CVE-2022-2964

Security Fix(es):

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.(CVE-2022-1462)

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5(CVE-2022-2503)

A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system.(CVE-2022-2959)

A flaw was found in the kernels implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.

References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d8e7007dc7c4d7c8366739bbcd3f5e51dcd470f(CVE-2022-2977)

The linux kernels driver for the "ASIX AX88179_178A based USB 2.0/3.0 Gigabit Ethernet Devices" contains multiple out-of-bounds reads and possible writes in the ax88179_rx_fixup() function.

References:

https://www.spinics.net/lists/stable/msg536418.html

Upstream commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581(CVE-2022-2964)

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.(CVE-2022-3028)

Security Fix(es):

A flaw was found in the kernels implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.

References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d8e7007dc7c4d7c8366739bbcd3f5e51dcd470f(CVE-2022-2977)

The linux kernels driver for the "ASIX AX88179_178A based USB 2.0/3.0 Gigabit Ethernet Devices" contains multiple out-of-bounds reads and possible writes in the ax88179_rx_fixup() function.

References:

https://www.spinics.net/lists/stable/msg536418.html

Upstream commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581(CVE-2022-2964)

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.(CVE-2022-3028)

Security Fix(es):

A flaw was found in the kernels implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.

References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d8e7007dc7c4d7c8366739bbcd3f5e51dcd470f(CVE-2022-2977)

The linux kernels driver for the "ASIX AX88179_178A based USB 2.0/3.0 Gigabit Ethernet Devices" contains multiple out-of-bounds reads and possible writes in the ax88179_rx_fixup() function.

References:

https://www.spinics.net/lists/stable/msg536418.html

Upstream commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581(CVE-2022-2964)

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.(CVE-2022-3028)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rocky Linux8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)

• vfio zero page mappings fail after 2M instances (BZ#2128515)

• ice: Driver Update up to 5.19 (BZ#2130992)

• atlantic: missing hybernate/resume fixes (BZ#2131935)

• Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)

• Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)

• ice: Intel E810 PTP clock glitching (BZ#2136036)

• ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up (BZ#2136216)

• ice: dump additional CSRs for Tx hang debugging (BZ#2136513)

• ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)

• After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)

• i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)

• WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)

• DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)

• Lenovo 8.7: The VGA display shows no signal when install Rocky Linux8.7 (BZ#2140152)

• Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic (BZ#2141878)

• mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)

• net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)

• Rocky Linux:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was cloned for Rocky Linux8.6 and need this patch in 8.6+ (BZ#2144583)

• AMdCLIENT 8.8: The kernel command line parameter "nomodeset" not working properly (BZ#2145218)

• Path loss during Volume Ownership Change on Rocky Linux 8.7 SAS (BZ#2147374)

• net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)

• iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)

• Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)

• Azure Rocky Linux-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)

• Rocky Linux-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module. (BZ#2152206)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• The latest Rocky Linux 8.7.z1 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2137411)

• [DELL EMC 8.6-RT BUG] System is not booting into RT Kernel with perc12. (BZ#2139867)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863)

• kernel-rt: update RT source tree to the latest Rocky Linux-9.1.z1 Batch (BZ#2141817)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)

• vfio zero page mappings fail after 2M instances (BZ#2128514)

• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

• ice: Driver Update to 5.19 (BZ#2132070)

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

• No signal showed in the VGA monitor when installing Rocky Linux9 in the legacy bios mode (BZ#2140153)

• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)

• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

• fatal error: error in backend: Branch target out of insn range (BZ#2144902)

• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)

• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)

• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Rocky Linux SIG Cloud8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)

• vfio zero page mappings fail after 2M instances (BZ#2128515)

• ice: Driver Update up to 5.19 (BZ#2130992)

• atlantic: missing hybernate/resume fixes (BZ#2131935)

• Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)

• Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)

• ice: Intel E810 PTP clock glitching (BZ#2136036)

• ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up (BZ#2136216)

• ice: dump additional CSRs for Tx hang debugging (BZ#2136513)

• ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)

• After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)

• i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)

• WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)

• DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)

• Lenovo 8.7: The VGA display shows no signal when install Rocky Linux SIG Cloud8.7 (BZ#2140152)

• Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic (BZ#2141878)

• mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)

• net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)

