CVE-2022-48988

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix double list_add when enabling VMD in scalable mode

When enabling VMD and IOMMU scalable mode, the following kernel panic call trace/kernel log is shown in Eagle Stream platform (Sapphire Rapids CPU) during booting:

pci 0000:59:00.5: Adding to iommu group 42 ... vmd 0000:59:00.5: PCI host bridge to bus 10000:80 pci 10000:80:01.0: [8086:352a] type 01 class 0x060400 pci 10000:80:01.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] pci 10000:80:01.0: enabling Extended Tags pci 10000:80:01.0: PME# supported from D0 D3hot D3cold pci 10000:80:01.0: DMAR: Setup RID2PASID failed pci 10000:80:01.0: Failed to add to iommu group 42: -16 pci 10000:80:03.0: [8086:352b] type 01 class 0x060400 pci 10000:80:03.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] pci 10000:80:03.0: enabling Extended Tags pci 10000:80:03.0: PME# supported from D0 D3hot D3cold ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:29! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.17.0-rc3+ #7 Hardware name: Lenovo ThinkSystem SR650V3/SB27A86647, BIOS ESE101Y-1.00 01/13/2022 Workqueue: events work_for_cpu_fn RIP: 0010:__list_add_valid.cold+0x26/0x3f Code: 9a 4a ab ff 4c 89 c1 48 c7 c7 40 0c d9 9e e8 b9 b1 fe ff 0f 0b 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 f0 0c d9 9e e8 a2 b1 fe ff <0f> 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 98 0c d9 9e e8 8b b1 fe RSP: 0000:ff5ad434865b3a40 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ff4d61160b74b880 RCX: ff4d61255e1fffa8 RDX: 0000000000000000 RSI: 00000000fffeffff RDI: ffffffff9fd34f20 RBP: ff4d611d8e245c00 R08: 0000000000000000 R09: ff5ad434865b3888 R10: ff5ad434865b3880 R11: ff4d61257fdc6fe8 R12: ff4d61160b74b8a0 R13: ff4d61160b74b8a0 R14: ff4d611d8e245c10 R15: ff4d611d8001ba70 FS: 0000000000000000(0000) GS:ff4d611d5ea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ff4d611fa1401000 CR3: 0000000aa0210001 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> intel_pasid_alloc_table+0x9c/0x1d0 dmar_insert_one_dev_info+0x423/0x540 ? device_to_iommu+0x12d/0x2f0 intel_iommu_attach_device+0x116/0x290 __iommu_attach_device+0x1a/0x90 iommu_group_add_device+0x190/0x2c0 __iommu_probe_device+0x13e/0x250 iommu_probe_device+0x24/0x150 iommu_bus_notifier+0x69/0x90 blocking_notifier_call_chain+0x5a/0x80 device_add+0x3db/0x7b0 ? arch_memremap_can_ram_remap+0x19/0x50 ? memremap+0x75/0x140 pci_device_add+0x193/0x1d0 pci_scan_single_device+0xb9/0xf0 pci_scan_slot+0x4c/0x110 pci_scan_child_bus_extend+0x3a/0x290 vmd_enable_domain.constprop.0+0x63e/0x820 vmd_probe+0x163/0x190 local_pci_probe+0x42/0x80 work_for_cpu_fn+0x13/0x20 process_one_work+0x1e2/0x3b0 worker_thread+0x1c4/0x3a0 ? rescuer_thread+0x370/0x370 kthread+0xc7/0xf0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x1ca00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]---

The following 'lspci' output shows devices '10000:80:*' are subdevices of the VMD device 0000:59:00.5:

$ lspci ... 0000:59:00.5 RAID bus controller: Intel Corporation Volume Management Device NVMe RAID Controller (rev 20) ... 10000:80:01.0 PCI bridge: Intel Corporation Device 352a (rev 03) 10000:80:03.0 PCI bridge: Intel Corporation Device 352b (rev 03) 10000:80:05.0 PCI bridge: Intel Corporation Device 352c (rev 03) 10000:80:07.0 PCI bridge: Intel Corporation Device 352d (rev 03) 10000:81:00.0…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix double list_add when enabling VMD in scalable mode

