CVE-2022-2588

It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.

Security Fix(es):

st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.(CVE-2022-26490)

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.(CVE-2022-36123)

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issue.(CVE-2022-2588)

It was discovered that when exec ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.(CVE-2022-2585)

The Linux Kernel, the operating system core itself.

Security Fix(es):

Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.(CVE-2022-26373)

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issue.(CVE-2022-2588)

The Linux Kernel, the operating system core itself.

Security Fix(es):

Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.(CVE-2022-26373)

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issue.(CVE-2022-2588)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

• Information leak in scsi_ioctl() (CVE-2022-0494)

• A kernel-info-leak issue in pfkey_register (CVE-2022-1353)

• RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)

• Branch Type Confusion (non-retbleed) (CVE-2022-23825)

• RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Add s390_iommu_aperture kernel parameter (BZ#2081324)

• Blackscreen and hangup after resume from hibernate or S3 with DFGX WX3200 (BZ#2091065)

• Update NVME subsystem with bug fixes and minor changes (BZ#2106017)

• Fix parsing of nw_proto for IPv6 fragments (BZ#2106703)

• "vmcore failed, _exitcode:139" error observed while capturing vmcore during fadump after memory remove. incomplete vmcore is captured. (BZ#2107488)

• 'disable_policy' is ignored for addresses configured on a down interface (BZ#2109971)

• Backport request for new cpufreq.default_governor kernel command line parameter (BZ#2109996)

• Panics in mpt3sas mpt3sas_halt_firmware() if mpt3sas_fwfault_debug=1 enabled when poweroff issued to server (BZ#2111140)

• IOMMU/DMA update for 8.7 (BZ#2111692)

• Update Broadcom Emulex lpfc driver for Rocky Linux8.7 with bug fixes (14.0.0.13) (BZ#2112103)

• Incorrect Socket(s) & "Core(s) per socket" reported by lscpu command. (BZ#2112820)

• Panic in ch_release() due to NULL ch->device pointer, backport upstream fix (BZ#2115965)

• pyverbs-tests fail over qede IW HCAs on "test_query_rc_qp" (tests.test_qp.QPTest) (BZ#2119122)

• qedi shutdown handler hangs upon reboot (BZ#2119847)

• cache link_info for ethtool (BZ#2120197)

• Important iavf bug fixes (BZ#2120225)

• Hibernate crash with Aquantia 2.5/5 Gb LAN card (BZ#2124966)

• While using PTimekeeper the qede driver produces excessive log messages (BZ#2125477)

• general protection fault handling rpc_xprt.timer (BZ#2126184)

• Not enough device MSI-X vectors (BZ#2126482)

• Atlantic driver panic on wakeup after hybernate (BZ#2127845)

• Memory leak in vxlan_xmit_one (BZ#2131255)

• Missing hybernate/resume fixes (BZ#2131936)

Enhancement(s):

• Update smartpqi driver to latest upstream Second Set of Patches (BZ#2112354)

• qed/qede/qedr - driver updates to latest upstream (BZ#2120611)

• Update qedi driver to latest upstream (BZ#2120612)

• Update qedf driver to latest upstream (BZ#2120613)

• Include the support for new NVIDIA Mobile GFX GA103 on ADL Gen Laptops (BZ#2127122)

• Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129923)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

• kernel: information leak in scsi_ioctl() (CVE-2022-0494)

• Kernel: A kernel-info-leak issue in pfkey_register (CVE-2022-1353)

• hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)

• hw: cpu: AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

• hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [Rocky Linux8-rt] BUG: using __this_cpu_add() in preemptible [00000000] - caller is __mod_memcg_lruvec_state+0x69/0x1c0 (BZ#2122600)

• The latest Rocky Linux 8.6.z4 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2125396)

