CVE-2022-32250

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel(CVE-2022-20132)

In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel(CVE-2022-20154)

A use-after-free vulnerability was found in the Linux kernel s Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue.(CVE-2022-1966)

The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used.(CVE-2022-32296)

An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. (CVE-2022-32981)

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.(CVE-2022-32250)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012)

• kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-32250)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Softirq hrtimers are being placed on the per-CPU softirq clocks on isolcpu’s. (BZ#2090484)

• enable/disable multiqueues repeatedly while ping local host, guest kernel panic (BZ#2093416)

• Backport kernel audit enhancements and fixes from v5.13-rc1 to v5.16-rc6 (BZ#2095434)

• blk_update_request: I/O error, dev nvme0n3, during xfs creation (BZ#2100150)

• SCSI updates for Rocky Linux 8.7 (BZ#2100254)

• Kernel bug on mm/slub.c:314 (BZ#2102251)

• Implement new tc action for check_pkt_len (BZ#2102333)

• too long timeout value with TIME_WAIT status of conntrack entry (BZ#2104002)

• Connectx6-DX, mlx5 , backport 087032ee7021 ("net/mlx5e: TC, Fix ct_clear overwriting ct action metadata") (BZ#2104012)

• mlx5: Software steering memory allocation failure, netperf TCP_CRR with ct(). (BZ#2104013)

• tcp: request_sock leak in Calico OCP (BZ#2104670)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012)

• kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-32250)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• The latest Rocky Linux 8.6.z2 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2107215)

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es):

• kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012)
• kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-32250) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• Softirq hrtimers are being placed on the per-CPU softirq clocks on isolcpu’s. (BZ#2090484)
• enable/disable multiqueues repeatedly while ping local host, guest kernel panic (BZ#2093416)
• Backport kernel audit enhancements and fixes from v5.13-rc1 to v5.16-rc6 (BZ#2095434)
• blk_update_request: I/O error, dev nvme0n3, during xfs creation (BZ#2100150)
• SCSI updates for AlmaLinux 8.7 (BZ#2100254)
• Kernel bug on mm/slub.c:314 (BZ#2102251)
• Implement new tc action for check_pkt_len (BZ#2102333)
• too long timeout value with TIME_WAIT status of conntrack entry (BZ#2104002)
• Connectx6-DX, mlx5 , backport 087032ee7021 ("net/mlx5e: TC, Fix ct_clear overwriting ct action metadata") (BZ#2104012)
• mlx5: Software steering memory allocation failure, netperf TCP_CRR with ct(). (BZ#2104013)
• tcp: request_sock leak in Calico OCP (BZ#2104670)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es):

• kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012)
• kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-32250) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es):
• The latest AlmaLinux 8.6.z2 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2107215)

• media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
• net: mpls: fix stale pointer if allocation fails during device rename {CVE-2023-26545}
• net/ulp: prevent ULP without clone op from entering the LISTEN status {CVE-2023-0461}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() {CVE-2022-3640}
• mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
• usb: mon: make mmapped memory read only {CVE-2022-43750}
• ath9k: fix use-after-free in ath9k_hif_usb_rx_cb {CVE-2022-1679}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• netfilter: nf_tables: disallow non-stateful expression in sets earlier {CVE-2022-32250}
• perf: Fix sys_perf_event_open() race against self {CVE-2022-1729}
• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28388}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• media: em28xx: initialize refcount before kref_get {CVE-2022-3239}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE {CVE-2022-30594}
• af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
• Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() {CVE-2021-3640}
• igmp: Add ip_mc_list lock in ip_check_mc_rcu {CVE-2022-20141}
• af_unix: fix garbage collect vs MSG_PEEK {CVE-2021-0920}
• r8152: Rate limit overflow messages {CVE-2022-3594}

