CVE-2022-3106

An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().

An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().

• xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040}
• xen/xenbus: Fix granting of vmalloc'd memory
• xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036}
• xen/blkfront: don't trust the backend response data blindly
• xen/blkfront: don't take local copy of a request from the ring page
• xen/blkfront: read response from backend only once
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
• tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462}
• tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
• mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188}
• net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}
• netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• netfilter: nf_tables: stricter validation of element data {CVE-2022-34918}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998}
• drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998}
• drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707}
• drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108}
• hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107}
• sfc_ef100: potential dereference of null pointer {CVE-2022-3106}
• RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105}
• drm: use the lookup lock in drm_is_current_master {CVE-2022-1280}
• drm: add a locked version of drm_is_current_master {CVE-2022-1280}
• drm: serialize drm_file.master with a new spinlock {CVE-2022-1280}
• drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280}
• drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280}

• xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040}
• xen/xenbus: Fix granting of vmalloc'd memory
• xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036}
• xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036}
• xen/blkfront: don't trust the backend response data blindly
• xen/blkfront: don't take local copy of a request from the ring page
• xen/blkfront: read response from backend only once
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128}
• media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919}
• media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387}
• tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462}
• tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
• mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188}
• net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609}
• netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• netfilter: nf_tables: stricter validation of element data {CVE-2022-34918}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998}
• drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998}
• drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998}
• gfs2: Don't deref jdesc in evict {CVE-2023-3212}
• drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707}
• drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108}
• hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107}
• sfc_ef100: potential dereference of null pointer {CVE-2022-3106}
• RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105}
• drm: use the lookup lock in drm_is_current_master {CVE-2022-1280}
• drm: add a locked version of drm_is_current_master {CVE-2022-1280}
• drm: serialize drm_file.master with a new spinlock {CVE-2022-1280}
• drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280}
• drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280}
• KVM: avoid NULL pointer dereference in kvm_dirty_ring_push {CVE-2022-1263}

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c (bsc#1204171).
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-42328: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206114).
• CVE-2022-42329: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206113).
• CVE-2022-3643: Fixed a bug which could allow guests to trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
• CVE-2019-19083: Fixed a memory leaks in clock_source_create that could allow attackers to cause a denial of service (bsc#1157049).

The following non-security bugs were fixed:

