CVE-2021-39657

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).(CVE-2021-43976)

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References: Upstream kernel(CVE-2021-0941)

In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry.(CVE-2021-45469)

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.(CVE-2021-44733)

In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194696049References: Upstream kernel(CVE-2021-39657)

A flaw memory leak in the Linux kernel s eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.(CVE-2021-4135)

There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long. Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.(CVE-2021-28715)

The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing.(CVE-2021-28714)

Running PV backends in driver domains has one primary security advantage, if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. (CVE-2021-28713)

Running PV backends in driver domains has one primary security advantage, if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. (CVE-2021-28712)

Running PV backends in driver domains has one primary security advantage, if a driver domain gets compromised, it doesn't have the privileges to take over the system. However, a malicious driver domain could try to attack other guests via sending events at a high frequency leading to a Denial of Service in the guest due to trying to service interrupts for elongated amounts of time. (CVE-2021-28711)

In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194696049References: Upstream kernel

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).

The following security references were added to already fixed issues:

• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/core: Clean up cq pool mechanism (jsc#SLE-15176).
• RDMA/rxe: Remove the unnecessary variable (jsc#SLE-15176).
• ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (git-fixes).
• arm64: Kconfig: add a choice for endianness (jsc#SLE-23432).
• asix: fix wrong return value in asix_check_host_enable() (git-fixes).
• ata: pata_platform: Fix a NULL pointer dereference in __pata_platform_probe() (git-fixes).
• ath10k: Fix tx hanging (git-fixes).
• ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (git-fixes).
• batman-adv: allow netlink usage in unprivileged containers (git-fixes).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set…

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c (bnc#1194087).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device (bsc#1179599).
• CVE-2019-15126: Fixed a vulnerability in Broadcom…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Bluetooth: refactor malicious adv data check (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299).
• CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd(). (bsc#1196155)
• CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096).
• CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free vulnerability in unix_scm_to_skb of af_unix (bsc#1193731).
• CVE-2021-39657: Fixed an information leak in the Universal Flash Storage subsystem (bsc#1193864).

The following non-security bugs were fixed:

• ALSA: intel_hdmi: Fix reference to PCM buffer address (git-fixes).
• ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (git-fixes).
• ARM: Fix kgdb breakpoint for Thumb2 (git-fixes).
• ASoC: cs4265: Fix the duplicated control name (git-fixes).
• ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (git-fixes).
• ASoC: rt5668: do not block workqueue if card is unbound (git-fixes).
• ASoC: rt5682: do not block workqueue if card is unbound (git-fixes).
• Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE (bsc#1196779).
• EDAC/altera: Fix deferred probing (bsc#1178134).
• HID: add mapping for KEY_ALL_APPLICATIONS (git-fixes).
• HID: add mapping for KEY_DICTATE (git-fixes).
• Hand over the maintainership to SLE15-SP3 maintainers
• IB/hfi1: Correct guard on eager buffer deallocation (git-fixes).
• IB/hfi1: Fix early init panic (git-fixes).
• IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr (git-fixes).
• IB/hfi1: Insure use of smp_processor_id() is preempt disabled (git-fixes).
• IB/rdmavt: Validate remote_addr during loopback atomic tests (git-fixes).
• Input: clear BTN_RIGHT/MIDDLE on buttonpads (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• RDMA/bnxt_re: Scan the whole bitmap when checking if 'disabling RCFW with pending cmd-bit' (git-fixes).
• RDMA/cma: Do not change route.addr.src_addr outside state checks (bsc#1181147).
• RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry (git-fixes).
• RDMA/cma: Remove open coding of overflow checking for private_data_len (git-fixes).
• RDMA/core: Do not infoleak GRH fields (git-fixes).
• RDMA/core: Let ib_find_gid() continue search even after empty entry (git-fixes).
• RDMA/cxgb4: Set queue pair state when being queried…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299).
• CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd(). (bsc#1196155)
• CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096).
• CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free vulnerability in unix_scm_to_skb of af_unix (bsc#1193731).
• CVE-2021-39657: Fixed an information leak in the Universal Flash Storage subsystem (bsc#1193864).
• CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from heap memory via crafted frame lengths from a device (bsc#1196836).
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)
• CVE-2021-45402: The check_alu_op function in kernel/bpf/verifier.c did not properly update bounds while handling the mov32 instruction, which allowed local users to obtain potentially sensitive address information (bsc#1196130).
• CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers. (bsc#1196488)

