CVE-2022-21385

A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2019-3900: Fixed infinite loop the vhost_net kernel module that could result in a DoS scenario (bnc#1133374).

The following non-security bugs were fixed:

• net_sched: cls_route: Disallowed handle of 0 (bsc#1202393).
• mm, rmap: Fixed anon_vma->degree ambiguity leading to double-reuse (bsc#1203098).
• lightnvm: Removed lightnvm implemenation (bsc#1191881).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).

The following non-security bugs were fixed:

• 9p: migrate from sync_inode to filemap_fdatawrite_wbc (bsc#1202528).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• Fix releasing of old bundles in xfrm_bundle_lookup() (bsc#1201264 bsc#1190397 bsc#1199617).
• KABI: cgroup: Restore KABI of css_set (bsc#1201610).
• KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs (bsc#1065729).
• KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
• KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP (bsc#1120716).
• KVM: x86: Mark TSS busy during LTR emulation after all fault checks (git-fixes).
• KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP (git-fixes).
• PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors (git-fixes).
• README, patch-tag-template, header.py: Abolish Novell and FATE (bsc#1189904).
• SUNRPC: Fix READ_PLUS crasher (git-fixes).
• SUNRPC: Fix the svc_deferred_event trace class (git-fixes).
• USB: new quirk for Dell Gen 2 devices (git-fixes).
• USB: serial: io_ti: add Agilent E5805A support (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• bs-upload-kernel: Workaround for vim syntax highlighting
• bs-upload-kernel: build klp_symbols when supported. cherry-picked from kbuild
• btrfs: Convert fs_info->free_chunk_space to atomic64_t (bsc#1202528).
• btrfs: add a trace class for dumping the current ENOSPC state (bsc#1202528).
• btrfs: add a trace point for reserve tickets (bsc#1202528).
• btrfs: adjust the flush trace point to include the source (bsc#1202528).
• btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1202528).
• btrfs: check worker before need_preemptive_reclaim (bsc#1202528).
• btrfs: do not do preemptive flushing if the majority is global rsv (bsc#1202528).
• btrfs: do not include the global rsv size in the preemptive used amount (bsc#1202528).
• btrfs: enable a tracepoint when we fail tickets (bsc#1202528).
• btrfs: handle preemptive delalloc flushing slightly differently (bsc#1202528).
• btrfs: implement space clamping for preemptive flushing (bsc#1202528).
• btrfs: improve preemptive background space flushing (bsc#1202528).
• btrfs: include…

The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36946: Fixed a denial of service (panic) inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c (bnc#1201940).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20166: Fixed possible out of bounds write due to a heap buffer overflow in various methods of kernel base drivers (bnc#1200598).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could have led to a use-after-free (bnc#1201429).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).

The following non-security bugs were fixed:

• cifs: fix error paths in cifs_tree_connect() (bsc#1177440).
• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944).
• cifs: report error instead of invalid when revalidating a dentry fails (bsc#1177440).
• cifs: skip trailing separators of prefix paths (bsc#1188944).
• kernel-obs-build: include qemu_fw_cfg (boo#1201705)
• lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325).
• mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc#1203098).
• mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes, bsc#1203098).
• net_sched: cls_route: disallow handle of 0 (bsc#1202393).
• objtool: Add --backtrace support (bsc#1202396).
• objtool: Add support for intra-function calls (bsc#1202396).
• objtool: Allow no-op CFI ops in alternatives (bsc#1202396).
• objtool: Convert insn type to enum (bsc#1202396).
• objtool: Do not use ignore flag for fake jumps (bsc#1202396).
• objtool: Fix !CFI insn_state propagation (bsc#1202396).
• objtool: Fix ORC vs alternatives (bsc#1202396).
• objtool: Fix sibling call detection (bsc#1202396).
• objtool: Make handle_insn_ops() unconditional (bsc#1202396).
• objtool: Remove INSN_STACK (bsc#1202396).
• objtool: Remove check preventing branches within alternative (bsc#1202396).
• objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain (bsc#1202396).
• objtool: Rename struct cfi_state (bsc#1202396).
• objtool: Rework allocating stack_ops on decode (bsc#1202396).
• objtool: Rewrite alt->skip_orig (bsc#1202396).
• objtool: Set insn->func for alternatives (bsc#1202396).
• objtool: Support conditional retpolines (bsc#1202396).
• objtool: Support multiple stack_op per instruction (bsc#1202396).
• objtool: Track original function across branches (bsc#1202396).
• objtool: Uniquely identify alternative instruction groups (bsc#1202396).
• objtool: Use Elf_Scn typedef instead of…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).