• Rocky Linux SIG Cloud:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was cloned for Rocky Linux SIG Cloud8.6 and need this patch in 8.6+ (BZ#2144583)

• AMdCLIENT 8.8: The kernel command line parameter "nomodeset" not working properly (BZ#2145218)

• Path loss during Volume Ownership Change on Rocky Linux SIG Cloud 8.7 SAS (BZ#2147374)

• net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)

• iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)

• Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)

• Azure Rocky Linux SIG Cloud-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)

• Rocky Linux SIG Cloud-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module. (BZ#2152206)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)

• vfio zero page mappings fail after 2M instances (BZ#2128514)

• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

• ice: Driver Update to 5.19 (BZ#2132070)

• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

• No signal showed in the VGA monitor when installing Rocky Linux SIG Cloud9 in the legacy bios mode (BZ#2140153)

• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)

• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

• fatal error: error in backend: Branch target out of insn range (BZ#2144902)

• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)

• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)

• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• AlmaLinux8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)
• vfio zero page mappings fail after 2M instances (BZ#2128515)
• ice: Driver Update up to 5.19 (BZ#2130992)
• atlantic: missing hybernate/resume fixes (BZ#2131935)
• Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)
• Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)
• ice: Intel E810 PTP clock glitching (BZ#2136036)
• ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up (BZ#2136216)
• ice: dump additional CSRs for Tx hang debugging (BZ#2136513)
• ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)
• After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)
• i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)
• WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)
• DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)
• Lenovo 8.7: The VGA display shows no signal when install AlmaLinux8.7 (BZ#2140152)
• Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic (BZ#2141878)
• mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)
• net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)
• AlmaLinux:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was cloned for AlmaLinux8.6 and need this patch in 8.6+ (BZ#2144583)
• AMdCLIENT 8.8: The kernel command line parameter "nomodeset" not working properly (BZ#2145218)
• Path loss during Volume Ownership Change on AlmaLinux 8.7 SAS (BZ#2147374)
• net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)
• iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)
• Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)
• Azure AlmaLinux-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)
• AlmaLinux-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module. (BZ#2152206)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• The latest AlmaLinux 8.7.z1 kernel changes need to be merged into the RT source tree to keep source parity between the two kernels. (BZ#2137411)
• [DELL EMC 8.6-RT BUG] System is not booting into RT Kernel with perc12. (BZ#2139867)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)
• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)
• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863)
• kernel-rt: update RT source tree to the latest AlmaLinux-9.1.z1 Batch (BZ#2141817)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)
• kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)
• kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)
• kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)
• kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)
• kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Intel 9.2: Important iavf bug fixes (BZ#2127884)
• vfio zero page mappings fail after 2M instances (BZ#2128514)
• nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)
• ice: Driver Update to 5.19 (BZ#2132070)
• WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)
• drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)
• updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)
• DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)
• No signal showed in the VGA monitor when installing AlmaLinux9 in the legacy bios mode (BZ#2140153)
• Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168)
• ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)
• fatal error: error in backend: Branch target out of insn range (BZ#2144902)
• AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217)
• Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)
• Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605)
• DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407)

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• cgroup: cgroup.{procs,threads} factor out common parts
• cgroup: unify attach permission checking
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving {CVE-2022-2964}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• net: usb: ax88179_178a: fix packet alignment padding {CVE-2022-2964}
• ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• RDMA/cma: Make the locking for automatic state transition more clear
• ath10k: Validate first subframe of A-MSDU before processing the list {CVE-2020-24588}
• ath10k: drop MPDU which has discard flag set by firmware for SDIO {CVE-2020-24588}
• mac80211: drop A-MSDUs on old ciphers {CVE-2020-24588}
• cfg80211: mitigate A-MSDU aggregation attacks {CVE-2020-24588}
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• cgroup: fix psi monitor for root cgroup
• cgroup/cgroup.c: replace 'of->kn->priv' with of_cft()
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