• media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() {CVE-2023-1118}
• net: mpls: fix stale pointer if allocation fails during device rename {CVE-2023-26545}
• net/ulp: prevent ULP without clone op from entering the LISTEN status {CVE-2023-0461}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() {CVE-2022-3640}
• mISDN: fix use-after-free bugs in l1oip timer handlers {CVE-2022-3565}
• usb: mon: make mmapped memory read only {CVE-2022-43750}
• ath9k: fix use-after-free in ath9k_hif_usb_rx_cb {CVE-2022-1679}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• netfilter: nf_tables: disallow non-stateful expression in sets earlier {CVE-2022-32250}
• perf: Fix sys_perf_event_open() race against self {CVE-2022-1729}
• openvswitch: fix OOB access in reserve_sfa_size() {CVE-2022-2639}
• can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28388}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• media: em28xx: initialize refcount before kref_get {CVE-2022-3239}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE {CVE-2022-30594}
• af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register {CVE-2022-1353}
• Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() {CVE-2021-3640}
• igmp: Add ip_mc_list lock in ip_check_mc_rcu {CVE-2022-20141}
• af_unix: fix garbage collect vs MSG_PEEK {CVE-2021-0920}

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-20141: Fixwed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes). -…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1012: Fixed a small table perturb size in the TCP source port generation algorithm which could leads to information leak. (bsc#1199482).
• CVE-2022-20141: Fixed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
• ALSA: usb-audio: Set up (implicit) sync for Saffire 6 (git-fixes).
• ALSA: usb-audio: Skip generic sync EP parse for secondary EP (git-fixes).
• ALSA: usb-audio: Workaround for clock setup on TEAC devices (git-fixes).
• arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
• ASoC: dapm: Do not fold register value changes into notifications (git-fixes).
• ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
• ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
• ASoC: tscs454: Add endianness flag in snd_soc_component_driver (git-fixes).
• ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files (git-fixes).
• ath9k: fix QCA9561 PA bias level (git-fixes).
• b43: Fix assigning negative value to unsigned variable (git-fixes).
• b43legacy: Fix assigning negative value to unsigned variable (git-fixes).
• blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
• blk-mq: Fix wrong wakeup batch configuration which will cause hang (bsc#1200263).
• block: fix bio_clone_blkg_association() to associate with proper blkcg_gq (bsc#1200259).
• btrfs: tree-checker: fix incorrect printk format (bsc#1200249).
• certs/blacklist_hashes.c: fix const confusion in certs blacklist (git-fixes).
• cfg80211: set custom regdomain after wiphy registration (git-fixes).
• clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value (git-fixes).
• clocksource/drivers/sp804: Avoid error on multiple instances (git-fixes).
• dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace (git-fixes).
• dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (git-fixes).
• drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers (git-fixes).
• drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() (git-fixes).
• drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (git-fixes).
• drivers: tty: serial: Fix deadlock in sa1100_set_termios() (git-fixes).
• drivers: usb: host: Fix deadlock in oxu_bus_suspend() (git-fixes).
• drm: imx: fix compiler warning with gcc-12 (git-fixes).
• drm: msm: fix error check return value of irq_of_parse_and_map() (git-fixes).
• drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (git-fixes).
• drm/amdgpu/smu10: fix SoC/fclk units in auto mode (git-fixes).
• drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo (git-fixes).
• drm/atomic: Force bridge self-refresh-exit on CRTC switch (git-fixes).
• drm/bridge: analogix_dp: Support PSR-exit to disable transition (git-fixes).
• drm/i915: Fix…