When enabling VMD and IOMMU scalable mode, the following kernel panic call trace/kernel log is shown in Eagle Stream platform (Sapphire Rapids CPU) during booting:

pci 0000:59:00.5: Adding to iommu group 42 ... vmd 0000:59:00.5: PCI host bridge to bus 10000:80 pci 10000:80:01.0: [8086:352a] type 01 class 0x060400 pci 10000:80:01.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] pci 10000:80:01.0: enabling Extended Tags pci 10000:80:01.0: PME# supported from D0 D3hot D3cold pci 10000:80:01.0: DMAR: Setup RID2PASID failed pci 10000:80:01.0: Failed to add to iommu group 42: -16 pci 10000:80:03.0: [8086:352b] type 01 class 0x060400 pci 10000:80:03.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit] pci 10000:80:03.0: enabling Extended Tags pci 10000:80:03.0: PME# supported from D0 D3hot D3cold ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:29! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.17.0-rc3+ #7 Hardware name: Lenovo ThinkSystem SR650V3/SB27A86647, BIOS ESE101Y-1.00 01/13/2022 Workqueue: events work_for_cpu_fn RIP: 0010:__list_add_valid.cold+0x26/0x3f Code: 9a 4a ab ff 4c 89 c1 48 c7 c7 40 0c d9 9e e8 b9 b1 fe ff 0f 0b 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 f0 0c d9 9e e8 a2 b1 fe ff <0f> 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 98 0c d9 9e e8 8b b1 fe RSP: 0000:ff5ad434865b3a40 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ff4d61160b74b880 RCX: ff4d61255e1fffa8 RDX: 0000000000000000 RSI: 00000000fffeffff RDI: ffffffff9fd34f20 RBP: ff4d611d8e245c00 R08: 0000000000000000 R09: ff5ad434865b3888 R10: ff5ad434865b3880 R11: ff4d61257fdc6fe8 R12: ff4d61160b74b8a0 R13: ff4d61160b74b8a0 R14: ff4d611d8e245c10 R15: ff4d611d8001ba70 FS: 0000000000000000(0000) GS:ff4d611d5ea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ff4d611fa1401000 CR3: 0000000aa0210001 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> intel_pasid_alloc_table+0x9c/0x1d0 dmar_insert_one_dev_info+0x423/0x540 ? device_to_iommu+0x12d/0x2f0 intel_iommu_attach_device+0x116/0x290 __iommu_attach_device+0x1a/0x90 iommu_group_add_device+0x190/0x2c0 __iommu_probe_device+0x13e/0x250 iommu_probe_device+0x24/0x150 iommu_bus_notifier+0x69/0x90 blocking_notifier_call_chain+0x5a/0x80 device_add+0x3db/0x7b0 ? arch_memremap_can_ram_remap+0x19/0x50 ? memremap+0x75/0x140 pci_device_add+0x193/0x1d0 pci_scan_single_device+0xb9/0xf0 pci_scan_slot+0x4c/0x110 pci_scan_child_bus_extend+0x3a/0x290 vmd_enable_domain.constprop.0+0x63e/0x820 vmd_probe+0x163/0x190 local_pci_probe+0x42/0x80 work_for_cpu_fn+0x13/0x20 process_one_work+0x1e2/0x3b0 worker_thread+0x1c4/0x3a0 ? rescuer_thread+0x370/0x370 kthread+0xc7/0xf0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x1ca00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]---

The following 'lspci' output shows devices '10000:80:*' are subdevices of the VMD device 0000:59:00.5:

$ lspci ... 0000:59:00.5 RAID bus controller: Intel Corporation Volume Management Device NVMe RAID Controller (rev 20) ... 10000:80:01.0 PCI bridge: Intel Corporation Device 352a (rev 03) 10000:80:03.0 PCI bridge: Intel Corporation Device 352b (rev 03) 10000:80:05.0 PCI bridge: Intel Corporation Device 352c (rev 03) 10000:80:07.0 PCI bridge: Intel Corporation Device 352d (rev 03) 10000:81:00.0…

In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with it allowing any file to slip through. With the invarients broken, the d_name and parent accesses can now race against renames and removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go through a layer of indirection. Instead, let's check the superblock and dentry type.