• cgroup: Use open-time cgroup namespace for process migration perm checks {CVE-2021-4197}
• cgroup: Use open-time credentials for process migraton perm checks {CVE-2021-4197}
• vt: drop old FONT ioctls {CVE-2021-33656}
• fbmem: Check virtual screen sizes in fb_set_var() {CVE-2021-33655}
• fbcon: Prevent that screen size is smaller than font size {CVE-2021-33655}
• fbcon: Disallow setting font bigger than screen size {CVE-2021-33655}
• KVM: nVMX: add missing consistency checks for CR0 and CR4 {CVE-2023-30456}
• net: usb: ax88179_178a: Fix packet receiving
• ipv4: make exception cache less predictible {CVE-2021-20322}
• ipv4: use siphash instead of Jenkins in fnhe_hashfun() {CVE-2021-20322}
• ipv6: make exception cache less predictible {CVE-2021-20322}
• ipv6: use siphash in rt6_exception_hash() {CVE-2021-20322}
• ipv6: use jhash2() in rt6_exception_hash()
• psi: Fix uaf issue when psi trigger is destroyed while being polled {CVE-2022-2938}
• psi: fix possible trigger missing in the window
• cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
• cgroup: make per-cgroup pressure stall tracking configurable
• netfilter: nf_tables_offload: incorrect flow offload action array size {CVE-2022-25636}
• netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS {CVE-2022-2196}
• net/sched: tcindex: update imperfect hash filters respecting rcu {CVE-2023-1281}
• seq_buf: Fix overflow in seq_buf_putmem_hex() {CVE-2023-28772}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg {CVE-2023-31436}
• cgroup-v1: Require capabilities to set release_agent {CVE-2022-0492}
• net: sched: fix use-after-free in tc_new_tfilter() {CVE-2022-1055}
• SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() {CVE-2022-28893}
• net/sched: cls_u32: fix netns refcount changes in u32_change() {CVE-2022-29581}
• i2c: ismt: Fix an out-of-bounds bug in ismt_access() {CVE-2022-2873}
• RDMA/cma: Do not change route.addr.src_addr.ss_family {CVE-2021-4028}
• net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup {CVE-2022-2964}
• KVM: x86/mmu: do compare-and-exchange of gPTE via the user address {CVE-2022-1158}
• ovl: fail on invalid uid/gid mapping at copy up {CVE-2023-0386}

The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
• CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS (bnc#1200788).
• CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686 bsc#1196018).
• CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege escalation or DoS (bnc#1202700).
• CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET are sent (bnc#1203290).
• CVE-2022-3176: Fixed use-after-free in io_uring when using POLLFREE (bnc#1203391).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
• CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init() in drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bnc#1204417).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
• CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
• CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local privilege escalation or DoS (bnc#1204470).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bnc#1204439).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
• CVE-2022-3623: Fixed race condition in follow_page_pte() (mm/gup.c) (bsc#1204575).
• CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c (bnc#1204637).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
• CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
• CVE-2022-39189: Fixed a flaw in the x86 KVM subsystem that could allow unprivileged guest users to compromise the guest kernel via TLB flush operations on preempted vCPU (bnc#1203066).
• CVE-2022-40768: Fixed information disclosure in stex_queuecommand_lck (bnc#1203514).
• CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames (bsc#1203770).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
• CVE-2022-42719: Fixed MBSSID parsing use-after-free. (bsc#1204051)
• CVE-2022-42720: Fixed BSS refcounting bugs. (bsc#1204059)
• CVE-2022-42721: Avoid nontransmitted BSS list corruption. (bsc#1204060)
• CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bnc#1204653).

The following non-security bugs were fixed:

• acpi: APEI: do not add task_work to kernel thread to avoid memory leak (git-fixes).
• acpi: HMAT:…

The SUSE Linux Enterprise 15-SP3 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686 bsc#1196018).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
• CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS (bnc#1200788).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
• CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege escalation or DoS (bnc#1202700).
• CVE-2022-3176: Fixed use-after-free in io_uring when using POLLFREE (bnc#1203391).
• CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init() in drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bnc#1204417).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
• CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
• CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local privilege escalation or DoS (bnc#1204470).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bnc#1204439).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
• CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c (bnc#1204637).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
• CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
• CVE-2022-39189: Fixed a flaw in the x86 KVM subsystem that could allow unprivileged guest users to compromise the guest kernel via TLB flush operations on preempted vCPU (bnc#1203066).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bnc#1204653).

