CVE-2022-20132

The Linux Kernel, the operating system core itself.

Security Fix(es):

In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel(CVE-2022-20132)

In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel(CVE-2022-20154)

A use-after-free vulnerability was found in the Linux kernel s Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue.(CVE-2022-1966)

The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used.(CVE-2022-32296)

An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. (CVE-2022-32981)

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.(CVE-2022-32250)

In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel

In lg_probe of hid-lg.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.

• CVE-2022-1198
  • drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2020-36516
  • ipv4: avoid using shared IP generator for connected sockets
• CVE-2022-36879
  • xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
• CVE-2022-3061
  • video: fbdev: i740fb: Error out if 'pixclock' equals zero
• CVE-2022-1516
  • net/x25: Fix null-ptr-deref caused by x25_disconnect
• CVE-2022-1205
  • ax25: Fix NULL pointer dereferences in ax25 timers
  • ax25: Fix UAF bugs in ax25 timers
• CVE-2022-2318
  • net: rose: fix UAF bugs caused by timer handler
• CVE-2022-1195
  • hamradio: defer 6pack kfree after unregister_netdev
  • hamradio: defer ax25 kfree after unregister_netdev
  • hamradio: improve the incomplete fix to avoid NPD
• CVE-2022-0494
  • block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
• CVE-2021-26401
  • x86/speculation: Use generic retpoline by default on AMD
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-39188
  • mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112) // CVE-2022-39188
  • mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
• CVE-2022-45934
  • Bluetooth: L2CAP: Fix u8 overflow
• Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355) // CVE-2022-2991
  • lightnvm: disable the subsystem
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE-2021-4203
  • af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2021-3772
  • sctp: fix the processing for INIT chunk
  • sctp: fix the processing for INIT_ACK chunk
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE-2021-3772
  • sctp: use init_tag from inithdr for ABORT chunk
  • sctp: fix the processing for COOKIE_ECHO chunk
  • sctp: add vtag check in sctp_sf_violation
  • sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
  • sctp: add vtag check in sctp_sf_ootb
• CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434) // CVE-2022-1462
  • tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
  • tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
• CVE-2022-1462
  • tty: fix deadlock caused by calling printk() under tty_port->lock
• Bionic update: upstream stable patchset 2020-11-10 (LP: #1903768) // CVE-2022-1462
  • pty: do tty_flip_buffer_push without port->lock in pty_write
• Bionic update: upstream stable patchset 2019-02-08 (LP: #1815234) // CVE-2022-1462
  • tty: Fix data race in tty_insert_flip_string_fixed_flag
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-4662
  • USB: core: Prevent nested device-reset calls
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2022-0617
  • udf: Restore i_lenAlloc when inode expansion fails
  • udf: Fix NULL ptr deref when converting from inline format
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2022-1016
  • netfilter: nf_tables: initialize registers in nft_do_chain()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-2380
  • video: fbdev: sm712fb: Fix crash in smtcfb_read()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-3111
  • power: supply: wm8350-power: Add missing free in free_charger_irq
• CVE-2022-3628
  • wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
• Bionic update:…