The following non-security bugs were fixed:

• ALSA: intel_hdmi: Fix reference to PCM buffer address (git-fixes).
• ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (git-fixes).
• ARM: Fix kgdb breakpoint for Thumb2 (git-fixes).
• ASoC: cs4265: Fix the duplicated control name (git-fixes).
• ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (git-fixes).
• ASoC: rt5668: do not block workqueue if card is unbound (git-fixes).
• ASoC: rt5682: do not block workqueue if card is unbound (git-fixes).
• Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE (bsc#1196779).
• EDAC/altera: Fix deferred probing (bsc#1178134).
• EDAC: Fix calculation of returned address and next offset in edac_align_ptr() (bsc#1178134).
• HID: add mapping for KEY_ALL_APPLICATIONS (git-fixes).
• HID: add mapping for KEY_DICTATE (git-fixes).
• Hand over the maintainership to SLE15-SP3 maintainers
• IB/hfi1: Correct guard on eager buffer deallocation (git-fixes).
• IB/hfi1: Fix early init panic…

In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

The SUSE Linux Enterprise 12 SP3 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
• CVE-2019-0136: Fixed insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver that may have allowed an unauthenticated user to potentially enable denial of service via adjacent access (bnc#1193157).
• CVE-2020-35519: Fixed out-of-bounds memory access in x25_bind in net/x25/af_x25.c. A bounds check failure allowed a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information (bnc#1183696).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that may have allowed an authenticated user to potentially cause denial of service via local access (bnc#1192877).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4155: Fixed XFS map issue when unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (bsc#1194272).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-43976: Fixed insufficient access control in drivers/net/wireless/marvell/mwifiex/usb.c that allowed an attacker who connect a crafted USB device to cause denial of service (bnc#1192847).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-45485: Fixed information leak in the IPv6 implementation in net/ipv6/output_core.c (bnc#1194094).
• CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table (bnc#1194087).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

-…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).

The following security references were added to already fixed issues:

• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/core: Clean up cq pool mechanism (jsc#SLE-15176).
• RDMA/rxe: Remove the unnecessary variable (jsc#SLE-15176).
• ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply (git-fixes).
• arm64: Kconfig: add a choice for endianness (jsc#SLE-23432).
• asix: fix wrong return value in asix_check_host_enable() (git-fixes).
• ata: pata_platform: Fix a NULL pointer dereference in __pata_platform_probe() (git-fixes).
• ath10k: Fix tx hanging (git-fixes).
• ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (git-fixes).
• batman-adv: allow netlink usage in unprivileged containers (git-fixes).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
• CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).

The following non-security bugs were fixed:

• KVM: remember position in kvm->vcpus array (bsc#1190973).
• KVM: s390: index kvm->arch.idle_mask by vcpu_idx (bsc#1190973).
• SUNRPC: Add basic load balancing to the transport switch - kabi fix. (bnc#1192729).
• SUNRPC: Add basic load balancing to the transport switch. (bnc#1192729)
• SUNRPC: Fix initialisation of struct rpc_xprt_switch (bnc#1192729).
• SUNRPC: Optimise transport balancing code (bnc#1192729).
• SUNRPC: Replace division by multiplication in calculation of queue length (bnc#1192729).
• SUNRPC: Skip zero-refcount transports (bnc#1192729).
• USB: serial: option: add Telit FN990 compositions (git-fixes).
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (bsc#1194227).
• crypto: qat - fix undetected PFVF timeout in ACK loop (git-fixes).
• ext4: set csum seed in tmp inode while migrating to extents (bsc#1195272).
• fget: clarify and improve __fget_files() implementation (bsc#1193727).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193507).
• ibmvnic: Allow extra failures before disabling (bsc#1195073 ltc#195713).
• ibmvnic: do not spin in tasklet (bsc#1195073 ltc#195713).
• ibmvnic: init ->running_cap_crqs early (bsc#1195073 ltc#195713).
• ibmvnic: remove unused ->wait_capability (bsc#1195073 ltc#195713).
• kABI fixup after adding vcpu_idx to struct kvm_cpu (bsc#1190973).
• kabi: mask new member 'empty' of struct Qdisc (bsc#1183405).
• kabi: revert drop of Qdisc::atomic_qlen (bsc#1183405).
• kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).
• livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
• memstick: rtsx_usb_ms: fix UAF (bsc#1194516).
• mm/hwpoison: do not lock page again when…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (bsc#1194227).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set improperly (bsc#1195009).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
• net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
• net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193506).
• net: allow retransmitting a TCP packet if original is still in queue (bsc#1188605 bsc#1187428).
• net: mana: Add RX fencing (bsc#1193506).
• net: mana: Add XDP support (bsc#1193506).
• net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc (bsc#1183405).
• net: sched: add barrier to ensure correct ordering for lockless qdisc (bsc#1183405).
• net: sched: avoid unnecessary seqcount operation for lockless qdisc (bsc#1183405).
• net: sched: fix packet stuck problem for lockless qdisc (bsc#1183405).
• net: sched: fix tx action reschedule issue with stopped queue (bsc#1183405).
• net: sched: fix tx action rescheduling issue during deactivation (bsc#1183405).
• net: sched: replaced invalid qdisc tree flush helper in qdisc_replace (bsc#1183405).
• net_sched: avoid resetting active qdisc for multiple times (bsc#1183405).
• net_sched: get rid of unnecessary dev_qdisc_reset() (bsc#1183405).
• net_sched: use qdisc_reset() in qdisc_destroy() (bsc#1183405).
• nvme: add 'iopolicy' module parameter (bsc#1177599 bsc#1193096).
• xfrm: fix MTU regression (bsc#1185377, bsc#1194048).