• afs: Fix some tracing details (git-fixes).
• block: Do not reread partition table on exclusively open device (bsc#1190969).
• cuse: prevent clone (bsc#1206177).
• dt-bindings: clocks: imx8mp: Add ID for usb suspend clock (git-fixes).
• efi: Add iMac Pro 2017 to uefi skip cert quirk (git-fixes).
• fuse: do not check refcount after stealing page (bsc#1206174).
• fuse: fix the ->direct_IO() treatment of iov_iter (bsc#1206176).
• fuse: fix use after free in fuse_read_interrupt() (bsc#1206178).
• fuse: lock inode unconditionally in fuse_fallocate() (bsc#1206179).
• fuse: update attr_version counter on fuse_notify_inval_inode() (bsc#1206175).
• ipv6: ping: fix wrong checksum for large frames (bsc#1203183).
• kbuild: Unify options for BTF generation for vmlinux and modules (bsc#1204693).
• mm, page_alloc: avoid expensive reclaim when compaction may not succeed (bsc#1204250).
• net: mana: Fix race on per-CQ variable napi work_done (git-fixes).
• net: usb: cdc_ncm: do not spew notifications (git-fixes).
• net: usb: qmi_wwan: add u-blox 0x1342 composition (git-fixes).
• rtc: pcf85063: Fix reading alarm (git-fixes).
• s390/boot: add secure boot trailer (bsc#1205256 LTC#1205256).
• tracing: Add tracing_reset_all_online_cpus_unlocked() function (git-fixes).
• tracing: Delete all matched events (git-fixes).
• tracing: Free buffers when a used dynamic event is removed (git-fixes).
• usb: host: xhci-hub: fix extra endianness conversion (git-fixes).
• usbnet: move new members to end (git-fixes).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3344: Fixed a flaw found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0). (bsc#1204652)
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by a missing check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-4379: Fixed a use-after-free vulnerability in nfs4file.c:__nfs42_ssc_open. (bsc#1206209)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-3104: Fixed a null pointer dereference caused by caused by a missing check of the return value of kzalloc() in bugs.c:lkdtm_ARRAY_BOUNDS. (bsc#1206396)
• CVE-2022-3113: Fixed a null pointer dereference caused by a missing check of the return value of devm_kzalloc. (bsc#1206390)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3114: Fixed a null pointer dereference caused by a missing check of the return value of kcalloc. (bsc#1206391)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• acct: fix potential integer overflow in encode_comp_t() (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA (git-fixes).
• ACPICA: Fix error code path in acpi_ds_call_control_method() (git-fixes).
• ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (git-fixes).
• ALSA: asihpi: fix missing pci_disable_device() (git-fixes).
• ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list (git-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB (git-fixes).
• ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops (git-fixes).
• ALSA: line6: correct midi status byte when receiving data from podxt (git-fixes).
• ALSA: line6: fix stack overflow in line6_midi_transmit (git-fixes).
• ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (git-fixes).
• ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
• ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT (git-fixes).
• ALSA: pcm: Set missing stop_operating flag at undoing trigger start (git-fixes).
• ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (git-fixes).
• ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT (git-fixes).
• ALSA: usb-audio: add the quirk for KT0206 device (git-fixes).
• amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() (git-fixes).
• apparmor: fix a memleak in multi_transaction_new() (git-fixes).
• apparmor: Fix abi check to include v8 abi…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3344: Fixed a flaw found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0). (bsc#1204652)
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by a missing check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-4379: Fixed a use-after-free vulnerability in nfs4file.c:__nfs42_ssc_open. (bsc#1206209)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-3104: Fixed a null pointer dereference caused by a missing check of the return value of kzalloc() in bugs.c:lkdtm_ARRAY_BOUNDS. (bsc#1206396)
• CVE-2022-3113: Fixed a null pointer dereference caused by a missing check of the return value of devm_kzalloc. (bsc#1206390)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• acct: fix potential integer overflow in encode_comp_t() (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA (git-fixes).
• ACPICA: Fix error code path in acpi_ds_call_control_method() (git-fixes).
• ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (git-fixes).
• ALSA: asihpi: fix missing pci_disable_device() (git-fixes).
• ALSA: control-led: use strscpy in set_led_id() (git-fixes).
• ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 (git-fixes).
• ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle (git-fixes).
• ALSA: hda: cs35l41: Do not return -EINVAL from system suspend/resume (git-fixes).
• ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list (git-fixes).
• ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list (git-fixes).
• ALSA: hda/realtek - Turn on power early (git-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB (git-fixes).
• ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops (git-fixes).
• ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs do not work for a HP platform (git-fixes).
• ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook (git-fixes).
• ALSA: line6: correct midi status byte when receiving data from podxt (git-fixes).
• ALSA: line6: fix stack overflow in line6_midi_transmit (git-fixes).
• ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (git-fixes).
• ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
• ALSA: pcm: fix undefined behavior in bit…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-3344: Fixed a bug where nested shutdown interception could lead to host crash (bsc#1204652)
