CVE-2022-20154

The Linux Kernel, the operating system core itself.

Security Fix(es):

In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel(CVE-2022-20132)

In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel(CVE-2022-20154)

A use-after-free vulnerability was found in the Linux kernel s Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue.(CVE-2022-1966)

The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used.(CVE-2022-32296)

An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. (CVE-2022-32981)

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.(CVE-2022-32250)

In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes). -…

In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes).
• block: advance iov_iter on bio_add_hw_page failure (git-fixes).
• block: do not merge across cgroup boundaries if blkcg is enabled (bsc#1198020).
• block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (bsc#1185762).
• block: Fix kABI in blk-merge.c (bsc#1198020).
• block/keyslot-manager: prevent crash when…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• audit: fix a race condition with the auditd tracking code (bsc#1197170).
• block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• bonding: fix bond_neigh_init() (git-fixes).
• dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).
• drbd: fix duplicate array initializer (git-fixes).
• drbd: remove assign_p_sizes_qlim (git-fixes).
• drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).
• drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).
• exec: Force single empty string when argv is empty (bsc#1200571).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
• ext4: fix bug_on in __es_tree_search (bsc#1200809).
• ext4: fix bug_on in ext4_writepages (bsc#1200872).
• ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).
• ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
• ext4: fix symlink file size not match to file content (bsc#1200868).
• ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).
• ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).
• ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
• ext4: make variable 'count' signed (bsc#1200820).
• fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873).
• i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).
• ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
• init: Initialize noop_backing_dev_info early (bsc#1200822).
• inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
• Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes).
• iomap: iomap_write_failed fix (bsc#1200829). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).

The following non-security bugs were fixed:

• add mainline tag for a pci-hyperv change
• audit: fix a race condition with the auditd tracking code (bsc#1197170).
• block: bio-integrity: Advance seed correctly for larger interval sizes (git-fixes).
• bnxt_en: Remove the setting of dev_port (git-fixes).
• bonding: fix bond_neigh_init() (git-fixes).
• dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (git-fixes).
• drbd: fix duplicate array initializer (git-fixes).
• drbd: remove assign_p_sizes_qlim (git-fixes).
• drbd: use bdev_alignment_offset instead of queue_alignment_offset (git-fixes).
• drbd: use bdev based limit helpers in drbd_send_sizes (git-fixes).
• exec: Force single empty string when argv is empty (bsc#1200571).
• ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
• ext4: fix bug_on in __es_tree_search (bsc#1200809).
• ext4: fix bug_on in ext4_writepages (bsc#1200872).
• ext4: fix overhead calculation to account for the reserved gdt blocks (bsc#1200869).
• ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
• ext4: fix symlink file size not match to file content (bsc#1200868).
• ext4: fix use-after-free in ext4_rename_dir_prepare (bsc#1200871).
• ext4: force overhead calculation if the s_overhead_cluster makes no sense (bsc#1200870).
• ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
• ext4: make variable 'count' signed (bsc#1200820).
• fs-writeback: writeback_sb_inodes Recalculate 'wrote' according skipped pages (bsc#1200873).
• i915_vma: Rename vma_lookup to i915_vma_lookup (git-fixes).
• ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
• init: Initialize noop_backing_dev_info early (bsc#1200822).
• inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
• Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag (git-fixes).
• Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes).
• Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes).
• Input: omap4-keypad - fix pm_runtime_get_sync() error checking (git-fixes). -…

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space (bsc#1200144).
• CVE-2022-1975: Fixed a bug that allows an attacker to crash the linux kernel by simulating nfc device from user-space (bsc#1200143).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed a use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (bsc#1198577).
• CVE-2022-21499: Lock down kgdb to prohibit secure-boot bypass (bsc#1199426).
• CVE-2019-19377: Fixed a user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image (bsc#1158266).

The following non-security bugs were fixed:

• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).

The following non-security bugs were fixed:

• exec: Force single empty string when argv is empty (bsc#1200571).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Add various fsctl structs (bsc#1200217).
• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to 3.12.31 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442)
• Add various fsctl structs (bsc#1200217).
• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of…

This update for the Linux Kernel 5.3.18-150200_24_115 fixes one issue.

The following security issue was fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

This update for the Linux Kernel 4.12.14-122_116 fixes several issues.

The following security issues were fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21499: Reinforced the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb (bsc#1199426).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).

This update for the Linux Kernel 4.12.14-122_124 fixes one issue.

The following security issue was fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

This update for the Linux Kernel 4.12.14-95_83 fixes several issues.

The following security issues were fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21499: Reinforced the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb (bsc#1199426).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).

This update for the Linux Kernel 4.12.14-95_99 fixes several issues.

The following security issues were fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).

This update for the Linux Kernel 4.12.14-95_80 fixes several issues.