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c (bnc#1194087).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device (bsc#1179599).
• CVE-2019-15126: Fixed a vulnerability in Broadcom…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-45486: Fixed an information leak because the hash table is very small in net/ipv4/route.c (bnc#1194087).
• CVE-2021-0920: Fixed a local privilege escalation due to an use after free bug in unix_gc (bsc#1193731).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28714: Fixed issue with xen/netback to handle rx queue stall detection (XSA-392) (bsc#1193442).
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device (bsc#1179599).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-43975: hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allowed an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value (bnc#1192845).
• CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may have allowed an authenticated…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Bluetooth: refactor malicious adv data check (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)…

The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
• CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table (bnc#1194087).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2021-43976: Fixed a flaw that could allow an attacker (who can connect a crafted USB device) to cause a denial of service. (bnc#1192847)
• CVE-2021-43975: Fixed a flaw in hw_atl_utils_fw_rpc_wait that could allow an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value. (bsc#1192845)
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4002: Fixed a missing TLB flush that could lead to leak or corruption of data in hugetlbfs. (bsc#1192946)
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-33098: Fixed a potential denial of service in Intel(R) Ethernet ixgbe driver due to improper input validation. (bsc#1192877)
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-28714: Fixed issue with xen/netback to add rx queue stall detection (XSA-392) (bsc#1193442).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-0920: Fixed use after free bug due to a race condition in unix_scm_to_skb of af_unix.c. This could have led to local escalation of privilege with System execution privileges needed (bnc#1193731).
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
• CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4159: Fixed kernel ptr leak vulnerability via BPF in coerce_reg_to_size (bsc#1194227).

The following non-security bugs were fixed:

• KVM: remember position in kvm->vcpus array (bsc#1190973).
• KVM: s390: index kvm->arch.idle_mask by vcpu_idx (bsc#1190973).
• SUNRPC: Add basic load balancing to the transport switch - kabi fix. (bnc#1192729).
• SUNRPC: Add basic load balancing to the transport switch. (bnc#1192729)
• SUNRPC: Fix initialisation of struct rpc_xprt_switch (bnc#1192729).
• SUNRPC: Optimise transport balancing code (bnc#1192729).
• SUNRPC: Replace division by multiplication in calculation of queue length (bnc#1192729).
• SUNRPC: Skip zero-refcount transports (bnc#1192729).
• USB: serial: option: add Telit FN990 compositions (git-fixes).
• crypto: qat - fix undetected PFVF timeout in ACK loop (git-fixes).
• ext4: set csum seed in tmp inode while migrating to extents (bsc#1195272).
• fget: clarify and improve __fget_files() implementation (bsc#1193727).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193507).
• ibmvnic: Allow extra failures before disabling (bsc#1195073 ltc#195713).
• ibmvnic: do not spin in tasklet (bsc#1195073 ltc#195713).
• ibmvnic: init ->running_cap_crqs early (bsc#1195073 ltc#195713).
• ibmvnic: remove unused ->wait_capability (bsc#1195073 ltc#195713).
• kABI fixup after adding vcpu_idx to struct kvm_cpu (bsc#1190973).
• kabi: mask new member 'empty' of struct Qdisc (bsc#1183405).
• kabi: revert drop of Qdisc::atomic_qlen (bsc#1183405).
• livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
• memstick: rtsx_usb_ms: fix UAF (bsc#1194516).
• mm/hwpoison: do not lock page again when me_huge_page() successfully recovers (bsc#1194814).
• moxart: fix potential use-after-free on remove path (bsc#1194516).
• net, xdp: Introduce xdp_init_buff…

