CVE-2022-0001

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

• kernel: avoid cyclic entity chains due to malformed USB descriptors (CVE-2020-0404)

• kernel: speculation on incompletely validated data on IBM Power9 (CVE-2020-4788)

• kernel: integer overflow in k_ascii() in drivers/tty/vt/keyboard.c (CVE-2020-13974)

• kernel: out-of-bounds read in bpf_skb_change_head() of filter.c due to a use-after-free (CVE-2021-0941)

• kernel: joydev: zero size passed to joydev_handle_JSIOCSBTNMAP() (CVE-2021-3612)

• kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts (CVE-2021-3669)

• kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c (CVE-2021-3743)

• kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() (CVE-2021-3744)

• kernel: possible use-after-free in bluetooth module (CVE-2021-3752)

• kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks (CVE-2021-3759)

• kernel: DoS in ccp_run_aes_gcm_cmd() function (CVE-2021-3764)

• kernel: sctp: Invalid chunks may be used to remotely remove existing associations (CVE-2021-3772)

• kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients (CVE-2021-3773)

• kernel: possible leak or coruption of data residing on hugetlbfs (CVE-2021-4002)

• kernel: security regression for CVE-2018-13405 (CVE-2021-4037)

• kernel: Buffer overwrite in decode_nfs_fh function (CVE-2021-4157)

• kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

• kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

• kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies (CVE-2021-20322)

• kernel: arm: SIGPAGE information disclosure vulnerability (CVE-2021-21781)

• hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

• kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154)

• kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c (CVE-2021-37159)

• kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write (CVE-2021-41864)

• kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739)

• kernel: ppc: kvm: allows a malicious KVM guest to crash the host (CVE-2021-43056)

• kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (CVE-2021-43389)

• kernel: mwifiex_usb_recv() in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker to cause DoS via crafted USB device (CVE-2021-43976)

• kernel: use-after-free in the TEE subsystem (CVE-2021-44733)

• kernel: information leak in the IPv6 implementation (CVE-2021-45485)

• kernel: information leak in the IPv4 implementation (CVE-2021-45486)

• hw: cpu: intel: Branch History Injection (BHI) (CVE-2022-0001)

• hw: cpu: intel: Intra-Mode BTI (CVE-2022-0002)

• kernel: Local denial of service in bond_ipsec_add_sa (CVE-2022-0286)

• kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c (CVE-2022-0322)

• kernel: FUSE allows UAF reads of write() buffers, allowing theft of (partial) /etc/shadow hashes (CVE-2022-1011)

• kernel: use-after-free in nouveau kernel module (CVE-2020-27820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-26373
  • x86/speculation: Add RSB VM Exit protections
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542)
  • Revert "x86/cpu: Add a steppings field to struct x86_cpu_id"
  • x86/cpufeature: Add facility to check for min microcode revisions
  • x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header
  • x86/devicetable: Move x86 specific macro out of generic code
  • x86/cpu: Add consistent CPU match macros
  • x86/cpu: Add a steppings field to struct x86_cpu_id
  • x86/cpufeatures: Move RETPOLINE flags to word 11
  • x86/bugs: Report AMD retbleed vulnerability
  • x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
  • x86/entry: Add kernel IBRS implementation
  • x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
  • x86/speculation: Add LFENCE to RSB fill sequence
  • KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  • x86/speculation: Fill RSB on vmexit for IBRS
  • x86/cpu/amd: Enumerate BTC_NO
  • x86/speculation: Disable RRSBA behavior
  • x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-29901
  • x86/bugs: Optimize SPEC_CTRL MSR writes
  • x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation()
  • x86/bugs: Report Intel retbleed vulnerability
  • entel_idle: Disable IBRS during long idle
  • x86/speculation: Change FILL_RETURN_BUFFER to work with objtool
  • x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
  • x86/speculation: Fix firmware entry SPEC_CTRL handling
  • x86/speculation: Fix SPEC_CTRL write on SMT state change
  • x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
  • x86/speculation: Remove x86_spec_ctrl_mask
  • x86/common: Stamp out the stepping madness
  • x86/bugs: Add Cannon lake to RETBleed affected CPU list
  • x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-29900
  • x86/bugs: Add AMD retbleed= boot parameter
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112)
  • x86/bugs: Add "unknown" reporting for MMIO Stale Data
• CVE-2021-26401
  • x86/speculation: Warn about Spectre v2 LFENCE mitigation
  • x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
• CVE-2022-0001
  • x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
• Bionic update: upstream stable patchset 2019-10-07 (LP: #1847155)
  • x86/cpu: Add Tiger Lake to Intel family
• CVE-url: https://ubuntu.com/security/CVE-2023-4622
  • af_unix: Fix null-ptr-deref in unix_stream_sendpage().
• CVE-url: https://ubuntu.com/security/CVE-2022-45919
  • media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
• Miscellaneous upstream changes
  • Revert "x86/enter: Use IBRS on syscall and interrupts"

• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-26373
  • x86/speculation: Add RSB VM Exit protections
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542)
  • Revert "x86/cpu: Add a steppings field to struct x86_cpu_id"
  • x86/cpufeature: Add facility to check for min microcode revisions
  • x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header
  • x86/devicetable: Move x86 specific macro out of generic code
  • x86/cpu: Add consistent CPU match macros
  • x86/cpu: Add a steppings field to struct x86_cpu_id
  • x86/cpufeatures: Move RETPOLINE flags to word 11
  • x86/bugs: Report AMD retbleed vulnerability
  • x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
  • x86/entry: Add kernel IBRS implementation
  • x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
  • x86/speculation: Add LFENCE to RSB fill sequence
  • KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  • x86/speculation: Fill RSB on vmexit for IBRS
  • x86/cpu/amd: Enumerate BTC_NO
  • x86/speculation: Disable RRSBA behavior
  • x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-29901
  • x86/bugs: Optimize SPEC_CTRL MSR writes
  • x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation()
  • x86/bugs: Report Intel retbleed vulnerability
  • entel_idle: Disable IBRS during long idle
  • x86/speculation: Change FILL_RETURN_BUFFER to work with objtool
  • x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
  • x86/speculation: Fix firmware entry SPEC_CTRL handling
  • x86/speculation: Fix SPEC_CTRL write on SMT state change
  • x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
  • x86/speculation: Remove x86_spec_ctrl_mask
  • x86/common: Stamp out the stepping madness
  • x86/bugs: Add Cannon lake to RETBleed affected CPU list
  • x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
• Bionic update: upstream stable patchset 2022-12-01 (LP: #1998542) // CVE-2022-29900
  • x86/bugs: Add AMD retbleed= boot parameter
• Bionic update: upstream stable patchset 2022-10-06 (LP: #1992112)
  • x86/bugs: Add "unknown" reporting for MMIO Stale Data
• CVE-2021-26401
  • x86/speculation: Warn about Spectre v2 LFENCE mitigation
  • x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
• CVE-2022-0001
  • x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
• Bionic update: upstream stable patchset 2019-10-07 (LP: #1847155)
  • x86/cpu: Add Tiger Lake to Intel family
• CVE-url: https://ubuntu.com/security/CVE-2023-4622
  • af_unix: Fix null-ptr-deref in unix_stream_sendpage().
• CVE-url: https://ubuntu.com/security/CVE-2022-45919
  • media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
• Miscellaneous upstream changes
  • Revert "x86/enter: Use IBRS on syscall and interrupts"

This kernel update is based on upstream 5.15.28 and fixes at least the following security issues:

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access (CVE-2022-0001).

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access (CVE-2022-0002).

A memory leak flaw was found in the Linux kernel’s ICMPv6 networking protocol, in the way a user generated malicious ICMPv6 packets. This flaw allows a remote user to crash the system (CVE-2022-0742).

Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends:

blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer (blkfront: CVE-2022-23036, netfront: CVE-2022-23037, scsifront: CVE-2022-23038, gntalloc: CVE-2022-23039, xenbus: CVE-2022-23040)

blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose (CVE-2022-23041).

netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend (CVE-2022-23042).