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• drm/i915: Fix the GT fence revocation runtime PM logic {CVE-2022-0330}
• PM: runtime: Add pm_runtime_get_if_active() {CVE-2022-0330}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• bpf: In bpf_task_fd_query use fget_task {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}
• vfs, fdtable: Add fget_task helper {CVE-2021-4083}

• driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
• net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
• drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• tipc: guard against string buffer overrun {CVE-2024-49995}
• ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
• ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
• ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
• ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
• padata: Fix possible divide-by-0 panic in padata_mt_helper() {CVE-2024-43889}
• hwmon: (coretemp) Check for null before removing sysfs attrs {CVE-2022-49010}
• drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error {CVE-2024-47697}
• wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
• ipv6: avoid use-after-free in ip6_fragment() {CVE-2022-48956}
• netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
• drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
• slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
• drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
• tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
• ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
• ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
• mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
• firmware_loader: Block path traversal {CVE-2024-47742}
• ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
• tcp: drop the hash_32() part from the index calculation {CVE-2022-1012}
• tcp: increase source port perturb table to 2^16 {CVE-2022-1012}
• tcp: dynamically allocate the perturb table used by source ports {CVE-2022-1012}
• net: dccp: fix kernel crash on module load {CVE-2022-1012}
• net: dccp: initialize (addr,port) listening hashtable {CVE-2022-1012}
• tcp: add small random increments to the source port {CVE-2022-1012}
• tcp: resalt the secret every 10 seconds {CVE-2022-1012}
• tcp: use different parts of the port_offset for index and offset {CVE-2022-1012}
• secure_seq: use the 64 bits of the siphash for port offset calculation {CVE-2022-1012}
• Revert "[ELSCVE-6395] secure_seq: use the 64 bits of the siphash for port offset calculation" {CVE-2022-1012}
• tcp: add some entropy in __inet_hash_connect() {CVE-2022-1012}
• tcp: change source port randomizarion at connect() time {CVE-2022-1012}
• esp: limit skb_page_frag_refill use to a single page {CVE-2022-27666}
• drm/vmwgfx: Fix stale file descriptors on failed usercopy {CVE-2022-22942}
• PM-runtime: add tracepoints for usage_count changes {CVE-2022-0330}
• fget: clarify and improve __fget_files() implementation {CVE-2021-4083}
• proc/fd: In proc_fd_link use fget_task {CVE-2021-4083}
• kcmp: In kcmp_epoll_target use fget_task {CVE-2021-4083}
• file: Rename __fcheck_files to files_lookup_fd_raw {CVE-2021-4083}
• fget: check that the fd still exists after getting a ref to it {CVE-2021-4083}
• Revert "[ELSCVE-2732] fget: check that the fd still exists after getting a ref to it" {CVE-2021-4083}
• file: Replace fcheck_files with files_lookup_fd_rcu {CVE-2021-4083}
• file: Factor files_lookup_fd_locked out of fcheck_files {CVE-2021-4083}

• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue reshape after reassembling
• CVE-url: https://ubuntu.com/security/CVE-2024-43856
  • dma: fix call order in dmam_free_coherent
• CVE-url: https://ubuntu.com/security/CVE-2024-43884
  • Bluetooth: MGMT: Add error handling to pair_device()
• CVE-url: https://ubuntu.com/security/CVE-2024-42309
  • drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-50044
  • Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
• CVE-url: https://ubuntu.com/security/CVE-2024-49967
  • ext4: no need to continue when the number of entries is 1
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49015
  • net: hsr: Fix potential use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2024-50033
  • slip: make slhc_remember() more robust against malicious packets
• CVE-url: https://ubuntu.com/security/CVE-2024-47670
  • ocfs2: add bounds checking to ocfs2_xattr_find_entry()
• CVE-url: https://ubuntu.com/security/CVE-2024-49950
  • Bluetooth: L2CAP: Fix uaf in l2cap_connect
• CVE-url: https://ubuntu.com/security/CVE-2024-49883
  • ext4: aovid use-after-free in ext4_ext_insert_extent()
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-48960
  • net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-47745
  • mm: call the security_mmap_file() LSM hook in remap_file_pages()
• CVE-url: https://ubuntu.com/security/CVE-2024-49860
  • ACPI: sysfs: validate return type of _STR method
• CVE-url: https://ubuntu.com/security/CVE-2024-49882
  • ext4: fix double brelse() the buffer of the extents path
• CVE-url: https://ubuntu.com/security/CVE-2024-49995
  • tipc: guard against string buffer overrun
• CVE-url: https://ubuntu.com/security/CVE-2024-47723 -…