The SUSE Linux Enterprise 15 SP3 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2019-19377: Fixed an user-after-free that could be triggered when an attacker mounts a crafted btrfs filesystem image. (bnc#1158266)
• CVE-2022-1729: Fixed a sys_perf_event_open() race condition against self (bsc#1199507).
• CVE-2022-1184: Fixed an use-after-free and memory errors in ext4 when mounting and operating on a corrupted image. (bsc#1198577)
• CVE-2022-1652: Fixed a statically allocated error counter inside the floppy kernel module (bsc#1199063).
• CVE-2022-20008: Fixed bug that allows to read kernel heap memory due to uninitialized data in mmc_blk_read_single of block.c. (bnc#1199564)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2022-0168: Fixed a NULL pointer dereference in smb2_ioctl_query_info. (bsc#1197472)
• CVE-2021-33061: Fixed insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters that may have allowed an authenticated user to potentially enable denial of service via local access (bnc#1196426).
• CVE-2022-20141: Fixwed an use after free due to improper locking. This bug could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. (bnc#1200604)
• CVE-2022-21123: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21125: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21180: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21166: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-1975: Fixed a sleep-in-atomic bug that allows attacker to crash linux kernel by simulating nfc device from user-space. (bsc#1200143)
• CVE-2022-1974: Fixed an use-after-free that could causes kernel crash by simulating an nfc device from user-space. (bsc#1200144)
• CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism. (bnc#1177282)
• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)

The following non-security bugs were fixed:

• ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default (git-fixes).
• ACPI: property: Release subnode properties with data nodes (git-fixes).
• ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
• ACPI: sysfs: Make sparse happy about address space in use (git-fixes).
• ALSA: ctxfi: Add SB046x PCI ID (git-fixes).
• ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes (git-fixes).
• ALSA: hda - fix unused Realtek function when PM is not enabled (git-fixes).
• ALSA: hda/conexant - Fix loopback issue with CX20632 (git-fixes).
• ALSA: hda/realtek - Add new type for ALC245 (git-fixes).
• ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS (git-fixes).
• ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop (git-fixes).
• ALSA: hda/realtek: Enable headset mic on Lenovo P360 (git-fixes).
• ALSA: pcm: Check for null pointer of pointer substream before dereferencing it (git-fixes).
• ALSA: usb-audio: Add missing ep_idx in fixed EP quirks (git-fixes).
• ALSA: usb-audio: Clear MIDI port active flag after draining (git-fixes). -…

This update for the Linux Kernel 5.3.18-150300_59_71 fixes several issues.

The following security issues were fixed:

• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring that allows local attacker to cause memory corruption and escalate privileges to root. (bsc#1199647) versions.

This update for the Linux Kernel 5.3.18-150300_59_68 fixes several issues.

The following security issues were fixed:

• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring that allows local attacker to cause memory corruption and escalate privileges to root. (bsc#1199647) versions.
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)

This update for the Linux Kernel 5.3.18-150200_24_112 fixes several issues.

The following security issues were fixed:

• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring that allows local attacker to cause memory corruption and escalate privileges to root. (bsc#1199647) versions.
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)

This update for the Linux Kernel 5.3.18-59_5 fixes several issues.

The following security issues were fixed:

• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring that allows local attacker to cause memory corruption and escalate privileges to root. (bsc#1199647) versions.
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)

This update for the Linux Kernel 5.3.18-150300_59_54 fixes several issues.

The following security issues were fixed:

• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring that allows local attacker to cause memory corruption and escalate privileges to root. (bsc#1199647) versions.
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)

This update for the Linux Kernel 5.3.18-150300_59_63 fixes several issues.

The following security issues were fixed:

• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-1116: Fixed an integer overflow vulnerability in io_uring that allows local attacker to cause memory corruption and escalate privileges to root. (bsc#1199647) versions.
• CVE-2022-1734: Fixed a r/w use-after-free when non synchronized between cleanup routine and firmware download routine. (bnc#1199605)

This update for the Linux Kernel 5.14.21-150400_22 fixes several issues.

The following security issues were fixed:

• CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-30594: Fixed restriction bypass on setting the PT_SUSPEND_SECCOMP flag (bnc#1199505).
• CVE-2022-1280: Fixed a use-after-free vulnerability in drm_lease_held in drivers/gpu/drm/drm_lease.c (bnc#1197914).
• CVE-2022-1280: Fixed a use-after-free vulnerability in drm_lease_held in drivers/gpu/drm/drm_lease.c (bnc#1197914).
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956)