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information (CVE-2022-23960).

It was found that the default LFENCE-based Spectre v2 mitigation on AMD cpus is insufficient to mitigate such attacks. Becuse of that, the code have been switched to use generic retpolines on AMD cpus by default.

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.28 and fixes at least the following security issues:

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access (CVE-2022-0001).

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access (CVE-2022-0002).

A memory leak flaw was found in the Linux kernel’s ICMPv6 networking protocol, in the way a user generated malicious ICMPv6 packets. This flaw allows a remote user to crash the system (CVE-2022-0742).

Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends:

blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer (blkfront: CVE-2022-23036, netfront: CVE-2022-23037, scsifront: CVE-2022-23038, gntalloc: CVE-2022-23039, xenbus: CVE-2022-23040)

blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose (CVE-2022-23041).

netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend (CVE-2022-23042).

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information (CVE-2022-23960).

It was found that the default LFENCE-based Spectre v2 mitigation on AMD cpus is insufficient to mitigate such attacks. Becuse of that, the code have been switched to use generic retpolines on AMD cpus by default.

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Bluetooth: refactor malicious adv data check (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
• IB/umad: Return EIO in case of when device disassociated (git-fixes)
• IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
• Input: wm97xx: Simplify resource management (git-fixes).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFS: Ensure the server had an up to date ctime before renaming (git-fixes).
• NFSD: Fix the behavior of READ near OFFSET_MAX…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bnc#1196235 ).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Drop PCI xgene patch that caused a regression for mxl4 (bsc#1195352)
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957).
• PM: hibernate: Remove register_nosave_region_late() (git-fixes).
• PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes).
• RDMA/cma: Use correct address when leaving multicast group (bsc#1181147).
• RDMA/core: Always release restrack object (git-fixes)
• RDMA/cxgb4: check for ipv6 address properly while destroying listener (git-fixes)
• RDMA/siw: Release xarray entry (git-fixes)
• RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147).
• USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes).
• USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes).
• USB: serial: cp210x: add NCR Retail IO box id (git-fixes).
• USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes).
• USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes).
• USB: serial: option: add ZTE MF286D modem (git-fixes).
• ata: libata-core: Disable TRIM on M88V29 (git-fixes).
• ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes).
• blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787).
• blk-mq: avoid to iterate over stale request (bsc#1193787).
• blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787).
• blk-mq: clearing flush request reference in tags->rqs (bsc#1193787).
• blk-mq:…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

This update for xen fixes the following issues:

Update Xen to version 4.14.4 (bsc#1027519)

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

Security issues fixed:

• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: BHB speculation issues (bsc#1196915).

Non-security issues fixed:

• Fixed issue around xl and virsh operation - virsh list not giving any output (bsc#1191668).

These are all security issues fixed in the xen-4.16.0_06-3.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Bluetooth: refactor malicious adv data check (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
• IB/umad: Return EIO in case of when device disassociated (git-fixes)
• IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
• Input: wm97xx: Simplify resource management (git-fixes).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFS: Ensure the server had an up to date ctime before renaming (git-fixes).
• NFSD: Fix the behavior of READ near OFFSET_MAX…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free bug in unix_gc (bsc#1193731).
• CVE-2016-10905: Fixed a use-after-free is gfs2_clear_rgrpd() and read_rindex_entry() (bsc#1146312).

The following non-security bug was fixed:

• net: sched: sch_teql: fix null-pointer dereference (bsc#1190717).

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934).
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• hv_netvsc: fix network namespace issues with VF support (bsc#1107207).
• hv_netvsc: move VF to same namespace as netvsc device (bsc#1107207).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).
• CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096).
• CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905).