The following security issues were fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21499: Reinforced the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb (bsc#1199426).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).

This update for the Linux Kernel 4.12.14-150000_150_92 fixes one issue.

The following security issue was fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

This update for the Linux Kernel 5.3.18-150200_24_112 fixes several issues.

The following security issues were fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21499: Reinforced the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb (bsc#1199426).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).

This update for the Linux Kernel 5.14.21-150400_22 fixes several issues.

The following security issues were fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21499: Reinforced the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb (bsc#1199426).
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).

This update for the Linux Kernel 5.3.18-150300_59_71 fixes several issues.

The following security issues were fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)

This update for the Linux Kernel 5.3.18-150300_59_76 fixes several issues.

The following security issues were fixed:

• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-1116: Fixed an integer overflow in io_uring which may lead to local privilege escalation (bsc#1199647).
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-33743: Fixed a Denial of Service related to XDP (bsc#1200763).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bnc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-1998: Fixed a use after free in the file system notify functionality (bnc#1200284).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1852: Fixed a null-ptr-deref in the kvm module which can lead to DoS. (bsc#1199875)
• CVE-2022-1789: Fixed a NULL pointer dereference when shadow paging is enabled. (bnc#1199674)
• CVE-2022-1508: Fixed an out-of-bounds read flaw that could cause the system to crash. (bsc#1198968)
• CVE-2022-1671: Fixed a null-ptr-deref bugs in net/rxrpc/server_key.c, unprivileged users could easily trigger it via ioctl. (bsc#1199439)
• CVE-2022-1651: Fixed a bug in ACRN Device Model emulates virtual NICs in VM. This flaw may allow a local privileged attacker to leak kernel unauthorized information and also cause a denial of service problem. (bsc#1199433)
• CVE-2022-29582: Fixed a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. (bnc#1198811)
• CVE-2022-0494: Fixed a kernel information leak flaw in the scsi_ioctl function. This flaw allowed a local attacker with a special user privilege to create issues with confidentiality. (bnc#1197386)
• CVE-2021-4204: Fixed a vulnerability that allows local attackers to escalate privileges on affected installations via ebpf. (bnc#1194111)
• CVE-2022-23222: Fixed a bug that allowed local users to gain privileges. (bnc#1194765)
• CVE-2022-0264: Fixed a vulnerability in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (bnc#1194826)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).

The following non-security bugs were fixed:

• ALSA: hda/conexant: Fix missing beep setup (git-fixes).
• ALSA: hda/realtek - Add HW8326 support (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
• ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
• ALSA: hda/via: Fix missing beep setup (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• arm64: ftrace: fix branch range checks (git-fixes)
• ASoC: cs35l36: Update digital volume TLV (git-fixes).
• ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
• ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
• ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
• ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
• ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
• ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
• ASoC: wm8962: Fix suspend while playing music (git-fixes).
• ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
• bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• bcache: fixup multiple threads crash (git-fixes).
• bcache: improve multithreaded bch_btree_check() (git-fixes).
• bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
• bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
• bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
• bio: fix page leak bio_add_hw_page failure (git-fixes).
• blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
• blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
• blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
• blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-33743: Fixed a Denial of Service related to XDP (bsc#1200763).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1852: Fixed a null-ptr-deref in the kvm module which can lead to DoS. (bsc#1199875)
• CVE-2022-1789: Fixed a NULL pointer dereference when shadow paging is enabled. (bnc#1199674)
• CVE-2022-1508: Fixed an out-of-bounds read flaw that could cause the system to crash. (bsc#1198968)
• CVE-2022-1671: Fixed a null-ptr-deref bugs in net/rxrpc/server_key.c, unprivileged users could easily trigger it via ioctl. (bsc#1199439)
• CVE-2022-1651: Fixed a bug in ACRN Device Model emulates virtual NICs in VM. This flaw may allow a local privileged attacker to leak kernel unauthorized information and also cause a denial of service problem. (bsc#1199433)
• CVE-2022-29582: Fixed a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. (bnc#1198811)
• CVE-2022-0494: Fixed a kernel information leak flaw in the scsi_ioctl function. This flaw allowed a local attacker with a special user privilege to create issues with confidentiality. (bnc#1197386)
• CVE-2021-4204: Fixed a vulnerability that allows local attackers to escalate privileges on affected installations via ebpf. (bnc#1194111)
• CVE-2022-23222: Fixed a bug that allowed local users to gain privileges. (bnc#1194765)
• CVE-2022-0264: Fixed a vulnerability in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (bnc#1194826)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-1205: Fixed null pointer dereference and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. (bsc#1198027)
• CVE-2022-1198: Fixed an use-after-free vulnerability that allow an attacker to crash the linux kernel by simulating Amateur Radio (bsc#1198030).
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bsc#1177282)
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via Spectre like attacks (bsc#1199650).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-1966: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-21499: Reinforce the kernel lockdown feature, until now it's been trivial to break out of it with kgdb or kdb. (bsc#1199426)
• CVE-2022-1836: Fixed a bug in the floppy submodule disabling FDRAWCMD by default. (bsc#1198866)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX which could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2021-33655: Fixed memory out of bounds write by ioctl cmd FBIOPUT_VSCREENINFO (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write related to ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2022-1116: Fixed a integer overflow vulnerability in io_uring which allowed a local attacker to cause memory corruption and escalate privileges to root (bnc#1199647).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem. This flaw allowed a local user to crash the system or read unauthorized random data from memory. (bnc#1198829)
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
• CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-21505: Fixed kexec lockdown bypass with ima policy (bsc#1201458).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-36946: Fixed incorrect packet truncation in nfqnl_mangle() that could lead to remote DoS (bnc#1201940).