• CVE-url: https://ubuntu.com/security/CVE-2024-42265
  • protect the fetch of ->fd[fd] in do_dup2() from mispredictions
• CVE-url: https://ubuntu.com/security/CVE-2024-47669
  • nilfs2: fix state management in error path of log writing function
• CVE-url: https://ubuntu.com/security/CVE-2023-52918
  • media: pci: cx23885: check cx23885_vdev_init() return
• CVE-url: https://ubuntu.com/security/CVE-2024-46750
  • PCI: Add missing bridge lock to pci_bus_lock()
• CVE-url: https://ubuntu.com/security/CVE-2024-46676
  • nfc: pn533: Add poll mod list filling check
• CVE-url: https://ubuntu.com/security/CVE-2024-46755
  • wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
• CVE-url: https://ubuntu.com/security/CVE-2024-46721
  • apparmor: fix possible NULL pointer dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-44947
  • fuse: Initialize beyond-EOF page contents before setting uptodate
• CVE-url: https://ubuntu.com/security/CVE-2024-46675
  • usb: dwc3: core: Prevent USB core invalid event buffer address access
• CVE-url: https://ubuntu.com/security/CVE-2024-43893
  • serial: core: check uartclk for zero to avoid divide by zero
• CVE-url: https://ubuntu.com/security/CVE-2024-45021
  • memcg_write_event_control(): fix a user-triggerable oops
• CVE-url: https://ubuntu.com/security/CVE-2024-41012
  • filelock: Remove locks reliably when fcntl/close race is detected
• CVE-url: https://ubuntu.com/security/CVE-2024-42310
  • drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-42311
  • hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
• CVE-url: https://ubuntu.com/security/CVE-2024-45028
  • mmc: mmc_test: Fix NULL dereference on allocation failure
• CVE-url: https://ubuntu.com/security/CVE-2024-43914
  • md/raid5: avoid BUG_ON() while continue reshape after reassembling
• CVE-url: https://ubuntu.com/security/CVE-2024-43856
  • dma: fix call order in dmam_free_coherent
• CVE-url: https://ubuntu.com/security/CVE-2024-43884
  • Bluetooth: MGMT: Add error handling to pair_device()
• CVE-url: https://ubuntu.com/security/CVE-2024-42309
  • drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
• CVE-url: https://ubuntu.com/security/CVE-2024-50044
  • Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
• CVE-url: https://ubuntu.com/security/CVE-2024-49967
  • ext4: no need to continue when the number of entries is 1
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-49015
  • net: hsr: Fix potential use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2024-50033
  • slip: make slhc_remember() more robust against malicious packets
• CVE-url: https://ubuntu.com/security/CVE-2024-47670
  • ocfs2: add bounds checking to ocfs2_xattr_find_entry()
• CVE-url: https://ubuntu.com/security/CVE-2024-49950
  • Bluetooth: L2CAP: Fix uaf in l2cap_connect
• CVE-url: https://ubuntu.com/security/CVE-2024-49883
  • ext4: aovid use-after-free in ext4_ext_insert_extent()
• Bionic update: upstream stable patchset 2023-01-20 (LP: #2003596) // CVE- url: https://ubuntu.com/security/CVE-2022-48960
  • net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
• CVE-url: https://ubuntu.com/security/CVE-2024-47745
  • mm: call the security_mmap_file() LSM hook in remap_file_pages()
• CVE-url: https://ubuntu.com/security/CVE-2024-49860
  • ACPI: sysfs: validate return type of _STR method
• CVE-url: https://ubuntu.com/security/CVE-2024-49882
  • ext4: fix double brelse() the buffer of the extents path
• CVE-url: https://ubuntu.com/security/CVE-2024-49995
  • tipc: guard against string buffer overrun
• CVE-url: https://ubuntu.com/security/CVE-2024-47723 -…