It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)
• Information leak in scsi_ioctl() (CVE-2022-0494)
• A kernel-info-leak issue in pfkey_register (CVE-2022-1353)
• RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Add s390_iommu_aperture kernel parameter (BZ#2081324)
• Blackscreen and hangup after resume from hibernate or S3 with DFGX WX3200 (BZ#2091065)
• Update NVME subsystem with bug fixes and minor changes (BZ#2106017)
• Fix parsing of nw_proto for IPv6 fragments (BZ#2106703)
• "vmcore failed, _exitcode:139" error observed while capturing vmcore during fadump after memory remove. incomplete vmcore is captured. (BZ#2107488)
• 'disable_policy' is ignored for addresses configured on a down interface (BZ#2109971)
• Backport request for new cpufreq.default_governor kernel command line parameter (BZ#2109996)
• Panics in mpt3sas mpt3sas_halt_firmware() if mpt3sas_fwfault_debug=1 enabled when poweroff issued to server (BZ#2111140)
• IOMMU/DMA update for 8.7 (BZ#2111692)
• Update Broadcom Emulex lpfc driver for AlmaLinux8.7 with bug fixes (14.0.0.13) (BZ#2112103)
• Incorrect Socket(s) & "Core(s) per socket" reported by lscpu command. (BZ#2112820)
• Panic in ch_release() due to NULL ch->device pointer, backport upstream fix (BZ#2115965)
• pyverbs-tests fail over qede IW HCAs on "test_query_rc_qp" (tests.test_qp.QPTest) (BZ#2119122)
• qedi shutdown handler hangs upon reboot (BZ#2119847)
• cache link_info for ethtool (BZ#2120197)
• Important iavf bug fixes (BZ#2120225)
• Hibernate crash with Aquantia 2.5/5 Gb LAN card (BZ#2124966)
• While using PTimekeeper the qede driver produces excessive log messages (BZ#2125477)
• general protection fault handling rpc_xprt.timer (BZ#2126184)
• Not enough device MSI-X vectors (BZ#2126482)
• Atlantic driver panic on wakeup after hybernate (BZ#2127845)
• Memory leak in vxlan_xmit_one (BZ#2131255)
• Missing hybernate/resume fixes (BZ#2131936)

Enhancement(s):

• Update smartpqi driver to latest upstream Second Set of Patches (BZ#2112354)
• qed/qede/qedr - driver updates to latest upstream (BZ#2120611)
• Update qedi driver to latest upstream (BZ#2120612)
• Update qedf driver to latest upstream (BZ#2120613)
• Include the support for new NVIDIA Mobile GFX GA103 on ADL Gen Laptops (BZ#2127122)
• Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129923)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)
• kernel: information leak in scsi_ioctl() (CVE-2022-0494)
• Kernel: A kernel-info-leak issue in pfkey_register (CVE-2022-1353)
• hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)
• hw: cpu: AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)
• hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [almalinux8-rt] BUG: using __this_cpu_add() in preemptible [00000000] - caller is __mod_memcg_lruvec_state+0x69/0x1c0 (BZ#2122600)
• The latest AlmaLinux 8.6.z4 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2125396)

• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• netfilter: nf_tables: do not allow RULE_ID to refer to another chain {CVE-2022-2586}
• netfilter: nf_tables: do not allow SET_ID to refer to another table {CVE-2022-2586}
• netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}

• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• netfilter: nf_tables: do not allow RULE_ID to refer to another chain {CVE-2022-2586}
• netfilter: nf_tables: do not allow SET_ID to refer to another table {CVE-2022-2586}
• netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}

• KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) {CVE-2021-3653}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}

• KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) {CVE-2021-3653}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}

• KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) {CVE-2021-3653}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}

• KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) {CVE-2021-3653}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• xfs: fix up non-directory creation in SGID directories {CVE-2021-4037}
• net_sched: cls_route: remove from list when handle is 0 {CVE-2022-2588}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}

Aaron Adams discovered that the netfilter subsystem in the Linux kernel did not properly handle the removal of stateful expressions in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1966)

Ziming Zhang discovered that the netfilter subsystem in the Linux kernel did not properly validate sets with multiple ranged fields. A local attacker could use this to cause a denial of service or execute arbitrary code.(CVE-2022-1972)

It was discovered that the implementation of POSIX timers in the Linux kernel did not properly clean up timers in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2585)

It was discovered that the netfilter subsystem of the Linux kernel did not prevent one nft object from referencing an nft set in another nft table, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2586)

Zhenpeng Lin discovered that the network packet scheduler implementation in the Linux kernel did not properly remove all references to a route filter before freeing it in some situations. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-2588)

It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot restrictions.(CVE-2022-21499)

Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code.(CVE-2022-29581)

Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this to escalate privileges in certain situations.(CVE-2022-34918)

This kernel update is based on upstream 5.15.62 and fixes at least the following security issues:

A use-after-free flaw was found in the Linux kernel Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1679).

A use-after-free flaw was found in the Linux kernel’s POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-2585).

A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation (CVE-2022-2586).

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issue (CVE-2022-2588).

A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction (CVE-2022-26373).

x86/bugs: Enable STIBP for IBPB mitigated RETBleed.

