CVE-2022-0492

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

The Linux Kernel, the operating system core itself. Security Fix(es): In memory management driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.(CVE-2022-0492) An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.(CVE-2022-24448) A stack overflow flaw was found in the Linux kernel’s TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.(CVE-2022-0435) An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.(CVE-2022-24959) drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.(CVE-2022-24958)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• kernel symbol '__rt_mutex_init' is exported GPL-only in kernel 4.18.0-348.2.1.rt7.132.el8_5 (BZ#2038423)

• kernel-rt: update RT source tree to the Rocky Linux-8.5.z3 source tree (BZ#2045589)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888)

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel QAT Kernel power up fix (BZ#2016437)

• Rocky Linux8.4 seeing scsi_dma_map failed with mpt3sas driver and affecting performance (BZ#2018928)

• [Lenovo 8.4 bug] audio_HDMI certification failed on Rocky Linux 8.4GA (No hdmi out) (BZ#2027335)

• [Rocky Linux-8.5][4.18.0-323.el8.ppc64le][POWER8/9/10] security_flavor mode is not set back to zero post online migration (BZ#2027448)

• iommu/amd: Fix unable to handle page fault due to AVIC (BZ#2030854)

• [Lenovo 8.4 bug]The VGA display shows no signal (black screen) when install Rocky Linux8.4(beta or rc1) in the legacy BIOS mode. (BZ#2034949)

• Double free of kmalloc-64 cache struct ib_port->pkey_group from module ib_core . (BZ#2038724)

• Bus error with huge pages enabled (BZ#2039015)

• Rocky Linux8 - kvm: floating interrupts may get stuck (BZ#2040769)

• Data corruption on small files served by httpd, which is backed by cifs-mount (BZ#2041529)

• Add a net/mlx5 patch for Hardware Offload Fix (BZ#2042663)

• Windows guest random Bsod when 'hv-tlbflush' enlightenment is enabled (BZ#2043237)

• DNS lookup failures when run two times in a row (BZ#2043548)

• net/sched: Fix ct zone matching for invalid conntrack state (BZ#2043550)

• Kernel 4.18.0-348.2.1 secpath_cache memory leak involving strongswan tunnel (BZ#2047427)

• OCP node XFS metadata corruption after numerous reboots (BZ#2049292)

• Broadcom bnxt_re: RDMA stats are not incrementing (BZ#2049684)

• ice: bug fix series for 8.6 (BZ#2051951)

• panic while looking up a symlink due to NULL i_op->get_link (BZ#2052558)

• ceph omnibus backport for Rocky Linux-8.6.0 (BZ#2053725)

• SCTP peel-off with SELinux and containers in OCP (BZ#2054112)

• Selinux is not allowing SCTP connection setup between inter pod communication in enforcing mode (BZ#2054117)

• dnf fails with fsync() over local repository present on CIFS mount point (BZ#2055824)

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888)

Security Fix(es):

• kernel: improper initialization of the "flags" member of the new pipe_buffer (CVE-2022-0847)

• kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

• kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout (CVE-2021-4154)

• kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

• kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

• kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

• kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

• kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel QAT Kernel power up fix (BZ#2016437)

• AlmaLinux8.4 seeing scsi_dma_map failed with mpt3sas driver and affecting performance (BZ#2018928)

• [Lenovo 8.4 bug] audio_HDMI certification failed on AlmaLinux 8.4GA (No hdmi out) (BZ#2027335)

• [AlmaLinux-8.5][4.18.0-323.el8.ppc64le][POWER8/9/10] security_flavor mode is not set back to zero post online migration (BZ#2027448)

• iommu/amd: Fix unable to handle page fault due to AVIC (BZ#2030854)

• [Lenovo 8.4 bug]The VGA display shows no signal (black screen) when install AlmaLinux8.4(beta or rc1) in the legacy BIOS mode. (BZ#2034949)

• Double free of kmalloc-64 cache struct ib_port->pkey_group from module ib_core . (BZ#2038724)

• Bus error with huge pages enabled (BZ#2039015)

• AlmaLinux8 - kvm: floating interrupts may get stuck (BZ#2040769)

• Data corruption on small files served by httpd, which is backed by cifs-mount (BZ#2041529)

• Add a net/mlx5 patch for Hardware Offload Fix (BZ#2042663)

• Windows guest random Bsod when 'hv-tlbflush' enlightenment is enabled (BZ#2043237)

• DNS lookup failures when run two times in a row (BZ#2043548)

• net/sched: Fix ct zone matching for invalid conntrack state (BZ#2043550)

