matching for invalid conntrack state (BZ#2043550)

• Kernel 4.18.0-348.2.1 secpath_cache memory leak involving strongswan tunnel (BZ#2047427)

• OCP node XFS metadata corruption after numerous reboots (BZ#2049292)

• Broadcom bnxt_re: RDMA stats are not incrementing (BZ#2049684)

• ice: bug fix series for 8.6 (BZ#2051951)

• panic while looking up a symlink due to NULL i_op->get_link (BZ#2052558)

• ceph omnibus backport for AlmaLinux-8.6.0 (BZ#2053725)

• SCTP peel-off with SELinux and containers in OCP (BZ#2054112)

• Selinux is not allowing SCTP connection setup between inter pod communication in enforcing mode (BZ#2054117)

• dnf fails with fsync() over local repository present on CIFS mount point (BZ#2055824)

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• ALSA: control - introduce snd_ctl_notify_one() helper
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in parallel {CVE-2022-3028}
• dm verity: set DM_TARGET_IMMUTABLE feature flag {CVE-2022-20572}

• ALSA: pcm: Fix races among concurrent prealloc proc writes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent read/write and buffer changes {CVE-2022-1048}
• ALSA: pcm: Fix races among concurrent hw_params and hw_free calls {CVE-2022-1048}
• x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit {CVE-2022-25265}
• x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK {CVE-2022-25265}
• x86/elf: Add table to document READ_IMPLIES_EXEC {CVE-2022-25265}
• KVM: SEV-ES: fix another issue with string I/O VMGEXITs {CVE-2021-4093}
• KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed {CVE-2021-4093}
• KVM: SEV-ES: keep INS functions together {CVE-2021-4093}
• KVM: x86: remove unnecessary arguments from complete_emulator_pio_in {CVE-2021-4093}
• KVM: x86: split the two parts of emulator_pio_in {CVE-2021-4093}
• KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out {CVE-2021-4093}
• KVM: SEV-ES: clean up kvm_sev_es_ins/outs {CVE-2021-4093}
• KVM: SEV-ES: rename guest_ins_data to sev_pio_data {CVE-2021-4093}
• KVM: SEV-ES: fix length of string I/O {CVE-2021-4093}
• drm/i915: fix TLB invalidation for Gen12 video and compute engines {CVE-2022-4139}
• drm/i915: Flush TLBs before releasing backing store {CVE-2022-0330}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: Fix data races around sk->sk_prot. {CVE-2022-3567}
• ipv6: annotate some data-races around sk->sk_prot {CVE-2022-3567}
• ipv6: use indirect call wrappers for {tcp, udpv6}_{recv, send}msg() {CVE-2022-3567}
• netfilter: nf_tables: deactivate anonymous set from preparation phase {CVE-2023-32233}
• netfilter: nf_tables: bogus EBUSY when deleting set after flush
• media: dmxdev: fix UAF when dvb_register_device() fails {CVE-2022-41218}
• l2tp: Don't sleep and disable BH under writer-side sk_callback_lock {CVE-2022-4129}
• l2tp: Serialize access to sk_user_data with sk_callback_lock {CVE-2022-4129}
• net: fix a concurrency bug in l2tp_tunnel_register() {CVE-2022-4129}
• Bluetooth: L2CAP: Fix memory leak in vhci_write {CVE-2022-3619}
• Bluetooth: L2CAP: Fix handling fragmented length
• wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() {CVE-2022-3628}
• wifi: cfg80211: avoid nontransmitted BSS list corruption {CVE-2022-42721}
• cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
• wifi: cfg80211: fix BSS refcounting bugs {CVE-2022-42720}
• cfg80211: hold bss_lock while updating nontrans_list
• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• ALSA: control: Drop superfluous snd_power_wait() calls
• ALSA: control: Track in-flight control read/write/tlv accesses
• Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu {CVE-2022-3564}
• netfilter: nf_conntrack_irc: Tighten matching on DCC message {CVE-2022-2663}
• netfilter: nf_conntrack_irc: Fix forged IP logic {CVE-2022-2663}
• KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() {CVE-2022-2153}
• KVM: Add infrastructure and macro to mark VM as bugged
• KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID {CVE-2022-1789}
• tcp/udp: Fix memory leak in ipv6_renew_options(). {CVE-2022-3524}
• proc: proc_skip_spaces() shouldn't think it is working on C strings {CVE-2022-4378}
• proc: avoid integer type confusion in get_proc_long {CVE-2022-4378}
• wifi: mac80211: fix crash in beacon protection for P2P-device {CVE-2022-42722}
• net: sched: cbq: dont intepret cls results when asked to drop {CVE-2023-23454}
• ipv6: raw: Deduct extension header length in rawv6_push_pending_frames {CVE-2023-0394}
• net: sched: disallow noqueue for qdisc classes {CVE-2022-47929}
• wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() {CVE-2022-41674}
• af_key: Do not call xfrm_probe_algs in…