• CVE-2022-1198
  • drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2020-36516
  • ipv4: avoid using shared IP generator for connected sockets
• CVE-2022-36879
  • xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
• CVE-2022-3061
  • video: fbdev: i740fb: Error out if 'pixclock' equals zero
• CVE-2022-1516
  • net/x25: Fix null-ptr-deref caused by x25_disconnect
• CVE-2022-1205
  • ax25: Fix NULL pointer dereferences in ax25 timers
  • ax25: Fix UAF bugs in ax25 timers
• CVE-2022-2318
  • net: rose: fix UAF bugs caused by timer handler
• CVE-2022-1195
  • hamradio: defer 6pack kfree after unregister_netdev
  • hamradio: defer ax25 kfree after unregister_netdev
  • hamradio: improve the incomplete fix to avoid NPD
• CVE-2022-0494
  • block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
• CVE-2021-26401
  • x86/speculation: Use generic retpoline by default on AMD
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-39188
  • mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112) // CVE-2022-39188
  • mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
• CVE-2022-45934
  • Bluetooth: L2CAP: Fix u8 overflow
• Bionic update: upstream stable patchset 2022-06-21 (LP: #1979355) // CVE-2022-2991
  • lightnvm: disable the subsystem
• Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE-2021-4203
  • af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2021-3772
  • sctp: fix the processing for INIT chunk
  • sctp: fix the processing for INIT_ACK chunk
• Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE-2021-3772
  • sctp: use init_tag from inithdr for ABORT chunk
  • sctp: fix the processing for COOKIE_ECHO chunk
  • sctp: add vtag check in sctp_sf_violation
  • sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
  • sctp: add vtag check in sctp_sf_ootb
• CVE-2022-3303
  • ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
• Bionic update: upstream stable patchset 2022-09-21 (LP: #1990434) // CVE-2022-1462
  • tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
  • tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
• CVE-2022-1462
  • tty: fix deadlock caused by calling printk() under tty_port->lock
• Bionic update: upstream stable patchset 2020-11-10 (LP: #1903768) // CVE-2022-1462
  • pty: do tty_flip_buffer_push without port->lock in pty_write
• Bionic update: upstream stable patchset 2019-02-08 (LP: #1815234) // CVE-2022-1462
  • tty: Fix data race in tty_insert_flip_string_fixed_flag
• Bionic update: upstream stable patchset 2022-10-18 (LP: #1993349) // CVE-2022-4662
  • USB: core: Prevent nested device-reset calls
• Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE-2022-0617
  • udf: Restore i_lenAlloc when inode expansion fails
  • udf: Fix NULL ptr deref when converting from inline format
• Bionic update: upstream stable patchset 2022-04-26 (LP: #1970479) // CVE-2022-1016
  • netfilter: nf_tables: initialize registers in nft_do_chain()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-2380
  • video: fbdev: sm712fb: Fix crash in smtcfb_read()
• Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE-2022-3111
  • power: supply: wm8350-power: Add missing free in free_charger_irq
• CVE-2022-3628
  • wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
• Bionic update:…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes). -…

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes).
• block: advance iov_iter on bio_add_hw_page failure (git-fixes).
• block: do not merge across cgroup boundaries if blkcg is enabled (bsc#1198020).
• block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (bsc#1185762).
• block: Fix kABI in blk-merge.c (bsc#1198020).
• block/keyslot-manager: prevent crash when…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• audit: fix a race condition with the auditd tracking code (bsc#1197170).
• block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• bonding: fix bond_neigh_init() (git-fixes).
• dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).
• drbd: fix duplicate array initializer (git-fixes).
• drbd: remove assign_p_sizes_qlim (git-fixes).
• drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).
• drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).
• exec: Force single empty string when argv is empty (bsc#1200571).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
• ext4: fix bug_on in __es_tree_search (bsc#1200809).
• ext4: fix bug_on in ext4_writepages (bsc#1200872).
• ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).
• ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
• ext4: fix symlink file size not match to file content (bsc#1200868).
• ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).
• ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).
• ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
• ext4: make variable 'count' signed (bsc#1200820).
• fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873).
• i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).
• ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
• init: Initialize noop_backing_dev_info early (bsc#1200822).
• inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
• Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes).
• iomap: iomap_write_failed fix (bsc#1200829). -…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2017-16525: Fixed a use-after-free after failed setup in usb/serial/console (bsc#1066618).

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• add mainline tag for a pci-hyperv change
• audit: fix a race condition with the auditd tracking code (bsc#1197170).
• block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• bonding: fix bond_neigh_init() (git-fixes).
• dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).
• drbd: fix duplicate array initializer (git-fixes).
• drbd: remove assign_p_sizes_qlim (git-fixes).
• drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).
• drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).
• exec: Force single empty string when argv is empty (bsc#1200571).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
• ext4: fix bug_on in __es_tree_search (bsc#1200809).
• ext4: fix bug_on in ext4_writepages (bsc#1200872).
• ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).
• ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
• ext4: fix symlink file size not match to file content (bsc#1200868).
• ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).
• ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).
• ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
• ext4: make variable 'count' signed (bsc#1200820).
• fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873).
• i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).
• ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
• init: Initialize noop_backing_dev_info early (bsc#1200822).
• inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
• Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space (bsc#1200144).
• CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space (bsc#1200143).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed a use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (bsc#1198577).
• CVE-2022-21499: Lock down kgdb to prohibit secure-boot bypass (bsc#1199426).
• CVE-2019-19377: Fixed a user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image (bsc#1158266).