The following non-security bugs were fixed:

• btrfs: check for missing device in btrfs_trim_fs (bsc#1195701).
• gve: Add RX context (jsc#SLE-23652).
• gve: Add a jumbo-frame device option (jsc#SLE-23652).
• gve: Add consumed counts to ethtool stats (jsc#SLE-23652).
• gve: Add optional metadata descriptor type GVE_TXD_MTD (jsc#SLE-23652).
• gve: Correct order of processing device options (jsc#SLE-23652).
• gve: Fix GFP flags when allocing pages (jsc#SLE-23652).
• gve: Implement packet continuation for RX (jsc#SLE-23652).
• gve: Implement suspend/resume/shutdown (jsc#SLE-23652).
• gve: Move the irq db indexes out of the ntfy block struct (jsc#SLE-23652).
• gve: Recording rx queue before sending to napi (jsc#SLE-23652).
• gve: Update gve_free_queue_page_list signature (jsc#SLE-23652).
• gve: Use kvcalloc() instead of kvzalloc() (jsc#SLE-23652).
• gve: fix for null pointer dereference (jsc#SLE-23652).
• gve: fix the wrong AdminQ buffer queue index check (jsc#SLE-23652).
• gve: fix unmatched u64_stats_update_end() (jsc#SLE-23652).
• gve: remove memory barrier around seqno (jsc#SLE-23652).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).
• net: tipc: validate domain record count on input (bsc#1195254).
• nfsd: allow delegation state ids to be revoked and then freed (bsc#1192483).
• nfsd: allow lock state ids to be revoked and then freed (bsc#1192483).
• nfsd: allow open state ids to be revoked and then freed (bsc#1192483).
• nfsd: do not admin-revoke NSv4.0 state ids (bsc#1192483).
• nfsd: prepare for supporting admin-revocation of state (bsc#1192483). -…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bnc#1196235 ).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Drop PCI xgene patch that caused a regression for mxl4 (bsc#1195352)
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957).
• PM: hibernate: Remove register_nosave_region_late() (git-fixes).
• PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes).
• RDMA/cma: Use correct address when leaving multicast group (bsc#1181147).
• RDMA/core: Always release restrack object (git-fixes)
• RDMA/cxgb4: check for ipv6 address properly while destroying listener (git-fixes)
• RDMA/siw: Release xarray entry (git-fixes)
• RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147).
• USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes).
• USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes).
• USB: serial: cp210x: add NCR Retail IO box id (git-fixes).
• USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes).
• USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes).
• USB: serial: option: add ZTE MF286D modem (git-fixes).
• ata: libata-core: Disable TRIM on M88V29 (git-fixes).
• ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes).
• blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787).
• blk-mq: avoid to iterate over stale request (bsc#1193787).
• blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787).
• blk-mq: clearing flush request reference in tags->rqs (bsc#1193787).
• blk-mq:…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

The following non-security bugs were fixed:

• Bluetooth: bfusb: fix division by zero in send path (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1114648).
• IB/rdmavt: Validate remote_addr during loopback atomic tests (bsc#1114685).
• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934). Make this work-around optional
• NFSv42: Do not fail clone() unless the OP_CLONE operation failed (git-fixes).
• NFSv42: Fix pagecache invalidation after COPY/CLONE (git-fixes).
• NFSv4: Handle case where the lookup of a directory fails (git-fixes).
• NFSv4: nfs_atomic_open() can race when looking up a non-regular file (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/bnxt_re: Fix query SRQ failure (bsc#1050244).
• RDMA/mlx5: Set user priority for DCT (bsc#1103991).
• RDMA/netlink: Add __maybe_unused to static inline in C file (bsc#1046306).
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• cxgb4: fix eeprom len when diagnostics not implemented (bsc#1097585 bsc#1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584).
• e1000e: Fix packet loss on Tiger Lake and later (bsc#1158533).
• ext4: avoid trim error on fs with small groups (bsc#1191271).
• fuse: annotate lock in fuse_reverse_inval_entry() (bsc#1195795).
• gve: Add RX context (bsc#1191655).
• gve: Add a jumbo-frame device option (bsc#1191655).
• gve: Add consumed counts to ethtool stats (bsc#1191655).
• gve: Add netif_set_xps_queue call (bsc#1191655).
• gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655).
• gve: Add rx buffer pagecnt bias (bsc#1191655).
• gve: Allow pageflips on larger pages (bsc#1191655).
• gve: Avoid freeing NULL pointer (bsc#1191655).
• gve: Correct available tx qpl check (bsc#1191655).
• gve: Correct order of processing device options (bsc#1191655).
• gve: DQO: avoid unused variable warnings (bsc#1191655).
• gve: Do lazy cleanup in TX path (bsc#1191655).
• gve: Fix GFP flags when allocing pages (bsc#1191655).
• gve: Implement packet continuation for RX (bsc#1191655).
• gve: Implement suspend/resume/shutdown (bsc#1191655).
• gve: Move the irq db indexes out of the ntfy block struct (bsc#1191655).
• gve: Properly handle errors in gve_assign_qpl (bsc#1191655).
• gve: Recording rx queue before sending to napi (bsc#1191655).
• gve: Switch to use napi_complete_done (bsc#1191655).
• gve: Track RX buffer allocation failures (bsc#1191655).
• gve: Update gve_free_queue_page_list signature (bsc#1191655).
• gve: Use kvcalloc() instead of kvzalloc() (bsc#1191655).
• gve: fix for null pointer dereference (bsc#1191655).
• gve: fix gve_get_stats() (bsc#1191655).
• gve: fix the wrong AdminQ buffer queue index check (bsc#1191655).
• gve: fix unmatched u64_stats_update_end() (bsc#1191655).
• gve: remove memory…

