CVE-2022-20008

The Linux Kernel, the operating system core itself.

Security Fix(es):

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.(CVE-2022-0002)

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.(CVE-2022-29582)

A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.(CVE-2022-1195)

In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel(CVE-2022-20008)

Due to the small table perturb size, a memory leak flaw was found in the Linux kernel’s TCP source port generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and may cause a denial of service.(CVE-2022-1012)

A flaw was found in the Linux kernel’s nfcmrvl_nci_unregister_dev() function. A race condition leads to a use-after-free issue when simulating the NFC device from the user space.(CVE-2022-1734)

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.(CVE-2022-29581)

A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.(CVE-2022-1516)

In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel

In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-20141: Fixwed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes). -…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).

The following non-security bugs were fixed:

• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes).
• ALSA: usb-audio: Configure sync endpoints before data (git-fixes).
• ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant (git-fixes).
• ALSA: usb-audio: Restore Rane SL-1 quirk (git-fixes).
• ALSA: wavefront: Proper check of get_user() error (git-fixes).
• ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling (git-fixes)
• ARM: 9170/1: fix panic when kasan and kprobe are enabled (git-fixes)
• ARM: 9187/1: JIVE: fix return value of __setup handler (git-fixes)
• ARM: config: u8500: Re-enable AB8500 battery charging (git-fixes)
• ARM: davinci: da850-evm: Avoid NULL pointer dereference (git-fixes)
• ARM: dts: am3517-evm: Fix misc pinmuxing (git-fixes)
• ARM: dts: armada-38x: Add generic compatible to UART nodes (git-fixes)
• ARM: dts: at91: fix pinctrl phandles (git-fixes)
• ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek (git-fixes)
• ARM: dts: at91: sama5d2: Fix PMERRLOC resource size (git-fixes)
• ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name (git-fixes)
• ARM: dts: bcm2835-rpi-b: Fix GPIO line names…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes).
• ALSA: usb-audio: Configure sync endpoints before data (git-fixes).
• ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant (git-fixes).
• ALSA: usb-audio: Restore Rane SL-1 quirk (git-fixes).
• ALSA: wavefront: Proper check of get_user() error (git-fixes).
• ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling (git-fixes)
• ARM: 9170/1: fix panic when kasan and kprobe are enabled (git-fixes)
• ARM: 9187/1: JIVE: fix return value of __setup handler (git-fixes)
• ARM: config: u8500: Re-enable AB8500 battery charging (git-fixes)
• ARM: davinci: da850-evm: Avoid NULL pointer dereference (git-fixes)
• ARM: dts: am3517-evm: Fix misc pinmuxing (git-fixes)
• ARM: dts: armada-38x: Add generic compatible to UART nodes (git-fixes)
• ARM:…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-20141: Fixwed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-2503: Fixed a vulnerability that allowed root to bypass LoadPin and load untrusted and unverified kernel modules and firmware (bnc#1202677).
• CVE-2022-20008: Fixed a bug which allowed to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. (bnc#1199564)
• CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured (bnc#1202097).
• CVE-2022-39188: Fixed a race condition where a device driver can free a page while it still has stale TLB entries. (bnc#1203107).

The following non-security bugs were fixed:

• arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 (git-fixes)
• cifs: alloc_mid function should be marked as static (bsc#1190317).
• cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (bsc#1190317).
• cifs: change smb2_query_info_compound to use a cached fid, if available (bsc#1190317).
• cifs: check for smb1 in open_cached_dir() (bsc#1190317).
• cifs: Check the IOCB_DIRECT flag, not O_DIRECT (bsc#1190317).
• cifs: clean up an inconsistent indenting (bsc#1190317).
• cifs: convert the path to utf16 in smb2_query_info_compound (bsc#1190317).
• cifs: Do not use tcon->cfid directly, use the cfid we get from open_cached_dir (bsc#1190317).
• cifs: do not use uninitialized data in the owner/group sid (bsc#1190317).
• cifs: fix double free race when mount fails in cifs_get_root() (bsc#1190317).
• cifs: fix FILE_BOTH_DIRECTORY_INFO definition (bsc#1190317).
• cifs: fix handlecache and multiuser (bsc#1190317).
• cifs: fix lock length calculation (bsc#1190317).
• cifs: fix ntlmssp auth when there is no key exchange (bsc#1190317).
• cifs: fix NULL ptr dereference in refresh_mounts() (bsc#1190317).
• cifs: fix NULL ptr dereference in smb2_ioctl_query_info() (bsc#1190317).
• cifs: fix set of group SID via NTSD xattrs (bsc#1190317).
• cifs: fix signed integer overflow when fl_end is OFFSET_MAX (bsc#1190317).
• cifs: Fix smb311_update_preauth_hash() kernel-doc comment (bsc#1190317).
• cifs: fix the cifs_reconnect path for DFS (bsc#1190317).
• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1190317).
• cifs: mark sessions for reconnection in helper function (bsc#1190317).
• cifs: modefromsids must add an ACE for authenticated users (bsc#1190317).
• cifs: move definition of cifs_fattr earlier in cifsglob.h (bsc#1190317).
• cifs: move from strlcpy with unused retval to strscpy (bsc#1190317).
• cifs: move superblock magic defitions to magic.h (bsc#1190317).
• cifs: potential buffer overflow in handling symlinks (bsc#1190317).
• cifs: prevent bad output lengths in smb2_ioctl_query_info() (bsc#1190317).
• cifs: release cached dentries only if mount is complete (bsc#1190317).
• cifs: remove 'cifs_' prefix from init/destroy mids functions (bsc#1190317).
• cifs: remove check of list iterator against head past the loop body (bsc#1190317).
• cifs: remove minor build warning (bsc#1190317).
• cifs: remove redundant initialization to variable mnt_sign_enabled (bsc#1190317).
• cifs: remove remaining build warnings (bsc#1190317).
• cifs: remove repeated debug message on cifs_put_smb_ses() (bsc#1190317).
• cifs: remove some…

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-2503: Fixed a vulnerability that allowed root to bypass LoadPin and load untrusted and unverified kernel modules and firmware (bnc#1202677).
• CVE-2022-20008: Fixed a bug which allowed to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. (bnc#1199564)
• CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured (bnc#1202097).
• CVE-2022-39188: Fixed a race condition where a device driver can free a page while it still has stale TLB entries. (bnc#1203107).

The following non-security bugs were fixed:

• arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 (git-fixes)
• cifs: alloc_mid function should be marked as static (bsc#1190317).
• cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (bsc#1190317).
• cifs: change smb2_query_info_compound to use a cached fid, if available (bsc#1190317).
• cifs: check for smb1 in open_cached_dir() (bsc#1190317).
• cifs: Check the IOCB_DIRECT flag, not O_DIRECT (bsc#1190317).
• cifs: clean up an inconsistent indenting (bsc#1190317).
• cifs: convert the path to utf16 in smb2_query_info_compound (bsc#1190317).
• cifs: Do not use tcon->cfid directly, use the cfid we get from open_cached_dir (bsc#1190317).
• cifs: do not use uninitialized data in the owner/group sid (bsc#1190317).
• cifs: fix double free race when mount fails in cifs_get_root() (bsc#1190317).
• cifs: fix FILE_BOTH_DIRECTORY_INFO definition (bsc#1190317).
• cifs: fix handlecache and multiuser (bsc#1190317).
• cifs: fix lock length calculation (bsc#1190317).
• cifs: fix ntlmssp auth when there is no key exchange (bsc#1190317).
• cifs: fix NULL ptr dereference in refresh_mounts() (bsc#1190317).
• cifs: fix NULL ptr dereference in smb2_ioctl_query_info() (bsc#1190317).
• cifs: fix set of group SID via NTSD xattrs (bsc#1190317).
• cifs: fix signed integer overflow when fl_end is OFFSET_MAX (bsc#1190317).
• cifs: Fix smb311_update_preauth_hash() kernel-doc comment (bsc#1190317).
• cifs: fix the cifs_reconnect path for DFS (bsc#1190317).
• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1190317).
• cifs: mark sessions for reconnection in helper function (bsc#1190317).
• cifs: modefromsids must add an ACE for authenticated users (bsc#1190317).
• cifs: move definition of cifs_fattr earlier in cifsglob.h (bsc#1190317).
• cifs: move from strlcpy with unused retval to strscpy (bsc#1190317).
• cifs: move superblock magic defitions to magic.h (bsc#1190317).
• cifs: potential buffer overflow in handling symlinks (bsc#1190317).
• cifs: prevent bad output lengths in smb2_ioctl_query_info() (bsc#1190317).
• cifs: release cached dentries only if mount is complete (bsc#1190317).
• cifs: remove 'cifs_' prefix from init/destroy mids functions (bsc#1190317).
• cifs: remove check of list iterator against head past the loop body (bsc#1190317).
• cifs: remove minor build warning (bsc#1190317).
• cifs: remove redundant initialization to variable mnt_sign_enabled (bsc#1190317).
• cifs: remove remaining build warnings (bsc#1190317).
• cifs: remove repeated debug message on cifs_put_smb_ses() (bsc#1190317).
• cifs: remove some…

The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-20008: Fixed local information disclosure due to possibility to read kernel heap memory via mmc_blk_read_single of block.c (bnc#1199564).
• CVE-2022-2503: Fixed a vulnerability that allowed root to bypass LoadPin and load untrusted and unverified kernel modules and firmware (bnc#1202677).
• CVE-2022-32296: Fixed vulnerability where TCP servers were allowed to identify clients by observing what source ports are used (bnc#1200288).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and mgslpc_detach (bnc#1203987).

