CVE-2023-52509

In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop().

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

media: dvbdev: Fix memory leak in dvb_media_device_free()

dvb_media_device_free() is leaking memory. Free dvbdev->adapter->conn before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required."(CVE-2020-36777)

In the Linux kernel, the following vulnerability has been resolved:

i2c: sprd: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in sprd_i2c_master_xfer() and sprd_i2c_remove().

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36780)

In the Linux kernel, the following vulnerability has been resolved:

i2c: cadence: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave.

However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36784)

In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix null-ptr-deref during tty device unregistration

Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call.(CVE-2021-46904)

In the Linux kernel, the following vulnerability has been resolved:

NFC: st21nfca: Fix memory leak in device probe and remove

'phy->pending_skb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows:

unreferenced object 0xffff88800bc06800 (size 512): comm "8", pid 11775, jiffies 4295159829 (age 9.032s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000d66c09ce>] __kmalloc_node_track_caller+0x1ed/0x450 [<00000000c93382b3>] kmalloc_reserve+0x37/0xd0 [<000000005fea522c>] __alloc_skb+0x124/0x380 [<0000000019f29f9a>] st21nfca_hci_i2c_probe+0x170/0x8f2

Fix it by freeing 'pending_skb' in error and remove.(CVE-2021-46924)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: intel-sdw-acpi: harden detection of controller

The existing code currently sets a pointer to an ACPI handle before checking that it's actually a SoundWire controller. This can lead to issues where the graph walk continues and eventually fails, but the pointer was set already.

This patch changes the logic so that the information provided to the caller is set when a controller is found.(CVE-2021-46926)

In the Linux kernel, the following vulnerability has been resolved:

parisc: Clear stale IIR value on instruction access rights…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

media: dvbdev: Fix memory leak in dvb_media_device_free()

dvb_media_device_free() is leaking memory. Free dvbdev->adapter->conn before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required."(CVE-2020-36777)

In the Linux kernel, the following vulnerability has been resolved:

i2c: sprd: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in sprd_i2c_master_xfer() and sprd_i2c_remove().

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36780)

In the Linux kernel, the following vulnerability has been resolved:

i2c: cadence: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave.

However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36784)

In the Linux kernel, the following vulnerability has been resolved:

net: hso: fix null-ptr-deref during tty device unregistration

Multiple ttys try to claim the same the minor number causing a double unregistration of the same device. The first unregistration succeeds but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number but doesn't assign it immediately. The assignment is done by the caller later. But before this assignment, calls to get_free_serial_index() would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number immediately after one is found to be and rename it to obtain_minor() to better reflect what it does. Similary, rename set_serial_by_index() to release_minor() and modify it to free up the minor number of the given hso_serial. Every obtain_minor() should have corresponding release_minor() call.(CVE-2021-46904)

In the Linux kernel, the following vulnerability has been resolved:

NFC: st21nfca: Fix memory leak in device probe and remove

'phy->pending_skb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows:

unreferenced object 0xffff88800bc06800 (size 512): comm "8", pid 11775, jiffies 4295159829 (age 9.032s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000d66c09ce>] __kmalloc_node_track_caller+0x1ed/0x450 [<00000000c93382b3>] kmalloc_reserve+0x37/0xd0 [<000000005fea522c>] __alloc_skb+0x124/0x380 [<0000000019f29f9a>] st21nfca_hci_i2c_probe+0x170/0x8f2

Fix it by freeing 'pending_skb' in error and remove.(CVE-2021-46924)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: intel-sdw-acpi: harden detection of controller

The existing code currently sets a pointer to an ACPI handle before checking that it's actually a SoundWire controller. This can lead to issues where the graph walk continues and eventually fails, but the pointer was set already.

This patch changes the logic so that the information provided to the caller is set when a controller is found.(CVE-2021-46926)

In the Linux kernel, the following vulnerability has been resolved:

parisc: Clear stale IIR value on instruction access rights…

In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop().