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• drm/i915: Fix the GT fence revocation runtime PM logic {CVE-2022-0330}
• PM: runtime: Add pm_runtime_get_if_active() {CVE-2022-0330}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• bpf: In bpf_task_fd_query use fget_task {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}
• vfs, fdtable: Add fget_task helper {CVE-2021-4083}

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}

This kernel update is based on upstream 5.15.18 and fixes at least the following security issues:

A random memory access flaw was found in the Linux kernels GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system (CVE-2022-0330).

A use-after-free flaw was found in the Linux kernels vmw_execbuf_copy_fence_user function in drivers/gpu/drm/vmwgfx/ vmwgfx_execbuf.c in vmwgfx. This flaw allows a local attacker with user privileges to cause a privilege escalation problem (CVE-2022-22942).

kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace (CVE-2022-24122).

Other fixes in this update:

• fix broken RTL8814AU support (mga#29952)
• fix cifs failing to load on server kernels (mga#29957)
• fix broken plymouth scaling (mga#29925)
• bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()
• fs/exec: require argv[0] presence in do_execveat_common()

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.18 and fixes at least the following security issues:

A random memory access flaw was found in the Linux kernels GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system (CVE-2022-0330).

A use-after-free flaw was found in the Linux kernels vmw_execbuf_copy_fence_user function in drivers/gpu/drm/vmwgfx/ vmwgfx_execbuf.c in vmwgfx. This flaw allows a local attacker with user privileges to cause a privilege escalation problem (CVE-2022-22942).

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).

The following security references were added to already fixed issues:

• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/core: Clean up cq pool mechanism (jsc#SLE-15176).
• RDMA/rxe: Remove the unnecessary variable (jsc#SLE-15176).
• ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (git-fixes).
• arm64: Kconfig: add a choice for endianness (jsc#SLE-23432).
• asix: fix wrong return value in asix_check_host_enable() (git-fixes).
• ata: pata_platform: Fix a NULL pointer dereference in __pata_platform_probe() (git-fixes).
• ath10k: Fix tx hanging (git-fixes).
• ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (git-fixes).
• batman-adv: allow netlink usage in unprivileged containers (git-fixes).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set…

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c (bnc#1194087).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device (bsc#1179599).
• CVE-2019-15126: Fixed a vulnerability in Broadcom…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Bluetooth: refactor malicious adv data check (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)…

These are all security issues fixed in the kernel-devel-5.16.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 12 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
• CVE-2019-0136: Fixed insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver that may have allowed an unauthenticated user to potentially enable denial of service via adjacent access (bnc#1193157).
• CVE-2020-35519: Fixed out-of-bounds memory access in x25_bind in net/x25/af_x25.c. A bounds check failure allowed a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information (bnc#1183696).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that may have allowed an authenticated user to potentially cause denial of service via local access (bnc#1192877).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4155: Fixed XFS map issue when unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (bsc#1194272).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-43976: Fixed insufficient access control in drivers/net/wireless/marvell/mwifiex/usb.c that allowed an attacker who connect a crafted USB device to cause denial of service (bnc#1192847).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-45485: Fixed information leak in the IPv6 implementation in net/ipv6/output_core.c (bnc#1194094).
• CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table (bnc#1194087).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

-…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).

