CVE-2022-1852

The Linux Kernel, the operating system core itself.

Security Fix(es):

NFC: netlink: fix sleep in atomic bug when firmware download timeout(CVE-2022-1975)

In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182388481References: Upstream kernel(CVE-2022-20166)

A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.(CVE-2022-1852)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

• Race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• Memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

• Uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

• Race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)

• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

• Memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

• Double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

• Use after free in SUNRPC subsystem (CVE-2022-28893)

• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

• race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)

• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)

• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• Spectre-BHB (CVE-2022-23960)

• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

• memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

• use after free in SUNRPC subsystem (CVE-2022-28893)

• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• Race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• Memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• Uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• Race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• Memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
• Double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• Use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference (CVE-2020-36558)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)
• smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)
• net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• Spectre-BHB (CVE-2022-23960)
• Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)
• kernel info leak issue in pfkey_register (CVE-2022-1353)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)
• incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)
• incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nf_tables disallow binding to already bound chain (CVE-2022-39190)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)
• use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)
• smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)
• NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)
• swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)
• uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)
• race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)
• use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184)
• concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)
• kernel info leak issue in pfkey_register (CVE-2022-1353)
• use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)
• NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)
• fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)
• nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)
• integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)
• slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)
• incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)
• incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)
• incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)
• possible to use the debugger to write zero into a location of choice (CVE-2022-21499)
• AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)
• double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)
• use after free in SUNRPC subsystem (CVE-2022-28893)
• use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)
• Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)
• DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)
• nf_tables disallow binding to already bound chain (CVE-2022-39190)
• nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.

This kernel update is based on upstream 5.15.46 and fixes at least the following security issues:

KVM: x86: avoid calling x86 emulator without a decoded instruction (CVE-2022-1852).

A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue (CVE-2022-1966).

An out-of-bound write vulnerability was identified within the netfilter subsystem which can be exploited to achieve privilege escalation to root. In order to trigger the issue it requires the ability to create user/net namespaces (CVE-2022-1972).

fs/ntfs3: Fix invalid free in log_replay (CVE-2022-1973).

Other fixes in this update:

• x86/amd_nb: Add AMD Family 17h A0-AF IDs
• x86/amd_nb: Add Family 19h model 70h-7Fh IDs
• x86/amd_nb: Add Family 19h model 60h-6Fh IDs
• hwmon: (k10temp): Add support for family 17h models A0h-AFh
• hwmon: (k10temp): Add support for family 19h models 70h-7Fh
• hwmon: (k10temp): Add support for family 19h models 60h-6Fh

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.46 and fixes at least the following security issues:

KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID (CVE-2022-1789).

KVM: x86: avoid calling x86 emulator without a decoded instruction (CVE-2022-1852).

A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue (CVE-2022-1966).

An out-of-bound write vulnerability was identified within the netfilter subsystem which can be exploited to achieve privilege escalation to root. In order to trigger the issue it requires the ability to create user/net namespaces (CVE-2022-1972).

fs/ntfs3: Fix invalid free in log_replay (CVE-2022-1973).

For other upstream fixes, see the referenced changelogs.

These are all security issues fixed in the kernel-devel-5.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-1462: Fixed an out-of-bounds read flaw in the TeleTYpe subsystem (bnc#1198829).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-33743: Fixed a Denial of Service related to XDP (bsc#1200763).
• CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bnc#1199487).
• CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bnc#1200619).
• CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
• CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
• CVE-2022-1998: Fixed a use after free in the file system notify functionality (bnc#1200284).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1852: Fixed a null-ptr-deref in the kvm module which can lead to DoS. (bsc#1199875)
• CVE-2022-1789: Fixed a NULL pointer dereference when shadow paging is enabled. (bnc#1199674)
• CVE-2022-1508: Fixed an out-of-bounds read flaw that could cause the system to crash. (bsc#1198968)
• CVE-2022-1671: Fixed a null-ptr-deref bugs in net/rxrpc/server_key.c, unprivileged users could easily trigger it via ioctl. (bsc#1199439)
• CVE-2022-1651: Fixed a bug in ACRN Device Model emulates virtual NICs in VM. This flaw may allow a local privileged attacker to leak kernel unauthorized information and also cause a denial of service problem. (bsc#1199433)
• CVE-2022-29582: Fixed a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. (bnc#1198811)
• CVE-2022-0494: Fixed a kernel information leak flaw in the scsi_ioctl function. This flaw allowed a local attacker with a special user privilege to create issues with confidentiality. (bnc#1197386)
• CVE-2021-4204: Fixed a vulnerability that allows local attackers to escalate privileges on affected installations via ebpf. (bnc#1194111)
• CVE-2022-23222: Fixed a bug that allowed local users to gain privileges. (bnc#1194765)
• CVE-2022-0264: Fixed a vulnerability in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (bnc#1194826)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and…

The SUSE Linux Enterprise 15 SP4 kernel was updated.