The following non-security bugs were fixed:

• dtb: Do not include sources in src.rpm - refer to kernel-source Same as other kernel binary packages there is no need to carry duplicate sources in dtb packages.
• mkspec: eliminate @NOSOURCE@ macro This should be alsways used with @SOURCES@, just include the content there.
• net: mana: Add rmb after checking owner bits (git-fixes).
• net: mana: Add the Linux MANA PF driver (bnc#1201309, jsc#PED-529).
• x86/bugs: Reenable retbleed=off While for older kernels the return thunks are statically built in and cannot be dynamically patched out, retbleed=off should still be possible to do so that the mitigation can still be disabled on Intel who do not use the return thunks but IBRS.

The SUSE Linux Enterprise 15 SP2 kernel was updated.

The following security bugs were fixed:

• CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a DCCP socket. (bnc#1177471)
• CVE-2022-20008: Fixed a bug which allowed to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. (bnc#1199564)
• CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates (bnc#1202677).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
• CVE-2022-32296: Fixed a bug which allowed TCP servers to identify clients by observing what source ports are used (bnc#1200288).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD move (bnc#1203622).
• CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames (bsc#1203770).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open (bnc#1203992).
• CVE-2022-42719: Fixed remote code execution with wlan frames when parsing a multi-BSSID element (bsc#1204051).
• CVE-2022-42720: Fixed remote code execution due to refcounting bugs (bsc#1204059).
• CVE-2022-42721: Fixed remote code execution due list corruption in the wlan stack (bsc#1204060).

The following non-security bugs were fixed:

• net: mana: Add support of XDP_REDIRECT action (bsc#1201310, jsc#PED-529).
• net: mana: Add the Linux MANA PF driver (bsc#1201309, jsc#PED-529).
• x86/bugs: Reenable retbleed=off While for older kernels the return thunks are statically built in and cannot be dynamically patched out, retbleed=off should still work so that it can be disabled.

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory. (bnc#1203514)
• CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET are sent. (bnc#1203290)
• CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
• CVE-2022-42719: Fixed MBSSID parsing use-after-free. (bsc#1204051)
• CVE-2022-42721: Avoid nontransmitted BSS list corruption. (bsc#1204060)
• CVE-2022-42720: Fixed BSS refcounting bugs. (bsc#1204059)
• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open (bnc#1203992).
• CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames (bsc#1203770).
• CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
• CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD move (bnc#1203622).
• CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates (bnc#1202677).
• CVE-2022-20008: Fixed a bug which allowed to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. (bnc#1199564)
• CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a DCCP socket. (bnc#1177471)

The following non-security bugs were fixed:

• ALSA: aloop: Fix random zeros in capture data when using jiffies timer (git-fixes).
• ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (git-fixes).
• ALSA: hda/realtek: Re-arrange quirk table entries (git-fixes).
• ALSA: seq: Fix data-race at module auto-loading (git-fixes).
• ALSA: seq: oss: Fix data-race for max_midi_devs access (git-fixes).
• ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() (git-fixes).
• ALSA: usb-audio: fix spelling mistakes (git-fixes).
• ALSA: usb-audio: Inform the delayed registration more properly (git-fixes).
• ALSA: usb-audio: Register card again for iface over delayed_register option (git-fixes).
• ALSA: usb-audio: Split endpoint setups for hw_params and prepare (git-fixes).
• arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 (git-fixes)
• arm64: dts: allwinner: A64 Sopine: phy-mode rgmii-id (git-fixes)
• arm64: dts: allwinner: a64-sopine-baseboard: change RGMII mode to (bsc#1202341)
• arm64: dts: allwinner: H5: NanoPi Neo Plus2: phy-mode rgmii-id (git-fixes)
• arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob (git-fixes)
• arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma (git-fixes)
• arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz (git-fixes)
• arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC (git-fixes)
• arm64:…

The SUSE Linux Enterprise 12 SP5 kernel rt was updated.