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
• CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
• CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445).
• CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
• CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function __dma_async_device_channel_register() (bsc#1221276).
• CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
• CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine (bsc#1221553).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
• CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
• CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
• CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
• CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
• CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
• CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445).
• CVE-2023-52513: Fixed connection failure handling in RDMA/siw (bsc#1221022).
• CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
• CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
• CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
• CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
• CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
• CVE-2023-52567: Fixed possible Oops in serial/8250_port: when using IRQ polling (irq = 0) (bsc#1220839).
• CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i (bsc#1221055).
• CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
• CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
• CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine (bsc#1221553).
• CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47102: Fixed…

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-36780: Fixed a reference leak when pm_runtime_get_sync fails in i2c (bsc#1220556).
• CVE-2020-36782: Fixed a reference leak when pm_runtime_get_sync fails in i2c imx-lpi2c (bsc#1220560).
• CVE-2020-36783: Fixed a reference leak when pm_runtime_get_sync fails in i2c img-scb (bsc#1220561).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46930: Fixed a list_head check warning caused by uninitialization of list_head in usb mtu3 (bsc#1220484).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46943: Fixed an oops in set_fmt error handling in media: staging/intel-ipu3 (bsc#1220583).
• CVE-2021-46944: Fixed a memory leak in imu_fmt in media staging/intel-ipu3 (bsc#1220566).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46951: Fixed an integer underflow of efi_tpm_final_log_size in tpm_read_log_efi in tpm efi (bsc#1220615).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46961: Fixed an error on not enabling irqs when handling spurious interrups in irqchip/gic-v3 (bsc#1220529).
• CVE-2021-46962: Fixed a resource leak in the remove function in mmc uniphier-sd (bsc#1220532).
• CVE-2021-46963: Fixed a denial of service in qla2xxx_mqueuecommand() in scsi qla2xxx (bsc#1220536)
• CVE-2021-46971: Fixed unconditional security_locked_down() call in perf/core (bsc#1220697).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46984: Fixed an out of bounds access in kyber_bio_merge() in kyber (bsc#1220631).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON in userfaultfd (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47000: Fixed an inode leak on getattr error in __fh_to_dentry in ceph (bsc#1220669).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47020: Fixed a memory leak in stream config error path in soundwire stream (bsc#1220785).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47051: Fixed a PM reference leak in lpspi_prepare_xfer_hardware() in spi fsl-lpspi (bsc#1220764).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47058: Fixed a possible user-after-free in set debugfs_name in regmap (bsc#1220779).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-36780: Fixed a reference leak when pm_runtime_get_sync fails in i2c (bsc#1220556).
• CVE-2020-36781: Fixed reference leak when pm_runtime_get_sync fails in i2c/imx (bsc#1220557).
• CVE-2020-36782: Fixed a reference leak when pm_runtime_get_sync fails in i2c imx-lpi2c (bsc#1220560).
• CVE-2020-36783: Fixed a reference leak when pm_runtime_get_sync fails in i2c img-scb (bsc#1220561).
• CVE-2021-46908: Fixed incorrect permission flag for mixed signed bounds arithmetic in bpf (bsc#1220425).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46911: Fixed kernel panic (bsc#1220400).
• CVE-2021-46914: Fixed unbalanced device enable/disable in suspend/resume in pci_disable_device() (bsc#1220465).
• CVE-2021-46917: Fixed wq cleanup of WQCFG registers in idxd (bsc#1220432).
• CVE-2021-46918: Fixed not clearing MSIX permission entry on shutdown in idxd (bsc#1220429).
• CVE-2021-46919: Fixed wq size store permission state in idxd (bsc#1220414).
• CVE-2021-46920: Fixed clobbering of SWERR overflow bit on writeback (bsc#1220426).
• CVE-2021-46921: Fixed ordering in queued_write_lock_slowpath (bsc#1220468).
• CVE-2021-46922: Fixed TPM reservation for seal/unseal (bsc#1220475).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46943: Fixed an oops in set_fmt error handling in media: staging/intel-ipu3 (bsc#1220583).
• CVE-2021-46944: Fixed a memory leak in imu_fmt in media staging/intel-ipu3 (bsc#1220566).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46951: Fixed an integer underflow of efi_tpm_final_log_size in tpm_read_log_efi in tpm efi (bsc#1220615).
• CVE-2021-46956: Fixed memory leak in virtio_fs_probe() (bsc#1220516).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46959: Fixed use-after-free with devm_spi_alloc_* (bsc#1220734).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46961: Fixed spurious interrup handling (bsc#1220529).
• CVE-2021-46962: Fixed a resource leak in the remove function in mmc uniphier-sd (bsc#1220532).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46971: Fixed unconditional security_locked_down() call (bsc#1220697).
• CVE-2021-46976: Fixed crash in auto_retire in drm/i915 (bsc#1220621).
• CVE-2021-46980: Fixed not retrieving all the PDOs instead of just the first 4 in usb/typec/ucsi (bsc#1220663).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46983: Fixed NULL pointer dereference when SEND is completed with error (bsc#1220639).
• CVE-2021-46984: Fixed an out of bounds access in kyber_bio_merge() in kyber (bsc#1220631).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46991: Fixed a use-after-free in i40e_client_subtask (bsc#1220575).
• CVE-2021-46992: Fixed a bug to avoid overflows in nft_hash_buckets (bsc#1220638).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47000: Fixed an inode leak on getattr error in __fh_to_dentry in ceph (bsc#1220669).
• CVE-2021-47001: Fixed cwnd update ordering in xprtrdma (bsc#1220670).
• CVE-2021-47003: Fixed…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

