CVE-2022-2938

The Linux Kernel, the operating system core itself.

Security Fix(es):

A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects.(CVE-2022-2938)

A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation.(CVE-2022-2586)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

• Race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• Memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

• Uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

• Race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)

• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

• Memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

• Double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

• Use after free in SUNRPC subsystem (CVE-2022-28893)

• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

• race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)

• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• Spectre-BHB (CVE-2022-23960)

• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

• memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

• use after free in SUNRPC subsystem (CVE-2022-28893)

• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• Race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• Memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• Uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• Race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• Memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
• Double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• Use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• Spectre-BHB (CVE-2022-23960)
• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• cgroup: cgroup.{procs,threads} factor out common parts
• cgroup: unify attach permission checking
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving {CVE-2022-2964}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• net: usb: ax88179_178a: fix packet alignment padding {CVE-2022-2964}
• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• RDMA/cma: Make the locking for automatic state transition more clear
• ath10k: Validate first subframe of A-MSDU before processing the list {CVE-2020-24588}
• ath10k: drop MPDU which has discard flag set by firmware for SDIO {CVE-2020-24588}
• mac80211: drop A-MSDUs on old ciphers {CVE-2020-24588}
• cfg80211: mitigate A-MSDU aggregation attacks {CVE-2020-24588}
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• cgroup: fix psi monitor for root cgroup
• cgroup/cgroup.c: replace 'of->kn->priv' with of_cft()
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects.

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a denial of service upon binding to an already bound chain (bnc#1203117).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-36946: Fixed a denial of service (panic) inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c (bnc#1201940).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3078: Fixed a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c (bnc#1203041).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-2959: Fixed a race condition that was found inside the watch queue due to a missing lock in pipe_resize_ring() (bnc#1202681).
• CVE-2022-2938: Fixed a flaw that was found inside the Pressure Stall Information implementation that could have been used to allow an attacker to crash the system or have other memory-corruption side effects (bnc#1202623).
• CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564, bsc#1202860).
• CVE-2022-2873: Fixed an out-of-bounds memory access flaw that was found in iSMT SMBus host controller driver (bnc#1202558).
• CVE-2022-28693: Fixed x86/speculation behavior by disabling RRSBA (bsc#1201455).
• CVE-2022-28356: Fixed a refcount leak bug that was found in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors that may have allowed information disclosure via local access (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-2585: Fixed missing cleanup of CPU timers before freeing them during exec (bsc#1202094).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-1184: Fixed an use-after-free flaw in fs/ext4/namei.c:dx_insert_block() in the filesystem sub-component (bnc#1198577).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
• CVE-2021-33135: Fixed uncontrolled resource consumption inside Intel(R) SGX that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1199515).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).

The following non-security bugs were fixed:

• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: APEI: explicit init of HEST and GHES in apci_init() (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk (git-fixes).
• ACPI: EC: Remove duplicate…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a denial of service upon binding to an already bound chain (bnc#1203117).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-3078: Fixed a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c (bnc#1203041).
• CVE-2022-28356: Fixed a refcount leak bug that was found in net/llc/af_llc.c (bnc#1197391).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564, bsc#1202860).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-2938: Fixed a flaw that was found inside the Pressure Stall Information implementation that could have been used to allow an attacker to crash the system or have other memory-corruption side effects (bnc#1202623).
• CVE-2022-28693: Fixed x86/speculation behavior by disabling RRSBA (bsc#1201455).
• CVE-2021-33135: Fixed uncontrolled resource consumption inside Intel(R) SGX that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1199515).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-2959: Fixed a race condition that was found inside the watch queue due to a missing lock in pipe_resize_ring() (bnc#1202681 bnc#1202685).
• CVE-2022-36946: Fixed a denial of service (panic) inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c (bnc#1201940 bnc#1201941 bnc#1202312 bnc#1202874).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
• CVE-2022-2873: Fixed an out-of-bounds memory access flaw that was found in iSMT SMBus host controller driver (bnc#1202558).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2022-32250: Fixed a privilege escalation issue in net/netfilter/nf_tables_api.c that allowed a local user to became root (bnc#1200015).

The following non-security bugs were fixed:

• 9p: Fix refcounting during full path walks for fid lookups (git-fixes).
• 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl (git-fixes).
• 9p: fix fid refcount leak in v9fs_vfs_get_link (git-fixes).
• ACPI: APEI: Better fix to avoid spamming the console with old error logs (git-fixes).
• ACPI: APEI: explicit init of HEST and GHES in apci_init() (git-fixes).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk (git-fixes).
• ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-42328: Guests could trigger denial of service via the netback driver (bsc#1206114).
• CVE-2022-42329: Guests could trigger denial of service via the netback driver (bsc#1206113).
• CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
• CVE-2022-3633: Fixed a memory leak in j1939_session_destroy of the file net/can/j1939/transport.c (bsc#1204650).
• CVE-2022-3114: Fixed a denial of service in imx_register_uart_clocks() in drivers/clk/imx/clk.c (bsc#1206391).
• CVE-2022-3619: Fixed a memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (bsc#1204569).
• CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c (bsc#1204631).
• CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c (bsc#1203960).
• CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c (bsc#1205796).
• CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
• CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
• CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
• CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect() and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively) remotely via Bluetooth (bsc#1205709).
• CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req() which can be used to leak kernel pointers remotely (bsc#1205705).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bsc#1198702).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bsc#1204653).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bsc#1204402).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bsc#1204574).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bsc#1203514).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
• CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
• CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
• CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109). polled (bsc#1202623).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
• CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
• CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595)
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758).
• CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

The following non-security bugs were fixed:

• NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633 bsc#1226226).
• ocfs2: adjust enabling place for la window (bsc#1219224).
• ocfs2: fix sparse warnings (bsc#1219224).
• ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
• ocfs2: speed up chain-list searching (bsc#1219224).
• psi: Fix uaf issue when psi trigger is destroyed while being
• x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
• CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
• CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
• CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
• CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
• CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
• CVE-2022-2938: psi: Fix uaf issue when psi trigger is destroyed while being polled (bsc#1202623).
• CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
• CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109).
• CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
• CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
• CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
• CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
• CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
• CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
• CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
• CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595)
• CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758).
• CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

The following non-security bugs were fixed:

• ocfs2: adjust enabling place for la window (bsc#1219224).
• ocfs2: fix sparse warnings (bsc#1219224).
• ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
• ocfs2: speed up chain-list searching (bsc#1219224).
• x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).
• x86/xen: Drop USERGS_SYSRET64 paravirt call (git-fixes).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.


The following security bugs were fixed:

- CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
- CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
- CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
- CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
- CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
- CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
- CVE-2022-2938: psi: Fix uaf issue when psi trigger is destroyed while being polled (bsc#1202623).
- CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
- CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109). polled (bsc#1202623).
- CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
- CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
- CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
- CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
- CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
- CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
- CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
- CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
- CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
- CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
- CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
- CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
- CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
- CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
- CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

The following non-security bugs were fixed:

- NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633 bsc#1226226).
- ocfs2: adjust enabling place for la window (bsc#1219224).
- ocfs2: fix sparse warnings (bsc#1219224).
- ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
- ocfs2: speed up chain-list searching (bsc#1219224).
- psi: Fix uaf issue when psi trigger is destroyed while being
- x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).