CVE-2022-29156

The Linux Kernel, the operating system core itself.

Security Fix(es):

A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system(CVE-2022-1205)

A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.(CVE-2022-1199)

A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.(CVE-2022-1353)

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.(CVE-2022-23960)

drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.(CVE-2022-29156)

A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system.(CVE-2022-0500)

Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn t check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042(CVE-2022-23036)

In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel(CVE-2021-39686)

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.(CVE-2022-0001)

Linux PV device frontends…

drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.

drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29156: Fixed a double free related to rtrs_clt_dev_release (bnc#1198515).
• CVE-2022-28893: Ensuring that sockets are in the intended state inside the SUNRPC subsystem (bnc#1198330).
• CVE-2022-28748: Fixed memory lead over the network by ax88179_178a devices (bsc#1196018).
• CVE-2022-28356: Fixed a refcount leak bug found in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
• CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1280: Fixed a use-after-free vulnerability in drm_lease_held in drivers/gpu/drm/drm_lease.c (bnc#1197914).
• CVE-2022-1158: Fixed KVM x86/mmu compare-and-exchange of gPTE via the user address (bsc#1197660).
• CVE-2022-0812: Fixed random memory leakage inside NFS/RDMA (bsc#1196639).
• CVE-2021-4154: Fixed a use-after-free flaw inside cgroup1_parse_param in kernel/cgroup/cgroup-v1.c. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system (bnc#1193842).
• CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
• CVE-2021-0707: Fixed possible memory corruption due to a use after free inside dma_buf_releas e of dma-buf.c (bnc#1198437).
• CVE-2020-27835: Fixed use after free in infiniband hfi1 driver in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).

The following non-security bugs were fixed:

• ACPI: processor idle: Check for architectural support for LPI (git-fixes).
• ACPI/APEI: Limit printable size of BERT table data (git-fixes).
• ACPICA: Avoid walking the ACPI Namespace if it is not there (git-fixes).
• adm8211: fix error return code in adm8211_probe() (git-fixes).
• ALSA: cs4236: fix an incorrect NULL check on list iterator (git-fixes).
• ALSA: hda/hdmi: fix warning about PCM count when used with SOF (git-fixes).
• ALSA: hda/realtek: Add alc256-samsung-headphone fixup (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD50PNT (git-fixes).
• ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 (git-fixes).
• ALSA: pcm: Test for 'silence' field in struct 'pcm_format_data' (git-fixes).
• ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb (git-fixes).
• ALSA: usb-audio: Increase max buffer size (git-fixes).
• ALSA: usb-audio: Limit max buffer and period sizes per time (git-fixes).
• arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1 (git-fixes)
• arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node (git-fixes)
• arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode (git-fixes)
• arm64: dts: exynos: correct GIC CPU interfaces address range on (git-fixes)
• arm64: dts: ls1028a: fix memory node (git-fixes)
• arm64: dts: ls1028a: fix node name for the sysclk (git-fixes)
• arm64: dts: lx2160a: fix scl-gpios property name (git-fixes)
• arm64: dts: marvell: armada-37xx: Extend PCIe MEM space (git-fixes)
• arm64: dts: marvell: armada-37xx: Fix reg for standard variant of (git-fixes)
• arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0 (git-fixes)
• arm64: dts: rockchip: Fix…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-27835: Fixed a use after free vulnerability in infiniband hfi1 driver in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).
• CVE-2021-0707: Fixed a use after free vulnerability in dma_buf_release of dma-buf.c, which may lead to local escalation of privilege with no additional execution privileges needed (bnc#1198437).
• CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055).
• CVE-2021-4154: Fixed a use-after-free vulnerability in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c, allowing a local privilege escalation by an attacker with user privileges by exploiting the fsconfig syscall parameter, leading to a container breakout and a denial of service on the system (bnc#1193842).
• CVE-2022-0812: Fixed information leak when a file is read from RDMA (bsc#1196639)
• CVE-2022-1158: Fixed a vulnerability in the kvm module that may lead to a use-after-free write or denial of service (bsc#1197660).
• CVE-2022-1280: Fixed a use-after-free vulnerability in drm_lease_held in drivers/gpu/drm/drm_lease.c (bnc#1197914).
• CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2022-28356: Fixed a refcount leak bug in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-28748: Fixed memory lead over the network by ax88179_178a devices (bsc#1196018).
• CVE-2022-28893: Fixed a use after free vulnerability in inet_put_port where some sockets are not closed before xs_xprt_free() (bsc#1198330).
• CVE-2022-29156: Fixed a double free vulnerability related to rtrs_clt_dev_release.ate (jsc#SLE-15176 bsc#1198515).