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free bug in unix_gc (bsc#1193731).
• CVE-2016-10905: Fixed a use-after-free is gfs2_clear_rgrpd() and read_rindex_entry() (bsc#1146312).

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bnc#1196235 ).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494). CONFIG_NVME_TARGET=m CONFIG_NVME_TARGET_PASSTHRU=y CONFIG_NVME_TARGET_LOOP=m CONFIG_NVME_TARGET_RDMA=m CONFIG_NVME_TARGET_FC=m CONFIG_NVME_TARGET_FCLOOP=m CONFIG_NVME_TARGET_TCP=m
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957).
• PM: hibernate: Remove register_nosave_region_late() (git-fixes).
• PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes).
• RDMA/cma: Use correct address when leaving multicast group (bsc#1181147).
• RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147).
• USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes).
• USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes).
• USB: serial: cp210x: add NCR Retail IO box id (git-fixes).
• USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes).
• USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes).
• USB: serial: option: add ZTE MF286D modem (git-fixes).
• ata: libata-core: Disable TRIM on M88V29 (git-fixes).
• ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes).
• blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787).
• blk-mq: avoid to iterate over stale request (bsc#1193787).
• blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787).
• blk-mq: clearing flush request reference in tags->rqs (bsc#1193787).
• blk-mq: do not grab rq's refcount in blk_mq_check_expired() (bsc#1193787 git-fixes).
• blk-mq: fix is_flush_rq (bsc#1193787 git-fixes).
• blk-mq: fix kernel panic during iterating over flush request (bsc#1193787 git-fixes).
• blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter (bsc#1193787).
• blk-mq: mark flush request as IDLE in…

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).

The following non-security bugs were fixed:

• btrfs: check for missing device in btrfs_trim_fs (bsc#1195701).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).
• nfsd: allow delegation state ids to be revoked and then freed (bsc#1192483).
• nfsd: allow open state ids to be revoked and then freed (bsc#1192483).
• nfsd: do not admin-revoke NSv4.0 state ids (bsc#1192483).
• nfsd: prepare for supporting admin-revocation of state (bsc#1192483).
• powerpc/pseries/ddw: Revert 'Extend upper limit for huge DMA window for persistent memory' (bsc#1195995 ltc#196394).