Other fixes in this update:

• add support for more tcp congestion control algos (mga #30725)
• add fixes for a serious bug that causes TCP connection hangs for users of TCP fast open and nf_conntrack
• ALSA: info: Fix llseek return value when using callback
• ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU
• ata: libata-eh: Add missing command name
• btrfs: fix lost error handling when looking up extended ref on log repla
• btrfs: reset RO counter on block group if we fail to relocate
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
• drm/amd/display: Check correct bounds for stream encoder instances for DCN303
• drm/nouveau: recognise GA103
• drm/ttm: Fix dummy res NULL ptr deref bug
• locking/atomic: Make test_and_*_bit() ordered on failure
• mmc: meson-gx: Fix an error handling path in meson_mmc_probe()
• mmc: pxamci: Fix an error handling path in pxamci_probe()
• mmc: pxamci: Fix another error handling path in pxamci_probe()
• rds: add missing barrier to release_refill
• KVM: Unconditionally get a ref to /dev/kvm module when creating a VM
• x86/mm: Use proper mask when setting PUD mapping
• x86/entry: Fix entry_INT80_compat for Xen PV guests
• x86/PAT: Have pat_enabled() properly reflect state when running on Xen
• xfs: flush inodegc workqueue tasks before cancel
• xfs: reserve quota for dir expansion when linking/unlinking files
• xfs: reserve quota for target dir expansion when renaming files
• xfs: remove infinite loop when reserving free block pool
• xfs: always succeed at setting the reserve pool size
• xfs: fix overfilling of reserve pool
• xfs: fix soft lockup via spinning in filestream ag selection loop
• xfs: revert "xfs: actually bump warning counts when we send warnings"
• xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP*

xtables-addons have been updated to 3.21.

For other upstream fixes in this update, see the referenced changelogs.

This kernel update is based on upstream 5.15.62 and fixes at least the following security issues:

A use-after-free flaw was found in the Linux kernel Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-1679).

A use-after-free flaw was found in the Linux kernel’s POSIX CPU timers functionality in the way a user creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user to crash or potentially escalate their privileges on the system (CVE-2022-2585).

A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the time of table deletion, possibly leading to local privilege escalation (CVE-2022-2586).

A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local, privileged attacker to crash the system, possibly leading to a local privilege escalation issue (CVE-2022-2588).

A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction (CVE-2022-26373).

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len (CVE-2022-36946).

x86/bugs: Enable STIBP for IBPB mitigated RETBleed.

Other fixes in this update:

• add support for more tcp congestion control algos (mga #30725)

For other upstream fixes in this update, see the referenced changelogs.

These are all security issues fixed in the kernel-devel-5.19.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.6.17-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2991: Fixed an heap-based overflow in the lightnvm implemenation (bsc#1201420).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).
• CVE-2019-3900: Fixed infinite loop the vhost_net kernel module that could result in a DoS scenario (bnc#1133374).

The following non-security bugs were fixed:

• net_sched: cls_route: Disallowed handle of 0 (bsc#1202393).
• mm, rmap: Fixed anon_vma->degree ambiguity leading to double-reuse (bsc#1203098).
• lightnvm: Removed lightnvm implemenation (bsc#1191881).

The SUSE Linux Enterprise 15 SP3 kernel was updated receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a denial of service upon binding to an already bound chain (bnc#1203117).
• CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564, bsc#1202860).
• CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem (bnc#1194272).
• CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a deallocated instance (bnc#1202895).
• CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).

The following non-security bugs were fixed:

• ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks (git-fixes).
• ACPI: LPSS: Fix missing check in register_device_clock() (git-fixes).
• ACPI: PM: save NVS memory for Lenovo G40-45 (git-fixes).
• ACPI: processor: Remove freq Qos request for all CPUs (git-fixes).
• ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool (git-fixes).
• ACPI: video: Force backlight native for some TongFang devices (git-fixes).
• ALSA: bcd2000: Fix a UAF bug on the error path of probing (git-fixes).
• ALSA: hda/cirrus - support for iMac 12,1 model (git-fixes).
• ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model (git-fixes).
• ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED (git-fixes).
• ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop (git-fixes).
• ALSA: hda/realtek: Add new alc285-hp-amp-init model (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo L140PU (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NP50PNJ (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NP70PNJ (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NP70PNP (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NS50PU (git-fixes).
• ALSA: hda/realtek: Add quirk for Clevo NV45PZ (git-fixes).
• ALSA: hda/realtek: Add quirk for Dell Latitude 7520 (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Dev One (git-fixes).
• ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx (git-fixes).
• ALSA: hda/realtek: Add quirk for TongFang devices with pop noise (git-fixes).
• ALSA: hda/realtek: Add quirk for another Asus K42JZ model (git-fixes).
• ALSA: hda/realtek: Add quirk for the Framework Laptop (git-fixes).
• ALSA: hda/realtek: Fix LED on HP ProBook 435 G7 (git-fixes).
• ALSA: hda/realtek: Fix deadlock by COEF mutex (git-fixes).
• ALSA: hda/realtek: Fix headset mic for…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).