The following security bugs were fixed:

• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory. (bnc#1203514)
• CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET are sent. (bnc#1203290)
• CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
• CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960).
• CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552).
• CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl (bnc#1203987).
• CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates (bnc#1202677).
• CVE-2022-20008: Fixed a bug which allowed to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. (bnc#1199564)
• CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c. (bnc#1203322)
• CVE-2022-3424: Fixed a use-after-free in gru_set_context_option which was leading to kernel panic. (bsc#1204166)

The following non-security bugs were fixed:

• ACPI: processor idle: Practically limit 'Dummy wait' workaround to old Intel systems (bnc#1203802).
• ACPI: processor_idle: Skip dummy wait if kernel is in guest (bnc#1203802).
• arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 (git-fixes)
• cifs: alloc_mid function should be marked as static (bsc#1190317).
• cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (bsc#1190317).
• cifs: change smb2_query_info_compound to use a cached fid, if available (bsc#1190317).
• cifs: check for smb1 in open_cached_dir() (bsc#1190317).
• cifs: Check the IOCB_DIRECT flag, not O_DIRECT (bsc#1190317).
• cifs: clean up an inconsistent indenting (bsc#1190317).
• cifs: convert the path to utf16 in smb2_query_info_compound (bsc#1190317).
• cifs: Do not use tcon->cfid directly, use the cfid we get from open_cached_dir (bsc#1190317).
• cifs: do not use uninitialized data in the owner/group sid (bsc#1190317).
• cifs: fix double free race when mount fails in cifs_get_root() (bsc#1190317).
• cifs: fix FILE_BOTH_DIRECTORY_INFO definition (bsc#1190317).
• cifs: fix handlecache and multiuser (bsc#1190317).
• cifs: fix lock length calculation (bsc#1190317).
• cifs: fix ntlmssp auth when there is no key exchange (bsc#1190317).
• cifs: fix NULL ptr dereference in refresh_mounts() (bsc#1190317).
• cifs: fix NULL ptr dereference in smb2_ioctl_query_info() (bsc#1190317).
• cifs: fix set of group SID via NTSD xattrs (bsc#1190317).
• cifs: fix signed integer overflow when fl_end is OFFSET_MAX (bsc#1190317).
• cifs: Fix smb311_update_preauth_hash() kernel-doc comment (bsc#1190317).
• cifs: fix the cifs_reconnect path for DFS (bsc#1190317).
• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1190317).
• cifs: mark sessions for reconnection in helper function (bsc#1190317).
• cifs: modefromsids must add an ACE for authenticated users (bsc#1190317).
• cifs: move definition of cifs_fattr earlier in cifsglob.h (bsc#1190317).
• cifs: move from strlcpy with unused…

Jeremy Cline discovered a use-after-free in the nouveau graphics driver of the Linux kernel during device removal. A privileged or physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2020-27820)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-1016)

It was discovered that the MMC/SD subsystem in the Linux kernel did not properly handle read errors from SD cards in certain situations. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-20008)

It was discovered that the USB gadget subsystem in the Linux kernel did not properly validate interface descriptor requests. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-25258)

It was discovered that the Remote NDIS (RNDIS) USB gadget implementation in the Linux kernel did not properly validate the size of the RNDIS_MSG_SET command. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-25375)

It was discovered that the ST21NFCA NFC driver in the Linux kernel did not properly validate the size of certain data in EVT_TRANSACTION events. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-26490)

It was discovered that the Xilinx USB2 device gadget driver in the Linux kernel did not properly validate endpoint indices from the host. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-27223)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

It was discovered that the MMC/SD subsystem in the Linux kernel did not properly handle read errors from SD cards in certain situations. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-20008)

It was discovered that the USB gadget subsystem in the Linux kernel did not properly validate interface descriptor requests. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-25258)

It was discovered that the Remote NDIS (RNDIS) USB gadget implementation in the Linux kernel did not properly validate the size of the RNDIS_MSG_SET command. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-25375)

It was discovered that the ST21NFCA NFC driver in the Linux kernel did not properly validate the size of certain data in EVT_TRANSACTION events. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-26490)

It was discovered that the USB SR9700 ethernet device driver for the Linux kernel did not properly validate the length of requests from the device. A physically proximate attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-26966)

It was discovered that the Xilinx USB2 device gadget driver in the Linux kernel did not properly validate endpoint indices from the host. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-27223)

Miaoqian Lin discovered that the RDMA Transport (RTRS) client implementation in the Linux kernel contained a double-free when handling certain error conditions. An attacker could use this to cause a denial of service (system crash). (CVE-2022-29156)