The following non-security bugs were fixed:

• bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278).
• dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278).
• dma-mapping: add a dma_ops_bypass flag to struct device (bsc#1196472 ltc#192278).
• dma-mapping: move the remaining DMA API calls out of line (bsc#1196472 ltc#192278).
• dma: kABI: Add back removed exports (bsc#1196472 ltc#192278).
• exec: Force single empty string when argv is empty (bsc#1200571).
• fsnotify: invalidate dcache before IN_DELETE event (bsc#1195478 bsc#1200905).
• kvm: emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930).
• kvm: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930).
• powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278).
• powerpc/pseries/iommu: Create defines for…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump (bsc#1220253).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
• CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixex a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2021-47077: Fixed a NULL pointer dereference when in shost_data (bsc#1220861).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get and nfc_llcp_sock_get_sn (bsc#1220831).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval (bsc#1218915).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control (bsc#1220825).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46953: Fixed a corruption in interrupt mappings on watchdow probe failure (bsc#1220599).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47054: Fixed a bug to put child node before return (bsc#1220767).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46906: Fixed an info leak in hid_submit_ctrl (bsc#1220421).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2020-36777: Fixed a memory leak in dvb_media_device_free (bsc#1220526).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge (CVE-2023-46343).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).
• CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).

The following non-security bugs were fixed:

• ASN.1: Fix check for strdup() success (git-fixes).
• audit: fix possible soft lockup in __audit_inode_child() (git-fixes).
• Bluetooth: hci_bcsp: do not call kfree_skb() under spin_lock_irqsave() (git-fixes).
• Bluetooth: hci_h5: do…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item (bsc#1220918).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
• CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
• CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
• CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2024-26586: Fixed stack corruption (bsc#1220243).
• CVE-2024-26595:…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-26600: Fixed NULL pointer dereference for SRP (bsc#1220340).
• CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
• CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
• CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
• CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
• CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
• CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2021-47077: Fixed a NULL pointer dereference when in shost_data (bsc#1220861).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
• CVE-2021-33200: Fixed a leakage of uninitialized bpf stack under speculation. (bsc#1186484)
• CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
• CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
• CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU (bsc#1219295).
• CVE-2024-0607: Fixed 64-bit load issue in nft_byteorder_eval() (bsc#1218915).
• CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
• CVE-2023-52451: Fixed access beyond end of drmem array (bsc#1220250).
• CVE-2021-46953: Fixed a corruption in interrupt mappings on watchdow probe failure (bsc#1220599).
• CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier (bsc#1220238).
• CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
• CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
• CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
• CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
• CVE-2021-47054: Fixed a bug to put child node before return (bsc#1220767).
• CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
• CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
• CVE-2021-46906: Fixed an info leak in hid_submit_ctrl (bsc#1220421).
• CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
• CVE-2020-36777: Fixed a memory leak in dvb_media_device_free (bsc#1220526).
• CVE-2023-52443: Fixed crash when parsed profile name is empty (bsc#1220240).
• CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2024-26595: Fixed NULL pointer dereference in error path (bsc#1220344).
• CVE-2024-1151: Fixed unlimited number of recursions from action sets (bsc#1219835).
• CVE-2023-52464: Fixed possible out-of-bounds string access (bsc#1220330)
• CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv (bsc#1219127).

The following non-security bugs were fixed:

• ASN.1: Fix check for strdup() success (git-fixes).
• audit: fix possible soft lockup in __audit_inode_child() (git-fixes).
• Bluetooth:…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
• CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
• CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
• CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445).
• CVE-2023-52513: Fixed connection failure handling in RDMA/siw (bsc#1221022).
• CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
• CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
• CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
• CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
• CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
• CVE-2023-52567: Fixed possible Oops in serial/8250_port: when using IRQ polling (irq = 0) (bsc#1220839).
• CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i (bsc#1221055).
• CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
• CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
• CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine (bsc#1221553).
• CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47102: Fixed…