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bsc#1193867).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• Bluetooth: bfusb: fix division by zero in send path (git-fixes).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1114648).
• IB/rdmavt: Validate remote_addr during loopback atomic tests (bsc#1114685).
• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934). Make this work-around optional
• NFSv42: Do not fail clone() unless the OP_CLONE operation failed (git-fixes).
• NFSv42: Fix pagecache invalidation after COPY/CLONE (git-fixes).
• NFSv4: Handle case where the lookup of a directory fails (git-fixes).
• NFSv4: nfs_atomic_open() can race when looking up a non-regular file (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/bnxt_re: Fix query SRQ failure (bsc#1050244).
• RDMA/mlx5: Set user priority for DCT (bsc#1103991).
• RDMA/netlink: Add __maybe_unused to static inline in C file (bsc#1046306).
• Replace with an alternative fix for bsc#1185377
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• cxgb4: fix eeprom len when diagnostics not implemented (bsc#1097585 bsc#1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584).
• e1000e: Fix packet loss on Tiger Lake and later (bsc#1158533).
• ext4: avoid trim error on fs with small groups (bsc#1191271).
• fuse: annotate lock in fuse_reverse_inval_entry() (bsc#1195795).
• gve: Add RX context (bsc#1191655).
• gve: Add a jumbo-frame device option (bsc#1191655).
• gve: Add consumed counts to ethtool stats (bsc#1191655).
• gve: Add netif_set_xps_queue call (bsc#1191655).
• gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655).
• gve: Add rx buffer pagecnt bias (bsc#1191655).
• gve: Allow pageflips on larger pages (bsc#1191655).
• gve: Avoid freeing NULL pointer (bsc#1191655).
• gve: Correct available tx qpl check (bsc#1191655).
• gve: Correct order of processing device options (bsc#1191655).
• gve: DQO: avoid unused variable warnings (bsc#1191655).
• gve: Do lazy…

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• hv_netvsc: fix network namespace issues with VF support (bsc#1107207).
• hv_netvsc: move VF to same namespace as netvsc device (bsc#1107207).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bsc#1193867).

The following non-security bugs were fixed:

• Bluetooth: bfusb: fix division by zero in send path (git-fixes).
• Bluetooth: fix the erroneous flush_work() order (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1114648).
• IB/rdmavt: Validate remote_addr during loopback atomic tests (bsc#1114685).
• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934). Make this work-around optional
• NFSv42: Do not fail clone() unless the OP_CLONE operation failed (git-fixes).
• NFSv42: Fix pagecache invalidation after COPY/CLONE (git-fixes).
• NFSv4: Handle case where the lookup of a directory fails (git-fixes).
• NFSv4: nfs_atomic_open() can race when looking up a non-regular file (git-fixes).
• PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller (git-fixes).
• RDMA/bnxt_re: Fix query SRQ failure (bsc#1050244).
• RDMA/mlx5: Set user priority for DCT (bsc#1103991).
• RDMA/netlink: Add __maybe_unused to static inline in C file (bsc#1046306).
• Replace with an alternative fix for bsc#1185377
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• cxgb4: fix eeprom len when diagnostics not implemented (bsc#1097585 bsc#1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584).
• e1000e: Fix packet loss on Tiger Lake and later (bsc#1158533).
• ext4: avoid trim error on fs with small groups (bsc#1191271).
• fuse: annotate lock in fuse_reverse_inval_entry() (bsc#1195795).
• gve: Add RX context (bsc#1191655).
• gve: Add a jumbo-frame device option (bsc#1191655).
• gve: Add consumed counts to ethtool stats (bsc#1191655).
• gve: Add netif_set_xps_queue call (bsc#1191655).
• gve: Add optional metadata descriptor type GVE_TXD_MTD (bsc#1191655).
• gve: Add rx buffer pagecnt bias (bsc#1191655).
• gve: Allow pageflips on larger pages (bsc#1191655).
• gve: Avoid freeing NULL pointer (bsc#1191655).
• gve: Correct available tx qpl check (bsc#1191655).
• gve: Correct order of processing device options (bsc#1191655).
• gve: DQO: avoid unused variable warnings (bsc#1191655).
• gve: Do lazy cleanup in…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

This update for xen fixes the following issues:

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: BHB speculation issues (bsc#1196915).

This update for xen fixes the following issues:

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: BHB speculation issues (bsc#1196915).

This update for xen fixes the following issues:

Update Xen to version 4.14.4 (bsc#1027519)

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

Security issues fixed:

• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: BHB speculation issues (bsc#1196915).