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-25020: Fixed an overflow in the BPF subsystem due to a mishandling of a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions. This affects kernel/bpf/core.c and net/core/filter.c (bnc#1193575).
• CVE-2019-0136: Fixed insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver that may have allowed an unauthenticated user to potentially enable denial of service via adjacent access (bnc#1193157).
• CVE-2020-35519: Fixed out-of-bounds memory access in x25_bind in net/x25/af_x25.c. A bounds check failure allowed a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information (bnc#1183696).
• CVE-2021-0935: Fixed possible out of bounds write in ip6_xmit of ip6_output.c due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1192032).
• CVE-2021-28711: Fixed issue with xen/blkfront to harden blkfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28712: Fixed issue with xen/netfront to harden netfront against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28713: Fixed issue with xen/console to harden hvc_xen against event channel storms (XSA-391) (bsc#1193440).
• CVE-2021-28715: Fixed issue with xen/netback to do not queue unlimited number of packages (XSA-392) (bsc#1193442).
• CVE-2021-33098: Fixed improper input validation in the Intel(R) Ethernet ixgbe driver that may have allowed an authenticated user to potentially cause denial of service via local access (bnc#1192877).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-4002: Fixed incorrect TLBs flush in hugetlbfs after huge_pmd_unshare (bsc#1192946).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4155: Fixed XFS map issue when unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (bsc#1194272).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-43976: Fixed insufficient access control in drivers/net/wireless/marvell/mwifiex/usb.c that allowed an attacker who connect a crafted USB device to cause denial of service (bnc#1192847).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2021-45485: Fixed information leak in the IPv6 implementation in net/ipv6/output_core.c (bnc#1194094).
• CVE-2021-45486: Fixed information leak inside the IPv4 implementation caused by very small hash table (bnc#1194087).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

-…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-0286: Fixed null pointer dereference in bond_ipsec_add_sa() that may have lead to local denial of service (bnc#1195371).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-39685: Fixed USB gadget buffer overflow caused by too large endpoint 0 requests (bsc#1193802).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

• ACPI: battery: Add the ThinkPad 'Not Charging' quirk (git-fixes).
• ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() (git-fixes).
• ACPICA: Fix wrong interpretation of PCC address (git-fixes).
• ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 (git-fixes).
• ACPICA: Utilities: Avoid deleting the same object twice in a row (git-fixes).
• ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions (git-fixes).
• ALSA: seq: Set upper limit of processed events (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Bluetooth: Fix debugfs entry leak in hci_register_dev() (git-fixes).
• Bluetooth: refactor malicious adv data check (git-fixes).
• Documentation: fix firewire.rst ABI file path error (git-fixes).
• HID: apple: Do not reset quirks when the Fn key is not found (git-fixes).
• HID: quirks: Allow inverting the absolute X/Y values (git-fixes).
• HID: uhid: Fix worker destroying device without any protection (git-fixes).
• HID: wacom: Reset expected and received contact counts at the same time (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
• IB/umad: Return EIO in case of when device disassociated (git-fixes)
• IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
• Input: wm97xx: Simplify resource management (git-fixes).
• NFS: Ensure the…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-22600: Fixed double free bug in packet_set_ring() in net/packet/af_packet.c that could have been exploited by a local user through crafted syscalls to escalate privileges or deny service (bnc#1195184).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).