NOTE: This update has been retracted due to a bug in the BHI CPU sidechannel mitigation, which led to incorrect selection of other CPU mitigations.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register…

The SUSE Linux Enterprise 15 SP3 LTSS kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2020-36781: Fixed reference leak when pm_runtime_get_sync fails in i2c/imx (bsc#1220557).
• CVE-2021-46911: Fixed kernel panic (bsc#1220400).
• CVE-2021-46914: Fixed unbalanced device enable/disable in suspend/resume in pci_disable_device() (bsc#1220465).
• CVE-2021-46917: Fixed wq cleanup of WQCFG registers in idxd (bsc#1220432).
• CVE-2021-46918: Fixed not clearing MSIX permission entry on shutdown in idxd (bsc#1220429).
• CVE-2021-46919: Fixed wq size store permission state in idxd (bsc#1220414).
• CVE-2021-46920: Fixed clobbering of SWERR overflow bit on writeback (bsc#1220426).
• CVE-2021-46922: Fixed TPM reservation for seal/unseal (bsc#1220475).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46956: Fixed memory leak in virtio_fs_probe() (bsc#1220516).
• CVE-2021-46959: Fixed use-after-free with devm_spi_alloc_* (bsc#1220734).
• CVE-2021-46961: Fixed spurious interrup handling (bsc#1220529).
• CVE-2021-46971: Fixed unconditional security_locked_down() call (bsc#1220697).
• CVE-2021-46976: Fixed crash in auto_retire in drm/i915 (bsc#1220621).
• CVE-2021-46980: Fixed not retrieving all the PDOs instead of just the first 4 in usb/typec/ucsi (bsc#1220663).
• CVE-2021-46983: Fixed NULL pointer dereference when SEND is completed with error (bsc#1220639).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-47001: Fixed cwnd update ordering in xprtrdma (bsc#1220670).
• CVE-2021-47003: Fixed potential null dereference on pointer status in idxd_cmd_exec (bsc#1220677).
• CVE-2021-47009: Fixed memory leak on object td (bsc#1220733).
• CVE-2021-47014: Fixed wild memory access when clearing fragments in net/sched/act_ct (bsc#1220630).
• CVE-2021-47017: Fixed use after free in ath10k_htc_send_bundle (bsc#1220678).
• CVE-2021-47026: Fixed not destroying sysfs after removing session from active list (bsc#1220685).
• CVE-2021-47035: Fixed wrong WO permissions on second-level paging entries in iommu/vt-d (bsc#1220688).
• CVE-2021-47038: Fixed deadlock between hci_dev->lock and socket lock in bluetooth (bsc#1220753).
• CVE-2021-47044: Fixed shift-out-of-bounds in load_balance() in sched/fair (bsc#1220759).
• CVE-2021-47046: Fixed off by one in hdmi_14_process_transaction() (bsc#1220758).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47109: Fixed NUD_NOARP entries to be forced GCed (bsc#1221534).
• CVE-2021-47130: Fixed freeing unallocated p2pmem in nvmet (bsc#1221552).
• CVE-2021-47137: Fixed memory corruption in RX ring in net/lantiq (bsc#1221932).
• CVE-2021-47150: Fixed the potential memory leak in fec_enet_init() (bsc#1221973).
• CVE-2021-47160: Fixed VLAN traffic leaks in dsa: mt7530 (bsc#1221974).