Non-security issues fixed:

• Fixed issue around xl and virsh operation - virsh list not giving any output (bsc#1191668).

The SUSE Linux Enterprise 12 SP5 kernel was updated.

The following security bugs were fixed:

• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel. (bnc#1198033)
• CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel. (bnc#1198031)
• CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel. (bnc#1198032)
• CVE-2022-0812: Fixed an incorrect header size calculations which could lead to a memory leak. (bsc#1196639)
• CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock. (bsc#1197331)
• CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c. (bsc#1196761)
• CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from the memory via crafted frame lengths from a USB device. (bsc#1196836)
• CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file. (bnc#1197366)
• CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-after-free. (bnc#1196973)
• CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040,CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers. (bsc#1196488)
• CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could crash the system or corrupt the system memory. (bsc#1196830)
• CVE-2022-0001,CVE-2022-0002,CVE-2022-23960: Fixed a new kind of speculation issues, exploitable via JITed eBPF for instance. (bsc#1191580)
• CVE-2022-27666: Fixed a buffer overflow vulnerability in IPsec ESP transformation code. This flaw allowed a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation. (bnc#1197462)

The following non-security bugs were fixed:

• asix: Add rx->ax_skb = NULL after usbnet_skb_return() (git-fixes).
• asix: Ensure asix_rx_fixup_info members are all reset (git-fixes).
• asix: Fix small memory leak in ax88772_unbind() (git-fixes).
• asix: fix uninit-value in asix_mdio_read() (git-fixes).
• asix: fix wrong return value in asix_check_host_enable() (git-fixes).
• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 (bsc#1196018).
• block: bfq: fix bfq_set_next_ioprio_data() (bsc#1191451).
• block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) (bsc#1194586).
• can: dev: can_restart: fix use after free bug (git-fixes).
• cgroup: Correct privileges check in release_agent writes (bsc#1196723).
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv (bsc#1196723).
• cgroup: Use open-time cgroup namespace for process migration perm checks (bsc#1196723).
• dax: update to new mmu_notifier semantic (bsc#1184207).
• drm: add a locked version of drm_is_current_master (bsc#1197914).
• drm: drm_file struct kABI compatibility workaround (bsc#1197914).
• drm: protect drm_master pointers in drm_lease.c (bsc#1197914).
• drm: serialize drm_file.master with a new spinlock (bsc#1197914).
• drm: use the lookup lock in drm_is_current_master (bsc#1197914).
• EDAC: Fix calculation of returned address and next offset in edac_align_ptr() (bsc#1114648).
• ena_netdev: use generic power management (bsc#1197099 jsc#SLE-24125).
• ena: Remove rcu_read_lock() around XDP program invocation (bsc#1197099 jsc#SLE-24125).
• ethernet: amazon: ena: A typo fix in…

This update for xen fixes the following issues:

• CVE-2022-26356: Fixed potential race conditions in dirty memory tracking that could cause a denial of service in the host (bsc#1197423).
• CVE-2022-26357: Fixed a potential race condition in memory cleanup for hosts using VT-d IOMMU hardware, which could lead to a denial of service in the host (bsc#1197425).
• CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361: Fixed various memory corruption issues for hosts using VT-d or AMD-Vi IOMMU hardware. These could be leveraged by an attacker to cause a denial of service in the host (bsc#1197426).
• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: Added BHB speculation issue mitigations (bsc#1196915).

This update for xen fixes the following issues:

• CVE-2022-26356: Fixed potential race conditions in dirty memory tracking that could cause a denial of service in the host (bsc#1197423).
• CVE-2022-26357: Fixed a potential race condition in memory cleanup for hosts using VT-d IOMMU hardware, which could lead to a denial of service in the host (bsc#1197425).
• CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361: Fixed various memory corruption issues for hosts using VT-d or AMD-Vi IOMMU hardware. These could be leveraged by an attacker to cause a denial of service in the host (bsc#1197426).
• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: Added BHB speculation issue mitigations (bsc#1196915).