The following non-security bugs were fixed:

• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Add various fsctl structs (bsc#1200217).
• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Add various fsctl structs (bsc#1200217).
• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2017-16525: Fixed a use-after-free after failed setup in usb/serial/console (bsc#1066618).

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-33743: Fixed a Denial of Service related to XDP (bsc#1200763).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bnc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-1998: Fixed a use after free in the file system notify functionality (bnc#1200284).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1852: Fixed a null-ptr-deref in the kvm module which can lead to DoS. (bsc#1199875)
• CVE-2022-1789: Fixed a NULL pointer dereference when shadow paging is enabled. (bnc#1199674)
• CVE-2022-1508: Fixed an out-of-bounds read flaw that could cause the system to crash. (bsc#1198968)
• CVE-2022-1671: Fixed a null-ptr-deref bugs in net/rxrpc/server_key.c, unprivileged users could easily trigger it via ioctl. (bsc#1199439)
• CVE-2022-1651: Fixed a bug in ACRN Device Model emulates virtual NICs in VM. This flaw may allow a local privileged attacker to leak kernel unauthorized information and also cause a denial of service problem. (bsc#1199433)
• CVE-2022-29582: Fixed a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. (bnc#1198811)
• CVE-2022-0494: Fixed a kernel information leak flaw in the scsi_ioctl function. This flaw allowed a local attacker with a special user privilege to create issues with confidentiality. (bnc#1197386)
• CVE-2021-4204: Fixed a vulnerability that allows local attackers to escalate privileges on affected installations via ebpf. (bnc#1194111)
• CVE-2022-23222: Fixed a bug that allowed local users to gain privileges. (bnc#1194765)
• CVE-2022-0264: Fixed a vulnerability in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (bnc#1194826)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-33743: Fixed a Denial of Service related to XDP (bsc#1200763).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1852: Fixed a null-ptr-deref in the kvm module which can lead to DoS. (bsc#1199875)
• CVE-2022-1789: Fixed a NULL pointer dereference when shadow paging is enabled. (bnc#1199674)
• CVE-2022-1508: Fixed an out-of-bounds read flaw that could cause the system to crash. (bsc#1198968)
• CVE-2022-1671: Fixed a null-ptr-deref bugs in net/rxrpc/server_key.c, unprivileged users could easily trigger it via ioctl. (bsc#1199439)
• CVE-2022-1651: Fixed a bug in ACRN Device Model emulates virtual NICs in VM. This flaw may allow a local privileged attacker to leak kernel unauthorized information and also cause a denial of service problem. (bsc#1199433)
• CVE-2022-29582: Fixed a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. (bnc#1198811)
• CVE-2022-0494: Fixed a kernel information leak flaw in the scsi_ioctl function. This flaw allowed a local attacker with a special user privilege to create issues with confidentiality. (bnc#1197386)
• CVE-2021-4204: Fixed a vulnerability that allows local attackers to escalate privileges on affected installations via ebpf. (bnc#1194111)
• CVE-2022-23222: Fixed a bug that allowed local users to gain privileges. (bnc#1194765)
• CVE-2022-0264: Fixed a vulnerability in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (bnc#1194826)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-1205: Fixed null pointer dereference and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. (bsc#1198027)
• CVE-2022-1198: Fixed an use-after-free vulnerability that allow an attacker to crash the linux kernel by simulating Amateur Radio (bsc#1198030).
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1966: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
• CVE-2022-1836: Fixed a bug in the floppy submodule disabling FDRAWCMD by default. (bsc#1198866)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2021-33655: Fixed memory out of bounds write by ioctl cmd FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem. This flaw allowed a local user to crash the system or read unauthorized random data from memory. (bnc#1198829)
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21505: Fixed kexec lockdown bypass with ima policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278).
• dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278).
• dma-mapping: add a dma_ops_bypass flag to struct device (bsc#1196472 ltc#192278).
• dma-mapping: move the remaining DMA API calls out of line (bsc#1196472 ltc#192278).
• dma: kABI: Add back removed exports (bsc#1196472 ltc#192278).
• exec: Force single empty string when argv is empty (bsc#1200571).
• fsnotify: invalidate dcache before IN_DELETE event (bsc#1195478 bsc#1200905).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278).
• powerpc/pseries/iommu: Create defines for…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-13695: Fixed fix acpi operand cache leak in nseval.c (bsc#1055710).
• CVE-2018-7755: Fixed bypass of kernel security protections such as KASLR using fd_locked_ioctl function in drivers/block/floppy.c (bnc#1084513).
• CVE-2019-3837: Fixed memory leak due to thread-unsafe implementation of the net_dma code in tcp_recvmsg() (bnc#1131430).
• CVE-2019-3900: Fixed infinite loop while receiving packets in vhost_net (bnc#1133374).
• CVE-2020-15393: Fixed memory leak in usbtest_disconnect in drivers/usb/misc/usbtest.c (bnc#1173514).
• CVE-2020-16119: Fixed use-after-free exploitable by a local attacker due to reuse of a DCCP socket (bnc#1177471).
• CVE-2020-36557: Fixed race condition in the VT_DISALLOCATE ioctl and closing/opening of ttys which could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition in VT_RESIZEX (bsc#1200910).
• CVE-2021-26341: Fixed vulnerablity where some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bnc#1201050).
• CVE-2021-33655: When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write when setting font with malicous data by ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-34981: Fixed file refcounter in bluetooth cmtp when cmtp_attach_device fails (bsc#1191961).
• CVE-2021-39713: Fixed race condition in the network scheduling subsystem which could lead to a use-after-free (bsc#1196973).