• smb: client: fix use-after-free of signing key {CVE-2024-53179}
• smb: client: stop flooding dmesg in smb2_calc_signature() {CVE-2024-53179}
• smb3: fix oops in calculating shash_setkey {CVE-2024-53179}
• cifs: return correct error in ->calc_signature() {CVE-2024-53179}
• cifs: secmech: use shash_desc directly, remove sdesc {CVE-2024-53179}
• cifs: replace kfree() with kfree_sensitive() for sensitive data {CVE-2024-53179}
• xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
• hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
• scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
• EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
• acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl {CVE-2024-56662}
• net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
• initramfs: avoid filename buffer overrun {CVE-2024-53142}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
• wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
• Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
• Bluetooth: msft: fix slab-use-after-free in msft_do_close() {CVE-2024-36012}
• Bluetooth: Fix support for Read Local Supported Codecs V2 {CVE-2024-36012}
• Bluetooth: hci_codec: Fix leaking content of local_codecs {CVE-2024-36012}
• blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
• net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
• net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
• NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
• net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
• drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 {CVE-2023-52818}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
• drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
• netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
• HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit {CVE-2023-52519}
• tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-56642}
• cifs: Fix buffer overflow when parsing NFS reparse points {CVE-2024-49996}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614}
• PM / devfreq: Rework freq_table to be local to devfreq struct {CVE-2023-52614}
• cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() {CVE-2024-41057}
• cachefiles: fix slab-use-after-free in fscache_withdraw_volume() {CVE-2024-41058}
• [ELSCVE-37480] netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() {CVE-2024-41058}
• memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
• Bluetooth: ISO: Fix UAF on iso_sock_timeout {CVE-2024-50124}
• Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125}
• Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout {CVE-2024-50125}
• Bluetooth: Consolidate code around sk_alloc into a helper function {CVE-2024-50125}
• smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
• gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() {CVE-2024-26754}
• smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
• smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-35868}
• vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
• net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
• wifi:…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070 git-fix prerequisity).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-fixes).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46809: drm/amd/display: Check BIOS images before it is used (bsc#1231148).
• CVE-2024-46811: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box (bsc#1231179).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
• CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (bsc#1231094).
• CVE-2024-46848: perf/x86/intel: Limit the period on Haswell (bsc#1231072).
• CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
• CVE-2024-47660: fsnotify: clear…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
• CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
• CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
• CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
• CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
• CVE-2024-46809: drm/amd/display: Check BIOS images before it is used (bsc#1231148).
• CVE-2024-46811: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box (bsc#1231179).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
• CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
• CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
• CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables (bsc#1231096).
• CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
• CVE-2024-46841: btrfs: do not…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
• CVE-2022-48988: memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1232069).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49003: nvme: fix SRCU protection of nvme_ns_head list (bsc#1232136).
• CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49023: wifi: cfg80211: fix buffer overflow in elem comparison (bsc#1231961).
• CVE-2022-49025: net/mlx5e: Fix use-after-free when reverting termination table (bsc#1231960).
• CVE-2024-36971: Fixed __dst_negative_advice() race (bsc#1226145).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
• CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
• CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
• CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
• CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
• CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
• CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
• CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
• CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

• kernel-binary: generate and install compile_commands.json (bsc#1228971)
• kernel-binary: vdso: Own module_dir
• bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
• mkspec-dtb: add toplevel symlinks also on arm
• net: mana: Fix the extra HZ in mana_hwc_send_request (bsc#1232033).
• scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
• CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
• CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
• CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
• CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174).
• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
• CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats (bsc#1232260).
• CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
• CVE-2024-49960: ext4: fix timer use-after-free on failed mount (bsc#1232395).
• CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
• CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
• CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
• CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
• CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

• NFSv3: only use NFS timeout for MOUNT when protocols are compatible (bsc#1231016).
• PKCS#7: Check codeSigning EKU of certificates in PKCS#7 (bsc#1226666).
• RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (bsc#1232036).
• bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
• dn_route: set rt neigh to blackhole_netdev instead of loopback_dev in ifdown (bsc#1216813).
• ipv6: blackhole_netdev needs snmp6 counters (bsc#1216813).
• ipv6: give an IPv6 dev to blackhole_netdev (bsc#1216813).
• net: mana: Fix the extra HZ in mana_hwc_send_request (bsc#1232033).
• xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (bsc#1216813).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The Linux Enterprise 12 SP5 kernel turned LTSS (Extended Security)

The following security bugs were fixed:

• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47163: kABI fix for tipc: wait and exit until all work queues are done (bsc#1221980).
• CVE-2021-47612: nfc: fix segfault in nfc_genl_dump_devices_done (bsc#1226585).
• CVE-2022-48809: net: fix a memleak when uncloning an skb dst and its metadata (bsc#1227947).
• CVE-2022-48951: ASoC: ops: Correct bounds check for second channel on SX controls (bsc#1231929).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
• CVE-2022-48971: Bluetooth: Fix not cleanup led when bt_init fails (bsc#1232037).
• CVE-2022-48972: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (bsc#1232025).
• CVE-2022-48973: gpio: amd8111: Fix PCI device reference count leak (bsc#1232039).
• CVE-2022-48978: HID: core: fix shift-out-of-bounds in hid_report_raw_event (bsc#1232038).
• CVE-2022-48991: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (bsc#1232070).
• CVE-2022-48992: ASoC: soc-pcm: Add NULL check in BE reparenting (bsc#1232071).
• CVE-2022-49000: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() (bsc#1232123).
• CVE-2022-49002: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (bsc#1232133).
• CVE-2022-49010: hwmon: (coretemp) Check for null before removing sysfs attrs (bsc#1232172).
• CVE-2022-49011: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (bsc#1232006).
• CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2022-49021: net: phy: fix null-ptr-deref while probe() failed (bsc#1231939).
• CVE-2022-49026: e100: Fix possible use after free in e100_xmit_prepare (bsc#1231997).
• CVE-2022-49027: iavf: Fix error handling in iavf_init_module() (bsc#1232007).
• CVE-2022-49028: ixgbevf: Fix resource leak in ixgbevf_init_module() (bsc#1231996).
• CVE-2022-49029: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (bsc#1231995).
• CVE-2023-52898: xhci: Fix null pointer dereference when host dies (bsc#1229568).
• CVE-2023-52918: media: pci: cx23885: check cx23885_vdev_init() return (bsc#1232047).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42114: netlink: extend policy range validation (bsc#1228564 prerequisite).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-fixes).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-46724: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (bsc#1230725).
• CVE-2024-46755: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (bsc#1230802). -…

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47589: igbvf: fix double free in igbvf_probe (bsc#1226557).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
• CVE-2022-48988: memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1206344 bsc#1232069).
• CVE-2022-48991: khugepaged: retract_page_tables() remember to test exit (bsc#1232070).
• CVE-2022-49003: nvme: fix SRCU protection of nvme_ns_head list (bsc#1232136).
• CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49023: wifi: cfg80211: fix buffer overflow in elem comparison (bsc#1231961).
• CVE-2022-49025: net/mlx5e: Fix use-after-free when reverting termination table (bsc#1231960).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
• CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
• CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
• CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
• CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
• CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
• CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

• initrd: Revert 'build initrd without systemd' (bsc#1195775).
• bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
• kernel-binary.spec.in: Enable klp_symbols on openSUSE Tumbleweed (boo#1229042).
• kernel-binary: generate and install compile_commands.json (bsc#1228971).
• net: mana: Fix the extra HZ in mana_hwc_send_request (bsc#1232033).
• rpm/check-for-config-changes: Exclude ARCH_USING_PATCHABLE_FUNCTION_ENTRY gcc version dependent, at least on ppc
• rpm/check-for-config-changes: add HAVE_RUST and RUSTC_SUPPORTS_ to IGNORED_CONFIGS_RE They depend on SHADOW_CALL_STACK.
• rpm/kernel-binary.spec.in: Fix build regression The previous fix forgot to take over grep -c option that broke the conditional expression.
• rpm/kernel-binary.spec.in: fix klp_symbols macro The commit below removed openSUSE filter from %ifs of the klp_symbols definition (boo#1229042).
• rpm/kernel-obs-build.spec.in: Some builds do not just create an iso9660 image, but also mount it during build (bsc#1226212).
• rpm/kernel-obs-build.spec.in: Add networking modules for docker (bsc#1226211).
• rpm/release-projects: Add SLFO projects (bsc#1231293).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
• CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
• CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
• CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
• CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (bsc#1230715).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
• CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
• CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
• CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174).
• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
• CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats (bsc#1232260).
• CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
• CVE-2024-49960: ext4: fix timer use-after-free on failed mount (bsc#1232395).
• CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
• CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
• CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
• CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
• CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

• NFSv3: only use NFS timeout for MOUNT when protocols are compatible (bsc#1231016).
• PKCS#7: Check codeSigning EKU of certificates in PKCS#7 (bsc#1226666).
• RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (bsc#1232036).
• bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
• dn_route: set rt neigh to blackhole_netdev instead of loopback_dev in…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47589: igbvf: fix double free in igbvf_probe (bsc#1226557).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
• CVE-2022-48988: memcg: Fix possible use-after-free in memcg_write_event_control() (bsc#1232069).
• CVE-2022-48991: khugepaged: retract_page_tables() remember to test exit (bsc#1232070 prerequisity).
• CVE-2022-49003: nvme: fix SRCU protection of nvme_ns_head list (bsc#1232136).
• CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49023: wifi: cfg80211: fix buffer overflow in elem comparison (bsc#1231961).
• CVE-2022-49025: net/mlx5e: Fix use-after-free when reverting termination table (bsc#1231960).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
• CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
• CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
• CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (bsc#1231197).
• CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (bsc#1231200).
• CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
• CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
• CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
• CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (bsc#1232145).
• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
• CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
• CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
• CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
• CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
• CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
• CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).