This update for xen fixes the following issues:

• CVE-2022-26356: Fixed potential race conditions in dirty memory tracking that could cause a denial of service in the host (bsc#1197423).
• CVE-2022-26357: Fixed a potential race condition in memory cleanup for hosts using VT-d IOMMU hardware, which could lead to a denial of service in the host (bsc#1197425).
• CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361: Fixed various memory corruption issues for hosts using VT-d or AMD-Vi IOMMU hardware. These could be leveraged by an attacker to cause a denial of service in the host (bsc#1197426).
• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: Added BHB speculation issue mitigations (bsc#1196915).

This update for xen fixes the following issues:

• CVE-2022-26356: Fixed potential race conditions in dirty memory tracking that could cause a denial of service in the host (bsc#1197423).
• CVE-2022-26357: Fixed a potential race condition in memory cleanup for hosts using VT-d IOMMU hardware, which could lead to a denial of service in the host (bsc#1197425).
• CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361: Fixed various memory corruption issues for hosts using VT-d or AMD-Vi IOMMU hardware. These could be leveraged by an attacker to cause a denial of service in the host (bsc#1197426).
• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: Added BHB speculation issue mitigations (bsc#1196915).
• CVE-2021-20257: Fixed an infinite loop in the e1000 emulated device, which could cause an excessive CPU consumption in the host (bsc#1182846).

This update for xen fixes the following issues:

• CVE-2022-26356: Fixed potential race conditions in dirty memory tracking that could cause a denial of service in the host (bsc#1197423).
• CVE-2022-26357: Fixed a potential race condition in memory cleanup for hosts using VT-d IOMMU hardware, which could lead to a denial of service in the host (bsc#1197425).
• CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361: Fixed various memory corruption issues for hosts using VT-d or AMD-Vi IOMMU hardware. These could be leveraged by an attacker to cause a denial of service in the host (bsc#1197426).
• CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: Added BHB speculation issue mitigations (bsc#1196915).

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bsc#1193867).
• CVE-2021-4155: Fixed a data leak flaw that allows a local attacker to leak data on the XFS filesystem (bsc#1194272).
• CVE-2020-27820: Fixed a vulnerability where a use-after-frees in nouveau's postclose() handler could happen if removing device (bsc#1179599).
• CVE-2019-0136: Fixed an insufficient access control which allow an unauthenticated user to execute a denial of service (bsc#1193157).
• CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).

The following non-security bugs were fixed:

• kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).
• md: check the return of mddev_find() (bsc#1195109).

Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-25636)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by ARM to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-23960)

Max Kellermann discovered that the Linux kernel incorrectly handled Unix pipes. A local attacker could potentially use this to modify any file that could be opened for reading. (CVE-2022-0847)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-0001, CVE-2022-0002)

Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-25636)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by ARM to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-23960)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-0001, CVE-2022-0002)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information.

Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-25636)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by ARM to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-23960)

It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in certain situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-23222)

Max Kellermann discovered that the Linux kernel incorrectly handled Unix pipes. A local attacker could potentially use this to modify any file that could be opened for reading. (CVE-2022-0847)

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. (CVE-2022-0492)

William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-0185)

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-0001)

Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083)

It was discovered that the NFS server implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4090)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155)

It was discovered that the AMD Radeon GPU driver in the Linux kernel did not properly validate writes in the debugfs file system. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-42327)

Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330)

Samuel Page discovered that the Transparent Inter-Process Communication (TIPC) protocol implementation in the Linux kernel contained a stack-based buffer overflow. A remote attacker could use this to cause a denial of service (system crash) for systems that have a TIPC bearer configured. (CVE-2022-0435)

It was discovered that the KVM implementation for s390 systems in the Linux kernel did not properly prevent memory operations on PVM guests that were in non-protected mode. A local attacker could use this to obtain unauthorized memory write access. (CVE-2022-0516)

It was discovered that the ICMPv6 implementation in the Linux kernel did not properly deallocate memory in certain situations. A remote attacker could possibly use this to cause a denial of service (memory exhaustion). (CVE-2022-0742)

It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain failure…