• Kernel 4.18.0-348.2.1 secpath_cache memory leak involving strongswan tunnel (BZ#2047427)

• OCP node XFS metadata corruption after numerous reboots (BZ#2049292)

• Broadcom bnxt_re: RDMA stats are not incrementing (BZ#2049684)

• ice: bug fix series for 8.6 (BZ#2051951)

• panic while looking up a symlink due to NULL i_op->get_link (BZ#2052558)

• ceph omnibus backport for AlmaLinux-8.6.0 (BZ#2053725)

• SCTP peel-off with SELinux and containers in OCP (BZ#2054112)

• Selinux is not allowing SCTP connection setup between inter pod communication in enforcing mode (BZ#2054117)

• dnf fails with fsync() over local repository present on CIFS mount point (BZ#2055824)

• cgroup-v1: Require capabilities to set release_agent [ELSCVE-3555] {CVE-2022-0492}
• xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate [ELSCVE-3891] {CVE-2021-4155}
• af_unix: fix garbage collect vs MSG_PEEK [ELSCVE-3728] {CVE-2021-0920}
• epoll: Keep a reference on files added to the check list [ELSCVE-3890] {CVE-2020-0466}
• Revert "cipso,calipso: resolve a number of problems with the DOI refcounts"

• cgroup-v1: Require capabilities to set release_agent [ELSCVE-3555] {CVE-2022-0492}
• xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate [ELSCVE-3891] {CVE-2021-4155}
• af_unix: fix garbage collect vs MSG_PEEK [ELSCVE-3728] {CVE-2021-0920}
• epoll: Keep a reference on files added to the check list [ELSCVE-3890] {CVE-2020-0466}
• Revert "cipso,calipso: resolve a number of problems with the DOI refcounts"

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• cgroup: cgroup.{procs,threads} factor out common parts
• cgroup: unify attach permission checking
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving {CVE-2022-2964}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• net: usb: ax88179_178a: fix packet alignment padding {CVE-2022-2964}
• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• RDMA/cma: Make the locking for automatic state transition more clear
• ath10k: Validate first subframe of A-MSDU before processing the list {CVE-2020-24588}
• ath10k: drop MPDU which has discard flag set by firmware for SDIO {CVE-2020-24588}
• mac80211: drop A-MSDUs on old ciphers {CVE-2020-24588}
• cfg80211: mitigate A-MSDU aggregation attacks {CVE-2020-24588}
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• cgroup: fix psi monitor for root cgroup
• cgroup/cgroup.c: replace 'of->kn->priv' with of_cft()
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges.(CVE-2022-0492)

Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.(CVE-2022-25636)

It was discovered that a race condition existed in the network scheduling subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2021-39713)

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges.(CVE-2022-0492)

It was discovered that the network traffic control implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2022-1055)

Bing-Jhong Billy Jheng discovered that the io_uring subsystem in the Linux kernel contained in integer overflow. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-1116)

It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot restrictions.(CVE-2022-21499)

Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-29581)

Jann Horn discovered that the Linux kernel did not properly enforce seccomp restrictions in some situations. A local attacker could use this to bypass intended seccomp sandbox restrictions.(CVE-2022-30594)

This kernel update is based on upstream 5.15.23 and fixes at least the following security issues:

A stack overflow flaw was found in the Linux kernel TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network (CVE-2022-0435).

A vulnerability was found in the Linux kernel cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly (CVE-2022-0492).

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor (CVE-2022-24448).

Other fixes in this update:

• enable several missed MediaTek wifi drivers (mga#29965)

For other upstream fixes, see the referenced changelogs.

This kernel-linus update is based on upstream 5.15.23 and fixes at least the following security issues:

A stack overflow flaw was found in the Linux kernel TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network (CVE-2022-0435).

A vulnerability was found in the Linux kernel cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly (CVE-2022-0492).

kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace (CVE-2022-24122).

An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor (CVE-2022-24448).

Other fixes in this update:

• enable several missed MediaTek wifi drivers (mga#29965)

For other upstream fixes, see the referenced changelogs.