The following non-security bugs were fixed:

• 9p: migrate from sync_inode to filemap_fdatawrite_wbc (bsc#1202528).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• Fix releasing of old bundles in xfrm_bundle_lookup() (bsc#1201264 bsc#1190397 bsc#1199617).
• KABI: cgroup: Restore KABI of css_set (bsc#1201610).
• KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs (bsc#1065729).
• KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
• KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP (bsc#1120716).
• KVM: x86: Mark TSS busy during LTR emulation after all fault checks (git-fixes).
• KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP (git-fixes).
• PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors (git-fixes).
• Revert 'USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set' (git-fixes).
• Revert 'r8152: adjust the settings about MAC clock speed down for RTL8153' (git-fixes).
• SUNRPC: Fix READ_PLUS crasher (git-fixes).
• SUNRPC: Fix the svc_deferred_event trace class (git-fixes).
• USB: new quirk for Dell Gen 2 devices (git-fixes).
• USB: serial: io_ti: add Agilent E5805A support (git-fixes).
• add Kirk Allan as branch maintainer
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• btrfs: Convert fs_info->free_chunk_space to atomic64_t (bsc#1202528).
• btrfs: add a trace class for dumping the current ENOSPC state (bsc#1202528).
• btrfs: add a trace point for reserve tickets (bsc#1202528).
• btrfs: adjust the flush trace point to include the source (bsc#1202528).
• btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1202528).
• btrfs: check worker before need_preemptive_reclaim (bsc#1202528).
• btrfs: do not do preemptive flushing if the majority is global rsv (bsc#1202528).
• btrfs: do not include the global rsv size in the preemptive used amount (bsc#1202528).
• btrfs: enable a tracepoint when we fail tickets (bsc#1202528).
• btrfs: handle preemptive delalloc flushing slightly differently (bsc#1202528).
• btrfs: implement space clamping for preemptive flushing (bsc#1202528).
• btrfs: improve preemptive background space flushing (bsc#1202528).
• btrfs: include delalloc related info in dump space info tracepoint…

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).

The following non-security bugs were fixed:

• cifs: fix error paths in cifs_tree_connect() (bsc#1177440).
• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944).
• cifs: report error instead of invalid when revalidating a dentry fails (bsc#1177440).
• cifs: skip trailing separators of prefix paths (bsc#1188944).
• kernel-obs-build: include qemu_fw_cfg (boo#1201705)
• lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325).
• mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc#1203098).
• mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes, bsc#1203098).
• net_sched: cls_route: disallow handle of 0 (bsc#1202393).
• objtool: Add --backtrace support (bsc#1202396).
• objtool: Add relocation check for alternative sections (bsc#1202396).
• objtool: Add support for intra-function calls (bsc#1202396).
• objtool: Allow no-op CFI ops in alternatives (bsc#1202396).
• objtool: Clean instruction state before each function validation (bsc#1169514).
• objtool: Convert insn type to enum (bsc#1202396).
• objtool: Do not use ignore flag for fake jumps (bsc#1202396).
• objtool: Fix !CFI insn_state propagation (bsc#1202396).
• objtool: Fix ORC vs alternatives (bsc#1202396).
• objtool: Fix sibling call detection (bsc#1202396).
• objtool: Fix switch table detection in .text.unlikely (bsc#1202396).
• objtool: Ignore empty alternatives (bsc#1169514).
• objtool: Make BP scratch register warning more robust (bsc#1202396).
• objtool: Make handle_insn_ops() unconditional (bsc#1202396).
• objtool: Remove INSN_STACK (bsc#1202396).
• objtool: Remove check preventing branches within alternative (bsc#1202396).
• objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain (bsc#1202396).
• objtool: Rename struct cfi_state (bsc#1202396).
• objtool: Rework allocating stack_ops on decode (bsc#1202396).
• objtool: Rewrite alt->skip_orig (bsc#1202396).
• objtool: Set insn->func for alternatives (bsc#1202396).
• objtool: Support conditional retpolines (bsc#1202396).
• objtool: Support multiple stack_op per instruction (bsc#1202396).
• objtool: Track original function across…

The SUSE Linux Enterprise 12 SP2 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2019-3900: Fixed infinite loop the vhost_net kernel module that could result in a DoS scenario (bnc#1133374).