The following security references were added to already fixed issues:

• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/core: Clean up cq pool mechanism (jsc#SLE-15176).
• RDMA/rxe: Remove the unnecessary variable (jsc#SLE-15176).
• ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (git-fixes).
• arm64: Kconfig: add a choice for endianness (jsc#SLE-23432).
• asix: fix wrong return value in asix_check_host_enable() (git-fixes).
• ata: pata_platform: Fix a NULL pointer dereference in __pata_platform_probe() (git-fixes).
• ath10k: Fix tx hanging (git-fixes).
• ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (git-fixes).
• batman-adv: allow netlink usage in unprivileged containers (git-fixes).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
• CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).

The following non-security bugs were fixed:

• KVM: remember position in kvm->vcpus array (bsc#1190973).
• KVM: s390: index kvm->arch.idle_mask by vcpu_idx (bsc#1190973).
• SUNRPC: Add basic load balancing to the transport switch - kabi fix. (bnc#1192729).
• SUNRPC: Add basic load balancing to the transport switch. (bnc#1192729)
• SUNRPC: Fix initialisation of struct rpc_xprt_switch (bnc#1192729).
• SUNRPC: Optimise transport balancing code (bnc#1192729).
• SUNRPC: Replace division by multiplication in calculation of queue length (bnc#1192729).
• SUNRPC: Skip zero-refcount transports (bnc#1192729).
• USB: serial: option: add Telit FN990 compositions (git-fixes).
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (bsc#1194227).
• crypto: qat - fix undetected PFVF timeout in ACK loop (git-fixes).
• ext4: set csum seed in tmp inode while migrating to extents (bsc#1195272).
• fget: clarify and improve __fget_files() implementation (bsc#1193727).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193507).
• ibmvnic: Allow extra failures before disabling (bsc#1195073 ltc#195713).
• ibmvnic: do not spin in tasklet (bsc#1195073 ltc#195713).
• ibmvnic: init ->running_cap_crqs early (bsc#1195073 ltc#195713).
• ibmvnic: remove unused ->wait_capability (bsc#1195073 ltc#195713).
• kABI fixup after adding vcpu_idx to struct kvm_cpu (bsc#1190973).
• kabi: mask new member 'empty' of struct Qdisc (bsc#1183405).
• kabi: revert drop of Qdisc::atomic_qlen (bsc#1183405).
• kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).
• livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
• memstick: rtsx_usb_ms: fix UAF (bsc#1194516).
• mm/hwpoison: do not lock page again when…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (bsc#1194227).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set improperly (bsc#1195009).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
• net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
• net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193506).
• net: allow retransmitting a TCP packet if original is still in queue (bsc#1188605 bsc#1187428).
• net: mana: Add RX fencing (bsc#1193506).
• net: mana: Add XDP support (bsc#1193506).
• net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc (bsc#1183405).
• net: sched: add barrier to ensure correct ordering for lockless qdisc (bsc#1183405).
• net: sched: avoid unnecessary seqcount operation for lockless qdisc (bsc#1183405).
• net: sched: fix packet stuck problem for lockless qdisc (bsc#1183405).
• net: sched: fix tx action reschedule issue with stopped queue (bsc#1183405).
• net: sched: fix tx action rescheduling issue during deactivation (bsc#1183405).
• net: sched: replaced invalid qdisc tree flush helper in qdisc_replace (bsc#1183405).
• net_sched: avoid resetting active qdisc for multiple times (bsc#1183405).
• net_sched: get rid of unnecessary dev_qdisc_reset() (bsc#1183405).
• net_sched: use qdisc_reset() in qdisc_destroy() (bsc#1183405).
• nvme: add 'iopolicy' module parameter (bsc#1177599 bsc#1193096).
• xfrm: fix MTU regression (bsc#1185377, bsc#1194048).