• CVE-2021-47164: Fixed null pointer dereference accessing lag dev in net/mlx5e (bsc#1221978).
• CVE-2021-47174: Fixed missing check in irq_fpu_usable() (bsc#1221990).
• CVE-2021-47175: Fixed OOB access in net/sched/fq_pie (bsc#1222003).
• CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource() (bsc#1222660).
• CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).
• CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
• CVE-2021-47189: Fixed denial of service due to memory…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource() (bsc#1222660).
• CVE-2021-47182: Fixed buffer length handling in scsi_mode_sense() in scsi core (bsc#1222662).
• CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).
• CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
• CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47113: Abort…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47114: Fixed a data corruption by fallocate in ocfs2 (bsc#1221548).
• CVE-2021-47117: Fixed a crash in ext4_es_cache_extent as ext4_split_extent_at failed in ext4 (bsc#1221575).
• CVE-2021-47118: Fixed an use-after-free in init task's struct pid in pid (bsc#1221605).
• CVE-2021-47119: Fixed a memory leak in ext4_fill_super in ext4 (bsc#1221608). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed double free of blk_mq_tag_set in dev remove after table load fails (bsc#1220554).
• CVE-2021-46939: Fixed possible hung in trace_clock_global() (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed possible data corruption in md/raid1 when ending a failed write request (bsc#1220662).
• CVE-2021-46958: Fixed race between transaction aborts and fsyncs that could lead to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed wrong error code from smb2_get_enc_key() (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed NULL pointer in flush_workqueue (bsc#1220611).
• CVE-2021-46988: Fixed possible crash in userfaultfd due to unreleased page (bsc#1220706).
• CVE-2021-46990: Fixed crashes when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed a use after free bug in enic_hard_start_xmit() (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed RX consumer index logic in the error path in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed resolved pte update for kernel memory on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed null pointer dereference in lpfc_prep_els_iocb() (bsc#1220640).
• CVE-2021-47049: Fixed Use after free in __vmbus_open() (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed uninitialized lock in adf_vf2pf_shutdown() (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed possible use-after-free in panel_bridge_detach() (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47114: Fixed data corruption by fallocate in ocfs2 (bsc#1221548).
• CVE-2021-47117: Fixed bug on in ext4_es_cache_extent() as ext4_split_extent_at() failed (bsc#1221575).
• CVE-2021-47118: Fixed possible use-after-free when initializing cad_pid (bsc#1221605). -…