The following non-security bugs were fixed:

• net_sched: cls_route: Disallowed handle of 0 (bsc#1202393).
• mm, rmap: Fixed anon_vma->degree ambiguity leading to double-reuse (bsc#1203098).
• lightnvm: Removed lightnvm implemenation (bsc#1191881).

The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2022-1012: Fixed a memory leak problem that was found in the TCP source port generation algorithm in net/ipv4/tcp.c (bnc#1199482).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).

The following non-security bugs were fixed:

• rpm: Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• cifs: fix error paths in cifs_tree_connect() (bsc#1177440).
• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944).
• cifs: report error instead of invalid when revalidating a dentry fails (bsc#1177440).
• cifs: skip trailing separators of prefix paths (bsc#1188944).
• kernel-obs-build: include qemu_fw_cfg (boo#1201705)
• lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325).
• md/bitmap: do not set sb values if can't pass sanity check (bsc#1197158).
• mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc#1203098).
• mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes, bsc#1203098).
• net_sched: cls_route: disallow handle of 0 (bsc#1202393).
• net_sched: cls_route: disallow handle of 0 (bsc#1202393).
• objtool: Add --backtrace support (bsc#1202396).
• objtool: Add support for intra-function calls (bsc#1202396).
• objtool: Allow no-op CFI ops in alternatives (bsc#1202396).
• objtool: Convert insn type to enum (bsc#1202396).
• objtool: Do not use ignore flag for fake jumps (bsc#1202396).
• objtool: Fix !CFI insn_state propagation (bsc#1202396).
• objtool: Fix ORC vs alternatives (bsc#1202396).
• objtool: Fix sibling call detection (bsc#1202396).
• objtool: Make handle_insn_ops() unconditional (bsc#1202396).
• objtool: Remove INSN_STACK (bsc#1202396).
• objtool: Remove check preventing branches within alternative (bsc#1202396).
• objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain (bsc#1202396).
• objtool: Rename struct cfi_state (bsc#1202396).
• objtool: Rework allocating stack_ops on decode (bsc#1202396).
• objtool: Rewrite alt->skip_orig (bsc#1202396).
• objtool: Set insn->func for alternatives (bsc#1202396).
• objtool: Support conditional…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).

The following non-security bugs were fixed:

• 9p: migrate from sync_inode to filemap_fdatawrite_wbc (bsc#1202528).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• Fix releasing of old bundles in xfrm_bundle_lookup() (bsc#1201264 bsc#1190397 bsc#1199617).
• KABI: cgroup: Restore KABI of css_set (bsc#1201610).
• KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs (bsc#1065729).
• KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
• KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP (bsc#1120716).
• KVM: x86: Mark TSS busy during LTR emulation after all fault checks (git-fixes).
• KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP (git-fixes).
• PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors (git-fixes).
• Revert 'USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set' (git-fixes).
• Revert 'r8152: adjust the settings about MAC clock speed down for RTL8153' (git-fixes).
• SUNRPC: Fix the svc_deferred_event trace class (git-fixes).
• USB: new quirk for Dell Gen 2 devices (git-fixes).
• USB: serial: io_ti: add Agilent E5805A support (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• btrfs: Convert fs_info->free_chunk_space to atomic64_t (bsc#1202528).
• btrfs: add a trace class for dumping the current ENOSPC state (bsc#1202528).
• btrfs: add a trace point for reserve tickets (bsc#1202528).
• btrfs: adjust the flush trace point to include the source (bsc#1202528).
• btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1202528).
• btrfs: check worker before need_preemptive_reclaim (bsc#1202528).
• btrfs: do not do preemptive flushing if the majority is global rsv (bsc#1202528).
• btrfs: do not include the global rsv size in the preemptive used amount (bsc#1202528).
• btrfs: enable a tracepoint when we fail tickets (bsc#1202528).
• btrfs: handle preemptive delalloc flushing slightly differently (bsc#1202528).
• btrfs: implement space clamping for preemptive flushing (bsc#1202528).
• btrfs: improve preemptive background space flushing (bsc#1202528).
• btrfs: include delalloc related info in dump space info tracepoint (bsc#1202528).
• btrfs: introduce a FORCE_COMMIT_TRANS flush operation (bsc#1202528).
• btrfs: make flush_space take a enum btrfs_flush_state instead of int (bsc#1202528).
• btrfs: only clamp the first time we have to start flushing (bsc#1202528).
• btrfs: only…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-13695: Fixed fix acpi operand cache leak in nseval.c (bsc#1055710).
• CVE-2018-7755: Fixed bypass of kernel security protections such as KASLR using fd_locked_ioctl function in drivers/block/floppy.c (bnc#1084513).
• CVE-2019-3837: Fixed memory leak due to thread-unsafe implementation of the net_dma code in tcp_recvmsg() (bnc#1131430).
• CVE-2019-3900: Fixed infinite loop while receiving packets in vhost_net (bnc#1133374).
• CVE-2020-15393: Fixed memory leak in usbtest_disconnect in drivers/usb/misc/usbtest.c (bnc#1173514).
• CVE-2020-16119: Fixed use-after-free exploitable by a local attacker due to reuse of a DCCP socket (bnc#1177471).
• CVE-2020-36557: Fixed race condition in the VT_DISALLOCATE ioctl and closing/opening of ttys which could lead to a use-after-free (bnc#1201429).
• CVE-2020-36558: Fixed race condition in VT_RESIZEX (bsc#1200910).
• CVE-2021-26341: Fixed vulnerablity where some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bnc#1201050).
• CVE-2021-33655: When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds (bnc#1201635).
• CVE-2021-33656: Fixed memory out of bounds write when setting font with malicous data by ioctl cmd PIO_FONT (bnc#1201636).
• CVE-2021-34981: Fixed file refcounter in bluetooth cmtp when cmtp_attach_device fails (bsc#1191961).
• CVE-2021-39713: Fixed race condition in the network scheduling subsystem which could lead to a use-after-free (bsc#1196973).
• CVE-2021-45868: Fixed use-after-free in fs/quota/quota_tree.c (bnc#1197366).
• CVE-2022-1011: Fixed UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (bsc#1197343).
• CVE-2022-1048: Fixed potential AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331).
• CVE-2022-1353: Fixed denial of service in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1462: Fixed out-of-bounds read in the TeleTYpe subsystem allowing local user to crash the system or read unauthorized random data from memory (bnc#1198829).
• CVE-2022-1652: Fixed use after free in floppy (bsc#1199063).
• CVE-2022-1679: Fixed use-after-free in the atheros wireless adapter driver (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read in lg_probe and related functions of hid-lg.c and other USB HID files (bnc#1200619).
• CVE-2022-20166: Fixed out of bounds write due to a heap buffer overflow which could lead to local escalation of privilege with System execution privileges needed (bnc#1200598).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bnc#1202346).
• CVE-2022-20369: Fixed out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-21166, CVE-2022-21127, CVE-2022-21123, CVE-2022-21125, CVE-2022-21180: Fixed stale MMIO data transient information leaks (INTEL-TA-00615) (bnc#1199650).
• CVE-2022-21385: Fixed warn in rds_message_alloc_sgs (bnc#1202897).
• CVE-2022-21499: Fixed issue where it was trivial to break out of lockdown using kgdb (bsc#1199426).
• CVE-2022-2318: Fixed use-after-free caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges (bnc#1201251).
• CVE-2022-2663: Fixed possible firewall bypass when users are using unencrypted IRC due to message handling confusion in nf_conntrack_irc (bnc#1202097).
• CVE-2022-28356: Fixed refcount leak bug in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-29900: Fixed mis-trained branch predictions for return instructions that may have allowed arbitrary speculative code execution under certain microarchitecture-dependent conditions (bnc#1199657).
• CVE-2022-29901: Fixed vulnerability where an attacker with unprivileged user access can hijack return instructions to…