The following security bugs were fixed:

• CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
• CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
• CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
• CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
• CVE-2022-2318: Fixed a use-after-free vulnerabilities in the timer handler in net/rose/rose_timer.c that allow attackers to crash the system without any privileges (bsc#1201251).
• CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742: Fixed multiple potential data leaks with Block and Network devices when using untrusted backends (bsc#1200762).
• CVE-2022-33743: Fixed a Denial of Service related to XDP (bsc#1200763).
• CVE-2022-1966: Fixed a use-after-free vulnerability in the Netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. (bnc#1200015)
• CVE-2022-1852: Fixed a null-ptr-deref in the kvm module which can lead to DoS. (bsc#1199875)
• CVE-2022-1789: Fixed a NULL pointer dereference when shadow paging is enabled. (bnc#1199674)
• CVE-2022-1508: Fixed an out-of-bounds read flaw that could cause the system to crash. (bsc#1198968)
• CVE-2022-1671: Fixed a null-ptr-deref bugs in net/rxrpc/server_key.c, unprivileged users could easily trigger it via ioctl. (bsc#1199439)
• CVE-2022-1651: Fixed a bug in ACRN Device Model emulates virtual NICs in VM. This flaw may allow a local privileged attacker to leak kernel unauthorized information and also cause a denial of service problem. (bsc#1199433)
• CVE-2022-29582: Fixed a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. (bnc#1198811)
• CVE-2022-0494: Fixed a kernel information leak flaw in the scsi_ioctl function. This flaw allowed a local attacker with a special user privilege to create issues with confidentiality. (bnc#1197386)
• CVE-2021-4204: Fixed a vulnerability that allows local attackers to escalate privileges on affected installations via ebpf. (bnc#1194111)
• CVE-2022-23222: Fixed a bug that allowed local users to gain privileges. (bnc#1194765)
• CVE-2022-0264: Fixed a vulnerability in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. (bnc#1194826)
• CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution. (bsc#1197227)
• CVE-2022-1205: Fixed null pointer dereference and use-after-free vulnerabilities that allow an attacker to crash the linux kernel by simulating Amateur Radio. (bsc#1198027)
• CVE-2022-1198: Fixed an use-after-free vulnerability that allow an attacker to crash the linux kernel by simulating Amateur Radio (bsc#1198030).
• CVE-2022-1972: Fixed a buffer overflow in nftable that could lead to privilege escalation. (bsc#1200019)
• CVE-2022-21127: Fixed a stale MMIO data transient which can be exploited to speculatively/transiently disclose information via spectre like attacks. (bsc#1199650)
• CVE-2022-21123: Fixed a…

It was discovered that the Atheros ath9k wireless device driver in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1679)

Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle guest TLB mapping invalidation requests in some situations. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2022-1789)

Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2022-1852)

Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

It was discovered that the netfilter subsystem in the Linux kernel contained a buffer overflow in certain situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2078)

It was discovered that some Intel processors did not completely perform cleanup actions on multi-core shared buffers. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21123)

It was discovered that some Intel processors did not completely perform cleanup actions on microarchitectural fill buffers. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21125)

It was discovered that some Intel processors did not properly perform cleanup during specific special register write operations. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21166)

It was discovered that the virtio RPMSG bus driver in the Linux kernel contained a double-free vulnerability in certain error conditions. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-34494, CVE-2022-34495)

Minh Yuan discovered that the floppy disk driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1652)

Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061)

Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information. (CVE-2022-1012)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2022-1852)

It was discovered that the UDF file system implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1943)

Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

Zheyu Ma discovered that the Intel iSMT SMBus host controller driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2873)

Selim Enes Karaduman discovered that a race condition existed in the pipe buffers implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly escalate privileges. (CVE-2022-2959)

Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061)

Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information. (CVE-2022-1012)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2022-1852)

It was discovered that the UDF file system implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1943)

Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

Zheyu Ma discovered that the Intel iSMT SMBus host controller driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2873)

Selim Enes Karaduman discovered that a race condition existed in the pipe buffers implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly escalate privileges. (CVE-2022-2959)

Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061)

Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information. (CVE-2022-1012)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2022-1852)

It was discovered that the UDF file system implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1943)

Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

Zheyu Ma discovered that the Intel iSMT SMBus host controller driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2873)

Selim Enes Karaduman discovered that a race condition existed in the pipe buffers implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly escalate privileges. (CVE-2022-2959)

Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061)

Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information. (CVE-2022-1012, CVE-2022-32296)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2022-1852)

It was discovered that the UDF file system implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1943)

Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

Zheyu Ma discovered that the Intel iSMT SMBus host controller driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2873)

Selim Enes Karaduman discovered that a race condition existed in the pipe buffers implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly escalate privileges. (CVE-2022-2959)

Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. (CVE-2021-33061)

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information. (CVE-2022-1012, CVE-2022-32296)

Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel, resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2022-1852)

It was discovered that the UDF file system implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1943)

Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2318)

It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

Roger Pau Monné discovered that the Xen virtual block driver in the Linux kernel did not properly initialize memory pages to be used for shared communication with the backend. A local attacker could use this to expose sensitive information (guest kernel memory). (CVE-2022-26365)

Zheyu Ma discovered that the Intel iSMT SMBus host controller driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-2873)

Selim Enes Karaduman discovered that a race condition existed in the pipe buffers implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly escalate privileges. (CVE-2022-2959)

Roger Pau Monné discovered that the Xen paravirtualization frontend in the Linux kernel did not properly initialize memory pages to be used for shared communication with the backend. A local attacker could use this to expose sensitive information (guest kernel memory). (CVE-2022-33740)

It was discovered that the Xen paravirtualization frontend in the Linux kernel incorrectly shared unrelated data when communicating with certain backends. A local attacker could use this to cause a denial of service (guest crash) or expose sensitive information (guest kernel memory). (CVE-2022-33741, CVE-2022-33742)

Jan Beulich discovered that the Xen network device frontend driver in…