The following non-security bugs were fixed:

• 9p: migrate from sync_inode to filemap_fdatawrite_wbc (bsc#1202528).
• ACPI: CPPC: Do not prevent CPPC from working in the future (git-fixes).
• Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019).
• Fix releasing of old bundles in xfrm_bundle_lookup() (bsc#1201264 bsc#1190397 bsc#1199617).
• KABI: cgroup: Restore KABI of css_set (bsc#1201610).
• KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs (bsc#1065729).
• KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
• KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP (bsc#1120716).
• KVM: x86: Mark TSS busy during LTR emulation after all fault checks (git-fixes).
• KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP (git-fixes).
• PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors (git-fixes).
• README, patch-tag-template, header.py: Abolish Novell and FATE (bsc#1189904).
• SUNRPC: Fix READ_PLUS crasher (git-fixes).
• SUNRPC: Fix the svc_deferred_event trace class (git-fixes).
• USB: new quirk for Dell Gen 2 devices (git-fixes).
• USB: serial: io_ti: add Agilent E5805A support (git-fixes).
• ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
• bs-upload-kernel: Workaround for vim syntax highlighting
• bs-upload-kernel: build klp_symbols when supported. cherry-picked from kbuild
• btrfs: Convert fs_info->free_chunk_space to atomic64_t (bsc#1202528).
• btrfs: add a trace class for dumping the current ENOSPC state (bsc#1202528).
• btrfs: add a trace point for reserve tickets (bsc#1202528).
• btrfs: adjust the flush trace point to include the source (bsc#1202528).
• btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1202528).
• btrfs: check worker before need_preemptive_reclaim (bsc#1202528).
• btrfs: do not do preemptive flushing if the majority is global rsv (bsc#1202528).
• btrfs: do not include the global rsv size in the preemptive used amount (bsc#1202528).
• btrfs: enable a tracepoint when we fail tickets (bsc#1202528).
• btrfs: handle preemptive delalloc flushing slightly differently (bsc#1202528).
• btrfs: implement space clamping for preemptive flushing (bsc#1202528).
• btrfs: improve preemptive background space flushing (bsc#1202528).
• btrfs: include…

The SUSE Linux Enterprise 12 SP4 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-36946: Fixed a denial of service (panic) inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c (bnc#1201940).
• CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948).
• CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898).
• CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
• CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154).
• CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726).
• CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
• CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897).
• CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
• CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
• CVE-2022-20166: Fixed possible out of bounds write due to a heap buffer overflow in various methods of kernel base drivers (bnc#1200598).
• CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
• CVE-2020-36558: Fixed a race condition involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault (bnc#1200910).
• CVE-2020-36557: Fixed a race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys that could have led to a use-after-free (bnc#1201429).
• CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616).

The following non-security bugs were fixed:

• cifs: fix error paths in cifs_tree_connect() (bsc#1177440).
• cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944).
• cifs: report error instead of invalid when revalidating a dentry fails (bsc#1177440).
• cifs: skip trailing separators of prefix paths (bsc#1188944).
• kernel-obs-build: include qemu_fw_cfg (boo#1201705)
• lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325).
• mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc#1203098).
• mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes, bsc#1203098).
• net_sched: cls_route: disallow handle of 0 (bsc#1202393).
• objtool: Add --backtrace support (bsc#1202396).
• objtool: Add support for intra-function calls (bsc#1202396).
• objtool: Allow no-op CFI ops in alternatives (bsc#1202396).
• objtool: Convert insn type to enum (bsc#1202396).
• objtool: Do not use ignore flag for fake jumps (bsc#1202396).
• objtool: Fix !CFI insn_state propagation (bsc#1202396).
• objtool: Fix ORC vs alternatives (bsc#1202396).
• objtool: Fix sibling call detection (bsc#1202396).
• objtool: Make handle_insn_ops() unconditional (bsc#1202396).
• objtool: Remove INSN_STACK (bsc#1202396).
• objtool: Remove check preventing branches within alternative (bsc#1202396).
• objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain (bsc#1202396).
• objtool: Rename struct cfi_state (bsc#1202396).
• objtool: Rework allocating stack_ops on decode (bsc#1202396).
• objtool: Rewrite alt->skip_orig (bsc#1202396).
• objtool: Set insn->func for alternatives (bsc#1202396).
• objtool: Support conditional retpolines (bsc#1202396).
• objtool: Support multiple stack_op per instruction (bsc#1202396).
• objtool: Track original function across branches (bsc#1202396).
• objtool: Uniquely identify alternative instruction groups (bsc#1202396).
• objtool: Use Elf_Scn typedef instead of…