The following non-security bugs were fixed:

• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (bsc#1194227).
• btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
• btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
• btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being set improperly (bsc#1195009).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
• net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
• net, xdp: Introduce xdp_prepare_buff utility routine (bsc#1193506).
• net: allow retransmitting a TCP packet if original is still in queue (bsc#1188605 bsc#1187428).
• net: mana: Add RX fencing (bsc#1193506).
• net: mana: Add XDP support (bsc#1193506).
• net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc (bsc#1183405).
• net: sched: add barrier to ensure correct ordering for lockless qdisc (bsc#1183405).
• net: sched: avoid unnecessary seqcount operation for lockless qdisc (bsc#1183405).
• net: sched: fix packet stuck problem for lockless qdisc (bsc#1183405).
• net: sched: fix tx action reschedule issue with stopped queue (bsc#1183405).
• net: sched: fix tx action rescheduling issue during deactivation (bsc#1183405).
• net: sched: replaced invalid qdisc tree flush helper in qdisc_replace (bsc#1183405).
• net_sched: avoid resetting active qdisc for multiple times (bsc#1183405).
• net_sched: get rid of unnecessary dev_qdisc_reset() (bsc#1183405).
• net_sched: use qdisc_reset() in qdisc_destroy() (bsc#1183405).
• nvme: add 'iopolicy' module parameter (bsc#1177599 bsc#1193096).
• xfrm: fix MTU regression (bsc#1185377, bsc#1194048).

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input (bsc#1195254).
• CVE-2022-24448: Fixed an issue inside fs/nfs/dir.c if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup (bnc#1195612).
• CVE-2021-3564: Fixed double-free memory corruption in the Linux kernel HCI device initialization subsystem that could have been used by attaching malicious HCI TTY Bluetooth devices. A local user could use this flaw to crash the system (bnc#1186207).
• CVE-2020-28097: Fixed out-of-bounds read in vgacon subsystem that mishandled software scrollback (bnc#1187723).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bnc#1193867).
• CVE-2022-22942: Fixed stale file descriptors on failed usercopy (bsc#1195065).
• CVE-2021-39657: Fixed out of bounds read due to a missing bounds check in ufshcd_eh_device_reset_handler of ufshcd.c. This could lead to local information disclosure with System execution privileges needed (bnc#1193864).
• CVE-2021-39648: Fixed possible disclosure of kernel heap memory due to a race condition in gadget_dev_desc_UDC_show of configfs.c. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation (bnc#1193861).
• CVE-2021-44733: Fixed a use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem, that could have occured because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object (bnc#1193767).
• CVE-2022-0330: Fixed flush TLBs before releasing backing store (bsc#1194880).
• CVE-2022-0322: Fixed SCTP issue with account stream padding length for reconf chunk (bsc#1194985).
• CVE-2021-4197: Use cgroup open-time credentials for process migraton perm checks (bsc#1194302).
• CVE-2021-4202: Fixed NFC race condition by adding NCI_UNREG flag (bsc#1194529).
• CVE-2021-4083: Fixed a read-after-free memory flaw inside the garbage collection for Unix domain socket file handlers when users call close() and fget() simultaneouslyand can potentially trigger a race condition (bnc#1193727).
• CVE-2021-4149: Fixed btrfs unlock newly allocated extent buffer after error (bsc#1194001).
• CVE-2021-4135: Fixed zero-initialize memory inside netdevsim for new map's value in function nsim_bpf_map_alloc (bsc#1193927).

The following non-security bugs were fixed:

• KVM: remember position in kvm->vcpus array (bsc#1190973).
• KVM: s390: index kvm->arch.idle_mask by vcpu_idx (bsc#1190973).
• SUNRPC: Add basic load balancing to the transport switch - kabi fix. (bnc#1192729).
• SUNRPC: Add basic load balancing to the transport switch. (bnc#1192729)
• SUNRPC: Fix initialisation of struct rpc_xprt_switch (bnc#1192729).
• SUNRPC: Optimise transport balancing code (bnc#1192729).
• SUNRPC: Replace division by multiplication in calculation of queue length (bnc#1192729).
• SUNRPC: Skip zero-refcount transports (bnc#1192729).
• USB: serial: option: add Telit FN990 compositions (git-fixes).
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() (bsc#1194227).
• crypto: qat - fix undetected PFVF timeout in ACK loop (git-fixes).
• ext4: set csum seed in tmp inode while migrating to extents (bsc#1195272).
• fget: clarify and improve __fget_files() implementation (bsc#1193727).
• hv_netvsc: Set needed_headroom according to VF (bsc#1193507).
• ibmvnic: Allow extra failures before disabling (bsc#1195073 ltc#195713).
• ibmvnic: do not spin in tasklet (bsc#1195073 ltc#195713).
• ibmvnic: init ->running_cap_crqs early (bsc#1195073 ltc#195713).
• ibmvnic: remove unused ->wait_capability (bsc#1195073 ltc#195713).
• kABI fixup after adding vcpu_idx to struct kvm_cpu (bsc#1190973).
• kabi: mask new member 'empty' of struct Qdisc (bsc#1183405).…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299).
• CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd(). (bsc#1196155)
• CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096).
• CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free vulnerability in unix_scm_to_skb of af_unix (bsc#1193731).
• CVE-2021-39657: Fixed an information leak in the Universal Flash Storage subsystem (bsc#1193864).