The following non-security bugs were fixed:

• ACPI/APEI: Limit printable size of BERT table data (git-fixes).
• ACPI: processor idle: Check for architectural support for LPI (git-fixes).
• ACPICA: Avoid walking the ACPI Namespace if it is not there (git-fixes).
• ALSA: cs4236: fix an incorrect NULL check on list iterator (git-fixes).
• ALSA: hda/hdmi: fix warning about PCM count when used with SOF (git-fixes).
• ALSA: hda/realtek: Add alc256-samsung-headphone fixup (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD50PNT (git-fixes).
• ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 (git-fixes).
• ALSA: pcm: Test for 'silence' field in struct 'pcm_format_data' (git-fixes).
• ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb (git-fixes).
• ALSA: usb-audio: Increase max buffer size (git-fixes).
• ALSA: usb-audio: Limit max buffer and period sizes per time (git-fixes).
• ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek (git-fixes).
• ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use (git-fixes).
• ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs (git-fixes).
• ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component (git-fixes).
• ASoC: soc-compress: Change the check for codec_dai (git-fixes).
• ASoC: soc-compress: prevent the potentially use of null pointer (git-fixes).
• ASoC: soc-core: skip zero num_dai component in searching dai name (git-fixes).
• ASoC: soc-dapm: fix two incorrect uses of list iterator…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-29156: Fixed a double free related to rtrs_clt_dev_release (bnc#1198515).
• CVE-2022-28893: Ensuring that sockets are in the intended state inside the SUNRPC subsystem (bnc#1198330).
• CVE-2022-28748: Fixed memory lead over the network by ax88179_178a devices (bsc#1196018).
• CVE-2022-28356: Fixed a refcount leak bug found in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012).
• CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742).
• CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c (bnc#1198516).
• CVE-2022-1280: Fixed a use-after-free vulnerability in drm_lease_held in drivers/gpu/drm/drm_lease.c (bnc#1197914).
• CVE-2022-1158: Fixed KVM x86/mmu compare-and-exchange of gPTE via the user address (bsc#1197660).
• CVE-2022-0812: Fixed random memory leakage inside NFS/RDMA (bsc#1196639).
• CVE-2021-4154: Fixed a use-after-free flaw inside cgroup1_parse_param in kernel/cgroup/cgroup-v1.c. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system (bnc#1193842).
• CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055).
• CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc#1191647).
• CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc#1183723).
• CVE-2021-0707: Fixed possible memory corruption due to a use after free inside dma_buf_releas e of dma-buf.c (bnc#1198437).
• CVE-2020-27835: Fixed use after free in infiniband hfi1 driver in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system (bnc#1179878).

The following non-security bugs were fixed:

• ACPI: processor idle: Check for architectural support for LPI (git-fixes).
• ACPI/APEI: Limit printable size of BERT table data (git-fixes).
• ACPICA: Avoid walking the ACPI Namespace if it is not there (git-fixes).
• adm8211: fix error return code in adm8211_probe() (git-fixes).
• ALSA: cs4236: fix an incorrect NULL check on list iterator (git-fixes).
• ALSA: hda/hdmi: fix warning about PCM count when used with SOF (git-fixes).
• ALSA: hda/realtek: Add alc256-samsung-headphone fixup (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo PD50PNT (git-fixes).
• ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 (git-fixes).
• ALSA: pcm: Test for 'silence' field in struct 'pcm_format_data' (git-fixes).
• ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb (git-fixes).
• ALSA: usb-audio: Increase max buffer size (git-fixes).
• ALSA: usb-audio: Limit max buffer and period sizes per time (git-fixes).
• arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1 (git-fixes)
• arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node (git-fixes)
• arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode (git-fixes)
• arm64: dts: exynos: correct GIC CPU interfaces address range on (git-fixes)
• arm64: dts: ls1028a: fix memory node (git-fixes)
• arm64: dts: ls1028a: fix node name for the sysclk (git-fixes)
• arm64: dts: lx2160a: fix scl-gpios property name (git-fixes)
• arm64: dts: marvell: armada-37xx: Extend PCIe MEM space (git-fixes)
• arm64: dts: marvell: armada-37xx: Fix reg for standard variant of (git-fixes)
• arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0 (git-fixes)
• arm64: dts: rockchip: Fix GPU…

Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2021-26401)

It was discovered that the MMC/SD subsystem in the Linux kernel did not properly handle read errors from SD cards in certain situations. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-20008)

It was discovered that the USB gadget subsystem in the Linux kernel did not properly validate interface descriptor requests. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-25258)

It was discovered that the Remote NDIS (RNDIS) USB gadget implementation in the Linux kernel did not properly validate the size of the RNDIS_MSG_SET command. An attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-25375)

It was discovered that the ST21NFCA NFC driver in the Linux kernel did not properly validate the size of certain data in EVT_TRANSACTION events. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-26490)

It was discovered that the USB SR9700 ethernet device driver for the Linux kernel did not properly validate the length of requests from the device. A physically proximate attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-26966)

It was discovered that the Xilinx USB2 device gadget driver in the Linux kernel did not properly validate endpoint indices from the host. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-27223)

Miaoqian Lin discovered that the RDMA Transport (RTRS) client implementation in the Linux kernel contained a double-free when handling certain error conditions. An attacker could use this to cause a denial of service (system crash). (CVE-2022-29156)