• CVE-2021-45868: Fixed use-after-free in fs/quota/quota_tree.c (bnc#1197366).
• CVE-2022-1011: Fixed UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (bsc#1197343).
• CVE-2022-1048: Fixed potential AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331).
• CVE-2022-1353: Fixed denial of service in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1462: Fixed out-of-bounds read in the TeleTYpe subsystem allowing local user to crash the system or read unauthorized random data from memory (bnc#1198829).
• CVE-2022-1652: Fixed use after free in floppy (bsc#1199063).
• CVE-2022-1679: Fixed use-after-free in the atheros wireless adapter driver (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read in lg_probe and related functions of hid-lg.c and other USB HID files (bnc#1200619).
• CVE-2022-20166: Fixed out of bounds write due to a heap buffer overflow which could lead to local escalation of privilege with System execution privileges needed (bnc#1200598).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bnc#1202346).
• CVE-2022-20369: Fixed out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21166, CVE-2022-21127, CVE-2022-21123, CVE-2022-21125, CVE-2022-21180: Fixed stale MMIO data transient information leaks (INTEL-TA-00615) (bnc#1199650).
• CVE-2022-21385: Fixed warn in rds_message_alloc_sgs (bnc#1202897).
• CVE-2022-21499: Fixed issue where it was trivial to break out of lockdown using kgdb (bsc#1199426).
• CVE-2022-2318: Fixed use-after-free caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges (bnc#1201251).
• CVE-2022-2663: Fixed possible firewall bypass when users are using unencrypted IRC due to message handling confusion in nf_conntrack_irc (bnc#1202097).
• CVE-2022-28356: Fixed refcount leak bug in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-29900: Fixed mis-trained branch predictions for return instructions that may have allowed arbitrary speculative code execution under certain microarchitecture-dependent conditions (bnc#1199657).
• CVE-2022-29901: Fixed vulnerability where an attacker with unprivileged user access can hijack return instructions to…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
• CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• cifs: add missing spinlock around tcon refcount (bsc#1213476).
• cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
• cifs: avoid race conditions with parallel reconnects (bsc#1213476).
• cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
• cifs: avoid use of global locks for high contention data (bsc#1213476).
• cifs: check only tcon status on tcon related functions (bsc#1213476).
• cifs: do all necessary checks for credits within or before locking (bsc#1213476).
• cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
• cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
• cifs: do not take exclusive lock for updating target hints (bsc#1213476).
• cifs: fix confusing debug message (bsc#1213476).
• cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
• cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
• cifs: fix refresh of cached referrals (bsc#1213476).
• cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
• cifs: fix source pathname comparison of dfs supers (bsc#1213476).
• cifs: fix status checks in cifs_tree_connect (bsc#1213476).
• cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
• cifs: get rid of dns resolve worker (bsc#1213476).
• cifs: get rid of mount options string parsing (bsc#1213476).
• cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
• cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
• cifs: match even the scope id for ipv6 addresses (bsc#1213476).
• cifs: optimize reconnect of nested links (bsc#1213476).
• cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• NFC: nxp: add NXP1002 (bsc#1185589).
• PCI: rpaphp: Add MODULE_DESCRIPTION (bsc#1176869 ltc#188243).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• md: Replace snprintf with scnprintf (git-fixes).
• netfilter: nf_tables: GC transaction race with abort path (git-fixes).
• netfilter: nf_tables: GC transaction race with netns dismantle (git-fixes).
• netfilter: nf_tables: defer gc run if previous batch is still pending (git-fixes).
• netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (git-fixes).
• netfilter: nf_tables: fix kdoc warnings after gc rework (git-fixes).
• netfilter: nf_tables: fix memleak when more than 255 elements expired (git-fixes).
• netfilter: nf_tables: mark newset as dead on transaction abort (git-fixes).
• netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (git-fixes).
• netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure (git-fixes).
• netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (git-fixes).
• netfilter: nf_tables: skip dead set elements in netlink dump (git-fixes).
• netfilter: nf_tables: use correct lock to protect gc_list (git-fixes).
• netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration (git-fixes).
• netfilter: nft_set_rbtree: Add missing expired checks (git-fixes).
• netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match (git-fixes).
• netfilter: nft_set_rbtree: Detect partial overlaps on insertion (git-fixes).
• netfilter: nft_set_rbtree: Do not account for expired elements on insertion (git-fixes).
• netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion (git-fixes).
• netfilter: nft_set_rbtree: Handle outcomes of tree rotations in overlap detection (git-fixes).
• netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() (git-fixes). -…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
• CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
• CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
• CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
• CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
• CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
• CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
• CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
• CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
• CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
• CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
• CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
• CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve local privilege escalation (bsc#1215420).
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