Andy Nguyen discovered that the Bluetooth L2CAP implementation in the Linux kernel contained a type-confusion error. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-12351)

Andy Nguyen discovered that the Bluetooth A2MP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate remote attacker could use this to expose sensitive information (kernel memory). (CVE-2020-12352)

Andy Nguyen discovered that the Bluetooth HCI event packet parser in the Linux kernel did not properly handle event advertisements of certain sizes, leading to a heap-based buffer overflow. A physically proximate remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-24490)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• I2C subsystem;
• Network drivers;
• Pin controllers subsystem;
• TTY drivers;
• USB Mass Storage drivers;
• Framebuffer layer;
• Ext4 file system;
• File systems infrastructure;
• Bluetooth subsystem;
• Kernel init infrastructure;
• DMA mapping infrastructure;
• Memory management;
• 9P file system network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netfilter;
• NFC subsystem;
• Phonet protocol;
• Network traffic control;
• Wireless networking; (CVE-2024-44947, CVE-2023-52594, CVE-2024-35886, CVE-2024-38633, CVE-2023-52509, CVE-2024-26625, CVE-2024-36946, CVE-2024-45021, CVE-2024-36270, CVE-2021-47118, CVE-2024-43884, CVE-2024-36941, CVE-2024-38619, CVE-2021-47501, CVE-2024-49967, CVE-2024-42090, CVE-2024-40912, CVE-2024-36968, CVE-2024-53057, CVE-2023-52507, CVE-2024-42101, CVE-2021-47086, CVE-2024-42153, CVE-2024-40959, CVE-2024-26777, CVE-2024-44944, CVE-2024-43856, CVE-2024-39301)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• I2C subsystem;
• Network drivers;
• Pin controllers subsystem;
• TTY drivers;
• USB Mass Storage drivers;
• Framebuffer layer;
• Ext4 file system;
• File systems infrastructure;
• Bluetooth subsystem;
• Kernel init infrastructure;
• DMA mapping infrastructure;
• Memory management;
• 9P file system network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netfilter;
• NFC subsystem;
• Phonet protocol;
• Network traffic control;
• Wireless networking; (CVE-2024-44944, CVE-2023-52507, CVE-2024-42101, CVE-2021-47118, CVE-2024-36941, CVE-2024-38633, CVE-2021-47086, CVE-2024-26625, CVE-2024-39301, CVE-2024-42090, CVE-2024-53057, CVE-2024-26777, CVE-2024-36946, CVE-2024-42153, CVE-2024-40912, CVE-2024-36968, CVE-2024-43856, CVE-2024-49967, CVE-2024-43884, CVE-2023-52509, CVE-2023-52594, CVE-2024-36270, CVE-2024-44947, CVE-2024-45021, CVE-2024-35886, CVE-2024-40959, CVE-2021-47501, CVE-2024-38619)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• I2C subsystem;
• InfiniBand drivers;
• IRQ chip drivers;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• TTY drivers;
• USB Host Controller drivers;
• USB Mass Storage drivers;
• Framebuffer layer;
• Ext4 file system;
• File systems infrastructure;
• Bluetooth subsystem;
• DMA mapping infrastructure;
• Memory management;
• 9P file system network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netfilter;
• NFC subsystem;
• Phonet protocol;
• Network traffic control;
• VMware vSockets driver;
• Wireless networking; (CVE-2024-42090, CVE-2024-42156, CVE-2021-47082, CVE-2024-26921, CVE-2023-52594, CVE-2024-36968, CVE-2024-38633, CVE-2024-42077, CVE-2021-47076, CVE-2021-47501, CVE-2023-52507, CVE-2024-42153, CVE-2024-39301, CVE-2024-36946, CVE-2024-43884, CVE-2023-52509, CVE-2024-36004, CVE-2023-52486, CVE-2024-50264, CVE-2024-45006, CVE-2024-36941, CVE-2024-43856, CVE-2024-40912, CVE-2024-49967, CVE-2024-53057, CVE-2024-26777, CVE-2024-36270, CVE-2024-26625, CVE-2024-45021, CVE-2024-35886, CVE-2024-44947, CVE-2024-44944, CVE-2024-35847, CVE-2024-40959, CVE-2024-42101, CVE-2024-38619)

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36402)

Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• GPU drivers;
• I2C subsystem;
• InfiniBand drivers;
• IRQ chip drivers;
• Network drivers;
• Pin controllers subsystem;
• S/390 drivers;
• TTY drivers;
• USB Host Controller drivers;
• USB Mass Storage drivers;
• Framebuffer layer;
• Ext4 file system;
• File systems infrastructure;
• Bluetooth subsystem;
• DMA mapping infrastructure;
• Memory management;
• 9P file system network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netfilter;
• NFC subsystem;
• Phonet protocol;
• Network traffic control;
• VMware vSockets driver;
• Wireless networking; (CVE-2024-42090, CVE-2024-42156, CVE-2021-47082, CVE-2024-26921, CVE-2023-52594, CVE-2024-36968, CVE-2024-38633, CVE-2024-42077, CVE-2021-47076, CVE-2021-47501, CVE-2023-52507, CVE-2024-42153, CVE-2024-39301, CVE-2024-36946, CVE-2024-43884, CVE-2023-52509, CVE-2024-36004, CVE-2023-52486, CVE-2024-50264, CVE-2024-45006, CVE-2024-36941, CVE-2024-43856, CVE-2024-40912, CVE-2024-49967, CVE-2024-53057, CVE-2024-26777, CVE-2024-36270, CVE-2024-26625, CVE-2024-45021, CVE-2024-35886, CVE-2024-44947, CVE-2024-44944, CVE-2024-35847, CVE-2024-40959, CVE-2024-42101, CVE-2024-38619)