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Bluetooth: refactor malicious adv data check (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
• IB/umad: Return EIO in case of when device disassociated (git-fixes)
• IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
• Input: wm97xx: Simplify resource management (git-fixes).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFS: Ensure the server had an up to date ctime before renaming (git-fixes).
• NFSD: Fix the behavior of READ near OFFSET_MAX…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bnc#1196235 ).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Drop PCI xgene patch that caused a regression for mxl4 (bsc#1195352)
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1195957).
• PM: hibernate: Remove register_nosave_region_late() (git-fixes).
• PM: s2idle: ACPI: Fix wakeup interrupts handling (git-fixes).
• RDMA/cma: Use correct address when leaving multicast group (bsc#1181147).
• RDMA/core: Always release restrack object (git-fixes)
• RDMA/cxgb4: check for ipv6 address properly while destroying listener (git-fixes)
• RDMA/siw: Release xarray entry (git-fixes)
• RDMA/ucma: Protect mc during concurrent multicast leaves (bsc#1181147).
• USB: serial: ch341: add support for GW Instek USB2.0-Serial devices (git-fixes).
• USB: serial: cp210x: add CPI Bulk Coin Recycler id (git-fixes).
• USB: serial: cp210x: add NCR Retail IO box id (git-fixes).
• USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 (git-fixes).
• USB: serial: mos7840: remove duplicated 0xac24 device ID (git-fixes).
• USB: serial: option: add ZTE MF286D modem (git-fixes).
• ata: libata-core: Disable TRIM on M88V29 (git-fixes).
• ax25: improve the incomplete fix to avoid UAF and NPD bugs (git-fixes).
• blk-mq: always allow reserved allocation in hctx_may_queue (bsc#1193787).
• blk-mq: avoid to iterate over stale request (bsc#1193787).
• blk-mq: clear stale request in tags->rq before freeing one request pool (bsc#1193787).
• blk-mq: clearing flush request reference in tags->rqs (bsc#1193787).
• blk-mq:…

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory (bsc#1196235).
• CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write (bsc#1195516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).

The following non-security bugs were fixed:

• ACPI/IORT: Check node revision for PMCG resources (git-fixes).
• ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks (git-fixes).
• ALSA: hda/realtek: Add quirk for ASUS GU603 (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows (git-fixes).
• ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) (git-fixes).
• ALSA: hda: Fix missing codec probe on Shenker Dock 15 (git-fixes).
• ALSA: hda: Fix regression on forced probe mask option (git-fixes).
• ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
• ALSA: usb-audio: initialize variables that could ignore errors (git-fixes).
• ASoC: Revert 'ASoC: mediatek: Check for error clk pointer' (git-fixes).
• ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name (git-fixes).
• ASoC: fsl: Add missing error handling in pcm030_fabric_probe (git-fixes).
• ASoC: max9759: fix underflow in speaker_gain_control_put() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (git-fixes).
• ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (git-fixes).
• ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes (git-fixes).
• Align s390 NVME target options with other architectures (bsc#1188404, jsc#SLE-22494).
• Bluetooth: refactor malicious adv data check (git-fixes).
• EDAC/xgene: Fix deferred probing (bsc#1178134).
• HID:Add support for UGTABLET WP5540 (git-fixes).
• IB/cm: Avoid a loop when device has 255 ports (git-fixes)
• IB/cma: Do not send IGMP leaves for sendonly Multicast groups (git-fixes).
• IB/hfi1: Fix AIP early init panic (jsc#SLE-13208).
• IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
• IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
• IB/isert: Fix a use after free in isert_connect_request (git-fixes)
• IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
• IB/mlx5: Add missing error code (git-fixes)
• IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
• IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
• IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
• IB/umad: Return EIO in case of when device disassociated (git-fixes)
• IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
• Input: wm97xx: Simplify resource management (git-fixes).
• KVM: remember position in kvm->vcpus array (bsc#1190972 LTC#194674).
• NFS: Ensure the server had an up to date ctime before renaming (git-fixes).
• NFSD: Fix the behavior of READ near OFFSET_MAX…

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).
• CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free bug in unix_gc (bsc#1193731).
• CVE-2016-10905: Fixed a use-after-free is gfs2_clear_rgrpd() and read_rindex_entry() (bsc#1146312).

The following non-security bug was fixed:

• net: sched: sch_teql: fix null-pointer dereference (bsc#1190717).

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

The following security bugs were fixed:

• CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
• CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
• CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-only) files (bsc#1196584).
• CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
• CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd() (bsc#1196155).
• CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987).
• CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
• CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
• CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed bypassing namespace isolation unexpectedly (bsc#1195543).
• CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612).

The following non-security bugs were fixed:

• NFSv4.x: by default serialize open/close operations (bsc#1114893 bsc#1195934).
• crypto: af_alg - get_page upon reassignment to TX SGL (bsc#1195840).
• hv_netvsc: fix network namespace issues with VF support (bsc#1107207).
• hv_netvsc: move VF to same namespace as netvsc device (bsc#1107207).
• lib/iov_iter: initialize 'flags' in new pipe_buffer (bsc#1196584).