CVE-2023-52520

In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix reference leak If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned which needs to be disposed accordingly using kobject_put(). Move the setting name validation into a separate function to allow for this change without having to duplicate the cleanup code for this setting. As a side note, a very similar bug was fixed in commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"), so it seems that the bug was copied from that driver. Compile-tested only.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)
• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)
• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)
• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)
• kernel: use after free in i2c (CVE-2019-25162)
• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)
• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)
• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)
• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)
• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)
• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)
• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)
• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)
• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)
• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)
• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)
• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)
• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)
• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)
• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)
• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)
• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)
• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)
• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)
• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)
• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)
• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)
• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)
• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)
• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)
• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)
• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)
• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)
• kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)
• kernel: net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)
• kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() (CVE-2022-48669)
• kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
• kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (CVE-2023-52594)
• kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)
• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)
• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)
• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)
• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)
• kernel: use after free in i2c (CVE-2019-25162)
• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)
• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)
• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)
• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)
• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)
• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)
• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)
• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)
• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)
• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)
• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)
• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)
• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)
• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)
• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)
• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)
• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)
• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)
• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)
• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)
• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)
• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)
• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)
• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)
• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)
• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)
• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)
• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)
• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)
• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest AlmaLinux-8.10.z kernel (JIRA:AlmaLinux-34640)
• kernel-rt: epoll_wait not reporting catching all events to application (JIRA:AlmaLinux-23022)

• af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
• netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
• libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
• bpf: Fix partial dynptr stack slot reads/writes {CVE-2023-39191}
• ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
• ima: define ima_max_digest_data struct without a flexible array variable
• ima: detect changes to the backing overlay file
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
• tty: n_gsm: fix restart handling via CLD command
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
• netfilter: tproxy: bail out if IP has been disabled on the device {CVE-2024-36270}
• tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
• Bluetooth: Fix double free in hci_conn_cleanup {CVE-2023-28464}
• fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841}
• net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
• tipc: fix UAF in error path {CVE-2024-36886}
• Bluetooth: af_bluetooth: Fix deadlock {CVE-2024-26886}
• Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• dma-mapping: benchmark: handle NUMA_NO_NODE correctly {CVE-2024-39277}
• net/mlx5e: Prevent deadlock while disabling aRFS {CVE-2024-27014}
• net/mlx5e: Introduce flow steering API {CVE-2024-27014}
• x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
• x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
• x86: Introduce ia32_enabled() {CVE-2024-25742}
• x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
• x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
• RDMA/srpt: Support specifying the srpt_service_guid parameter {CVE-2024-26744}
• platform/x86: think-lmi: Fix reference leak {CVE-2023-52520}
• USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command {CVE-2024-27059}
• fat: fix uninitialized field in nostale filehandles {CVE-2024-26973}
• usb: xhci: Add error handling in xhci_map_urb_for_dma {CVE-2024-26964}
• wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete {CVE-2024-26897}
• wifi: mac80211: fix race condition on enabling fast-xmit {CVE-2024-26779}
• RDMA/qedr: Fix qedr_create_user_qp error flow {CVE-2024-26743}
• wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
• x86/fpu: Stop relying on userspace for info to fault in xsave buffer {CVE-2024-26603}
• wifi: rt2x00: restart beacon queue when hardware reset {CVE-2023-52595}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg {CVE-2023-52528}
• RDMA/siw: Fix connection failure handling {CVE-2023-52513}
• usb: hub: Guard against accesses to uninitialized BOS descriptors {CVE-2023-52477}
• tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc {CVE-2021-47185}
• sctp: fail if no bound addresses can be used for a given scope {CVE-2023-1074}
• memcg: enable accounting for file lock caches {CVE-2022-0480}
• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}
• drm/amd/display: Atom Integrated System Info v2_2 for DCN35 {CVE-2024-36897}
• net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
• ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() {CVE-2024-36902}
• ipv6: prevent NULL dereference in ip6_output() {CVE-2024-36901}
• vt: fix memory overlapping when deleting chars in the buffer {CVE-2022-48627}
• hwmon: (coretemp) Fix out-of-bounds memory access {CVE-2024-26664}
• i2c: Fix a potential use after free {CVE-2019-25162}
• net/smc: fix…

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: think-lmi: Fix reference leak

If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned which needs to be disposed accordingly using kobject_put(). Move the setting name validation into a separate function to allow for this change without having to duplicate the cleanup code for this setting. As a side note, a very similar bug was fixed in commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"), so it seems that the bug was copied from that driver.