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by lacks check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-4379: Fixed a use-after-free vulnerability in nfs4file.c:__nfs42_ssc_open. (bsc#1206209)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2022-3104: Fixed a null pointer dereference caused by caused by a missing check of the return value of kzalloc() in bugs.c:lkdtm_ARRAY_BOUNDS. (bsc#1206396)
• CVE-2022-3113: Fixed a null pointer dereference caused by a missing check of the return value of devm_kzalloc. (bsc#1206390)
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3114: Fixed a null pointer dereference caused by a missing check of the return value of kcalloc. (bsc#1206391)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• acct: fix potential integer overflow in encode_comp_t() (git-fixes).
• ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA (git-fixes).
• ACPICA: Fix error code path in acpi_ds_call_control_method() (git-fixes).
• ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (git-fixes).
• ALSA: asihpi: fix missing pci_disable_device() (git-fixes).
• ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list (git-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB (git-fixes).
• ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops (git-fixes).
• ALSA: line6: correct midi status byte when receiving data from podxt (git-fixes).
• ALSA: line6: fix stack overflow in line6_midi_transmit (git-fixes).
• ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (git-fixes).
• ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
• ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT (git-fixes).
• ALSA: pcm: Set missing stop_operating flag at undoing trigger start (git-fixes).
• ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (git-fixes).
• ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT (git-fixes).
• ALSA: usb-audio: add the quirk for KT0206 device (git-fixes).
• amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() (git-fixes).
• apparmor: fix a memleak in multi_transaction_new() (git-fixes).
• apparmor: Fix abi check to include v8 abi (git-fixes).
• apparmor: fix lockdep warning when removing a namespace (git-fixes).
• apparmor: Fix memleak in alloc_ns() (git-fixes).
• apparmor: Use pointer to struct…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2023-0266: Fixed a use-after-free bug led by a missing lock in ALSA. (bsc#1207134)
• CVE-2022-47929: Fixed a NULL pointer dereference bug in the traffic control subsystem which allowed an unprivileged user to trigger a denial of service via a crafted traffic control configuration. (bsc#1207237)
• CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036)
• CVE-2023-23455: Fixed a bug that could allow attackers to cause a denial of service because of type confusion in atm_tc_enqueue. (bsc#1207125)
• CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c (bsc#1204171).
• CVE-2022-4662: Fixed a recursive locking violation in usb-storage that can cause the kernel to deadlock. (bsc#1206664)
• CVE-2022-3115: Fixed a null pointer dereference in malidp_crtc.c caused by a lack of checks of the return value of kzalloc. (bsc#1206393)
• CVE-2022-47520: Fixed an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. (bsc#1206515)
• CVE-2022-3112: Fixed a null pointer dereference caused by lacks check of the return value of kzalloc() in vdec_helpers.c:amvdec_set_canvases. (bsc#1206399)
• CVE-2022-3564: Fixed a bug which could lead to use after free, it was found in the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. (bsc#1206073)
• CVE-2022-3108: Fixed a bug in kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c where a lack of check of the return value of kmemdup() could lead to a NULL pointer dereference. (bsc#1206389)
• CVE-2019-19083: Fixed a memory leaks in clock_source_create that could allow attackers to cause a denial of service (bsc#1157049).
• CVE-2022-42328: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206114).
• CVE-2022-42329: Fixed a bug which could allow guests to trigger denial of service via the netback driver (bsc#1206113).
• CVE-2022-3643: Fixed a bug which could allow guests to trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
• CVE-2022-3107: Fixed a null pointer dereference caused by a missing check of the return value of kvmalloc_array. (bsc#1206395)
• CVE-2022-3111: Fixed a missing release of resource after effective lifetime bug caused by a missing free of the WM8350_IRQ_CHG_FAST_RDY in wm8350_init_charger. (bsc#1206394)
• CVE-2022-3105: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc_array. (bsc#1206398)
• CVE-2022-3106: Fixed a null pointer dereference caused by a missing check of the return value of kmalloc. (bsc#1206397)

The following non-security bugs were fixed:

• afs: Fix some tracing details (git-fixes).
• arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list (git-fixes)
• arm64: dts: allwinner: H5: Add PMU node (git-fixes)
• arm64: dts: allwinner: H6: Add PMU mode (git-fixes)
• arm64: dts: marvell: Add AP806-dual missing CPU clocks (git-fixes)
• arm64: dts: rockchip: add reg property to brcmf sub-nodes (git-fixes)
• arm64: dts: rockchip: fix dwmmc clock name for px30 (git-fixes)
• arm64: dts: rockchip: Fix NanoPC-T4 cooling maps (git-fixes)
• arm64: memory: Add missing brackets to untagged_addr() macro (git-fixes)
• arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() (git-fixes).
• arm64: tags: Preserve tags for addresses translated via TTBR1 (git-fixes)
• arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator (git-fixes)
• block: Do not reread partition table on exclusively open device (bsc#1190969).
• ceph: avoid putting the realm twice when decoding snaps fails (bsc#1207198).
• ceph: do not update snapshot context when there is no new snapshot (bsc#1207218).
• cuse: prevent clone (bsc#1206177).
• drbd: destroy workqueue when drbd device…