The following non-security bugs were fixed:

• af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
• af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
• af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• btrfs: do not start relocation until in progress drops are done (bsc#1222251).
• cifs: add missing spinlock around tcon refcount (bsc#1213476).
• cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
• cifs: avoid race conditions with parallel reconnects (bsc#1213476).
• cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
• cifs: avoid use of global locks for high contention data (bsc#1213476).
• cifs: check only tcon status on tcon related functions (bsc#1213476).
• cifs: do all necessary checks for credits within or before locking (bsc#1213476).
• cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
• cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
• cifs: do not take exclusive lock for updating target hints (bsc#1213476).
• cifs: fix confusing debug message (bsc#1213476).
• cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
• cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
• cifs: fix refresh of cached referrals (bsc#1213476).
• cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
• cifs: fix source pathname comparison of dfs supers (bsc#1213476).
• cifs: fix status checks in cifs_tree_connect (bsc#1213476).
• cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
• cifs: get rid of dns resolve worker (bsc#1213476).
• cifs: get rid of mount options string parsing (bsc#1213476).
• cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
• cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
• cifs: match even the scope id for ipv6 addresses (bsc#1213476).
• cifs: optimize reconnect of nested links (bsc#1213476).
• cifs: prevent data race in smb2_reconnect() (bsc#1213476). -…

Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of service (connection termination) or inject forged data. (CVE-2020-36516)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28712, CVE-2021-28713)

Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs in some situations. A remote attacker could possibly use this to cause a denial of service (connection disassociation). (CVE-2021-3772)

It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2021-4149)

Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2021-4203)

It was discovered that the file system quotas implementation in the Linux kernel did not properly validate the quota block number. An attacker could use this to construct a malicious file system image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-0487)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious UDF image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some…

Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of service (connection termination) or inject forged data. (CVE-2020-36516)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28712, CVE-2021-28713)

Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs in some situations. A remote attacker could possibly use this to cause a denial of service (connection disassociation). (CVE-2021-3772)

It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2021-4149)

Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2021-4203)

It was discovered that the file system quotas implementation in the Linux kernel did not properly validate the quota block number. An attacker could use this to construct a malicious file system image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-0487)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious UDF image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some…

Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of service (connection termination) or inject forged data. (CVE-2020-36516)

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did not adequately limit the number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)

Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs in some situations. A remote attacker could possibly use this to cause a denial of service (connection disassociation). (CVE-2021-3772)

It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2021-4149)

Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2021-4203)

It was discovered that the file system quotas implementation in the Linux kernel did not properly validate the quota block number. An attacker could use this to construct a malicious file system image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-0487)

It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in some situations. A privileged local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-0494)

It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious UDF image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in…