Compile-tested only.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)

• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)

• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)

• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)

• kernel: use after free in i2c (CVE-2019-25162)

• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)

• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)

• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)

• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)

• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)

• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)

• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)

• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)

• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)

• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)

• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)

• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)

• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)

• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)

• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)

• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)

• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)

• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)

• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)

• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)

• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)

• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)

• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)

• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)

• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)

• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)

• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)

• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

• kernel: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

• kernel: net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

• kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() (CVE-2022-48669)

• kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)

• kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (CVE-2023-52594)

• kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)

• kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2024-0340)

• kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

• kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

• kernel: pvrusb2: fix use after free on context disconnection (CVE-2023-52445)

• kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever (CVE-2024-26603)

• kernel: use after free in i2c (CVE-2019-25162)

• kernel: i2c: validate user data in compat ioctl (CVE-2021-46934)

• kernel: media: dvbdev: Fix memory leak in dvb_media_device_free() (CVE-2020-36777)

• kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477)

• kernel: mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

• kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615)

• kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)

• kernel: Integer Overflow in raid5_cache_count (CVE-2024-23307)

• kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565)

• kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

• kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (CVE-2023-52528)

• kernel: platform/x86: think-lmi: Fix reference leak (CVE-2023-52520)

• kernel: RDMA/siw: Fix connection failure handling (CVE-2023-52513)

• kernel: pid: take a reference when initializing cad_pid (CVE-2021-47118)

• kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

• kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643)

• kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642)

• kernel: i2c: i801: Don't generate an interrupt on bus reset (CVE-2021-47153)

• kernel: xhci: handle isoc Babble and Buffer Overrun events properly (CVE-2024-26659)

• kernel: hwmon: (coretemp) Fix out-of-bounds memory access (CVE-2024-26664)

• kernel: wifi: mac80211: fix race condition on enabling fast-xmit (CVE-2024-26779)

• kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter (CVE-2024-26744)

• kernel: RDMA/qedr: Fix qedr_create_user_qp error flow (CVE-2024-26743)

• kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (CVE-2021-47185)

• kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (CVE-2024-26901)

• kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup (CVE-2024-26872)

• kernel: usb: ulpi: Fix debugfs directory leak (CVE-2024-26919)

• kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma (CVE-2024-26964)

• kernel: USB: core: Fix deadlock in usb_deauthorize_interface() (CVE-2024-26934)

• kernel: USB: core: Fix deadlock in port "disable" sysfs attribute (CVE-2024-26933)

• kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993)

• kernel: fat: fix uninitialized field in nostale filehandles (CVE-2024-26973)

• kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (CVE-2024-27059)

Bug Fix(es):

• kernel-rt: update RT source tree to the latest Rocky Linux-8.10.z kernel (JIRA:Rocky Linux-34640)

• kernel-rt: epoll_wait not reporting catching all events to application (JIRA:Rocky Linux-23022)

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
• CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
• CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445).
• CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
• CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function __dma_async_device_channel_register() (bsc#1221276).
• CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
• CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
• CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
• CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine (bsc#1221553).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
• CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
• CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
• CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
• CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
• CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
• CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445).
• CVE-2023-52513: Fixed connection failure handling in RDMA/siw (bsc#1221022).
• CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
• CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
• CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
• CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
• CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
• CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
• CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
• CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
• CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
• CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
• CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
• CVE-2023-52567: Fixed possible Oops in serial/8250_port: when using IRQ polling (irq = 0) (bsc#1220839).
• CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i (bsc#1221055).
• CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
• CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
• CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine (bsc#1221553).
• CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47102: Fixed…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

NOTE: This update has been retracted due to a bug in the BHI CPU sidechannel mitigation, which led to incorrect selection of other CPU mitigations.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource() (bsc#1222660).
• CVE-2021-47182: Fixed buffer length handling in scsi_mode_sense() in scsi core (bsc#1222662).
• CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).
• CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
• CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length…