The following non-security bugs were fixed:

• bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (bsc#1231375).
• kernel-binary: generate and install compile_commands.json (bsc#1228971)
• kernel-binary: vdso: Own module_dir
• mkspec-dtb: add toplevel symlinks also on arm
• net: mana: Fix the extra HZ in mana_hwc_send_request (bsc#1232033).
• scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47594: mptcp: never allow the PM to close a listener subflow (bsc#1226560).
• CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() (bsc#1231973).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() (bsc#1232233).
• CVE-2022-48983: io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() (bsc#1231959).
• CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
• CVE-2024-26906: Fixed invalid vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).
• CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
• CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
• CVE-2024-35937: wifi: cfg80211: check A-MSDU format more carefully (bsc#1224526).
• CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too (bsc#1226797).
• CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
• CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
• CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
• CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
• CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
• CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
• CVE-2024-38615: cpufreq: exit() callback is optional (bsc#1226592).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-40997: cpufreq: amd-pstate: fix memory leak on CPU EPP exit (bsc#1227853).
• CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
• CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB (bsc#1228709).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
• CVE-2024-44932: idpf: fix UAFs when destroying the queues (bsc#1229808).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-44964: idpf: fix memory leaks and crashes while performing a soft reset (bsc#1230220).
• CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
• CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
• CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
• CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
• CVE-2024-46716: dmaengine: altera-msgdma:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The Linux Enterprise 12 SP5 kernel turned LTSS (Extended Security)

The following security bugs were fixed:

• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47163: kABI fix for tipc: wait and exit until all work queues are done (bsc#1221980).
• CVE-2021-47612: nfc: fix segfault in nfc_genl_dump_devices_done (bsc#1226585).
• CVE-2022-48809: net: fix a memleak when uncloning an skb dst and its metadata (bsc#1227947).
• CVE-2022-48951: ASoC: ops: Correct bounds check for second channel on SX controls (bsc#1231929).
• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
• CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
• CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
• CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
• CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
• CVE-2022-48967: NFC: nci: Bounds check struct nfc_target arrays (bsc#1232304).
• CVE-2022-48971: Bluetooth: Fix not cleanup led when bt_init fails (bsc#1232037).
• CVE-2022-48972: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (bsc#1232025).
• CVE-2022-48973: gpio: amd8111: Fix PCI device reference count leak (bsc#1232039).
• CVE-2022-48978: HID: core: fix shift-out-of-bounds in hid_report_raw_event (bsc#1232038).
• CVE-2022-48991: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (bsc#1232070).
• CVE-2022-48992: ASoC: soc-pcm: Add NULL check in BE reparenting (bsc#1232071).
• CVE-2022-49000: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() (bsc#1232123).
• CVE-2022-49002: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (bsc#1232133).
• CVE-2022-49010: hwmon: (coretemp) Check for null before removing sysfs attrs (bsc#1232172).
• CVE-2022-49011: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (bsc#1232006).
• CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1231890).
• CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
• CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
• CVE-2022-49021: net: phy: fix null-ptr-deref while probe() failed (bsc#1231939).
• CVE-2022-49026: e100: Fix possible use after free in e100_xmit_prepare (bsc#1231997).
• CVE-2022-49027: iavf: Fix error handling in iavf_init_module() (bsc#1232007).
• CVE-2022-49028: ixgbevf: Fix resource leak in ixgbevf_init_module() (bsc#1231996).
• CVE-2022-49029: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (bsc#1231995).
• CVE-2023-52898: xhci: Fix null pointer dereference when host dies (bsc#1229568).
• CVE-2023-52918: media: pci: cx23885: check cx23885_vdev_init() return (bsc#1232047).
• CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).
• CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).
• CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (bsc#1227437).
• CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
• CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620).
• CVE-2024-42114: netlink: extend policy range validation (bsc#1228564 prerequisite).
• CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
• CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-fixes).
• CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
• CVE-2024-46724: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (bsc#1230725).
• CVE-2024-46755: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (bsc#1230802). -…