The following non-security bugs were fixed:

• ALSA: intel_hdmi: Fix reference to PCM buffer address (git-fixes).
• ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (git-fixes).
• ARM: Fix kgdb breakpoint for Thumb2 (git-fixes).
• ASoC: cs4265: Fix the duplicated control name (git-fixes).
• ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (git-fixes).
• ASoC: rt5668: do not block workqueue if card is unbound (git-fixes).
• ASoC: rt5682: do not block workqueue if card is unbound (git-fixes).
• Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE (bsc#1196779).
• EDAC/altera: Fix deferred probing (bsc#1178134).
• HID: add mapping for KEY_ALL_APPLICATIONS (git-fixes).
• HID: add mapping for KEY_DICTATE (git-fixes).
• Hand over the maintainership to SLE15-SP3 maintainers
• IB/hfi1: Correct guard on eager buffer deallocation (git-fixes).
• IB/hfi1: Fix early init panic (git-fixes).
• IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr (git-fixes).
• IB/hfi1: Insure use of smp_processor_id() is preempt disabled (git-fixes).
• IB/rdmavt: Validate remote_addr during loopback atomic tests (git-fixes).
• Input: clear BTN_RIGHT/MIDDLE on buttonpads (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• RDMA/bnxt_re: Scan the whole bitmap when checking if 'disabling RCFW with pending cmd-bit' (git-fixes).
• RDMA/cma: Do not change route.addr.src_addr outside state checks (bsc#1181147).
• RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry (git-fixes).
• RDMA/cma: Remove open coding of overflow checking for private_data_len (git-fixes).
• RDMA/core: Do not infoleak GRH fields (git-fixes).
• RDMA/core: Let ib_find_gid() continue search even after empty entry (git-fixes).
• RDMA/cxgb4: Set queue pair state when being queried…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299).
• CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd(). (bsc#1196155)
• CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096).
• CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free vulnerability in unix_scm_to_skb of af_unix (bsc#1193731).
• CVE-2021-39657: Fixed an information leak in the Universal Flash Storage subsystem (bsc#1193864).
• CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from heap memory via crafted frame lengths from a device (bsc#1196836).
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)
• CVE-2021-45402: The check_alu_op function in kernel/bpf/verifier.c did not properly update bounds while handling the mov32 instruction, which allowed local users to obtain potentially sensitive address information (bsc#1196130).
• CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers. (bsc#1196488)

The following non-security bugs were fixed:

• ALSA: intel_hdmi: Fix reference to PCM buffer address (git-fixes).
• ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (git-fixes).
• ARM: Fix kgdb breakpoint for Thumb2 (git-fixes).
• ASoC: cs4265: Fix the duplicated control name (git-fixes).
• ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (git-fixes).
• ASoC: rt5668: do not block workqueue if card is unbound (git-fixes).
• ASoC: rt5682: do not block workqueue if card is unbound (git-fixes).
• Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE (bsc#1196779).
• EDAC/altera: Fix deferred probing (bsc#1178134).
• EDAC: Fix calculation of returned address and next offset in edac_align_ptr() (bsc#1178134).
• HID: add mapping for KEY_ALL_APPLICATIONS (git-fixes).
• HID: add mapping for KEY_DICTATE (git-fixes).
• Hand over the maintainership to SLE15-SP3 maintainers
• IB/hfi1: Correct guard on eager buffer deallocation (git-fixes).
• IB/hfi1: Fix early init panic…