The following non-security bugs were fixed:

• ACPI: APEI: do not add task_work to kernel thread to avoid memory leak (git-fixes).
• ACPI: HMAT: Release platform device in case of platform_device_add_data() fails (git-fixes).
• ACPI: extlog: Handle multiple records (git-fixes).
• ACPI: video: Add Toshiba Satellite/Portege Z830 quirk (git-fixes).
• ALSA: Use del_timer_sync() before freeing timer (git-fixes).
• ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() (git-fixes).
• ALSA: aoa: Fix I2S device accounting (git-fixes).
• ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() (git-fixes).
• ALSA: asihpi - Remove useless code in hpi_meter_get_peak() (git-fixes).
• ALSA: au88x0: use explicitly signed char (git-fixes).
• ALSA: dmaengine: increment buffer pointer atomically (git-fixes).
• ALSA: hda/hdmi: Do not skip notification handling during PM…

The SUSE Linux Enterprise 12 SP5 kernel RT was updated.

The following security bugs were fixed:

• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
• CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS (bnc#1200788).
• CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686 bsc#1196018).
• CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
• CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bnc#1204439).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bnc#1204653).

The following non-security bugs were fixed:

• amd-xgbe: Update DMA coherency values (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt_en: Fix RX consumer index logic in the error path (git-fixes).
• bnxt_en: reverse order of TX disable and carrier off (git-fixes).
• ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() (git-fixes).
• ftrace: Fix char print issue in print_ip_ins() (git-fixes).
• i40e: Fix flow for IPv6 next header (extension header) (git-fixes).
• i40e: Fix overwriting flow control settings during driver loading (git-fixes).
• i40e: improve locking of mac_filter_hash (git-fixes).
• input: gscps2 - check return value of ioremap() in gscps2_probe() (git-fixes).
• input: xpad - add supported devices as contributed on github (git-fixes).
• ip6: fix skb leak in ip6frag_expire_frag_queue (bsc#1202972)
• kABI: Fix after adding trace_iterator.wait_index (git-fixes).
• memcg, kmem: do not fail __GFP_NOFAIL charges (bsc#1204755).
• net/mlx4: Fix EEPROM dump support (git-fixes).
• net/mlx4_core: Add missed mlx4_free_cmd_mailbox() (git-fixes).
• net/mlx5e: Remove dependency in IPsec initialization flows (git-fixes).
• net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning (git-fixes).
• net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP (git-fixes).
• net: amd-xgbe: Reset link when the link never comes back (git-fixes).
• net: dsa: mt7530: add the missing RxUnicast MIB counter (git-fixes).
• net: ethernet: ezchip: fix UAF in nps_enet_remove (git-fixes).
• net: lapbether: Prevent racing when checking whether the netif is running (git-fixes).
• net: marvell: fix MVNETA_TX_IN_PRGRS bit number (git-fixes).
• net: mvpp2: Put fwnode in error case during ->probe() (git-fixes).
• net: stmmac: fix watchdog timeout during suspend/resume stress test (git-fixes).
• net: stmmac: stop each tx channel independently (git-fixes).
• net: usb: qmi_wwan: Add new usb-id for Dell branded…

The SUSE Linux Enterprise 15-SP4 Azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1199904).
• CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS (bnc#1200788).
• CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686 bsc#1196018).
• CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege escalation or DoS (bnc#1202700).
• CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET are sent (bnc#1203290).
• CVE-2022-33981: Fixed a use-after-free in floppy driver (bnc#1200692).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c (bsc#1204171).
• CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
• CVE-2022-3526: Fixed a memory leak in macvlan_handle_frame() from drivers/net/macvlan.c (bnc#1204353).
• CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init() in drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bnc#1204417).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
• CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
• CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local privilege escalation or DoS (bnc#1204470).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bnc#1204439).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
• CVE-2022-3619: Fixed memory leak in l2cap_recv_acldata() in net/bluetooth/l2cap_core.c of the component (bnc#1204569).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
• CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c (bnc#1204637).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
• CVE-2022-3633: Fixed memory leak in j1939_session_destroy() in net/can/j1939/transport.c (bnc#1204650).
• CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
• CVE-2022-40476: Fixed a null pointer dereference in fs/io_uring.c (bnc#1203435).
• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bnc#1203514).
• CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames (bsc#1203770).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
• CVE-2022-42719: Fixed MBSSID parsing use-after-free. (bsc#1204051)
• CVE-2022-42720: Fixed BSS refcounting bugs. (bsc#1204059)
• CVE-2022-42721: Avoid nontransmitted BSS list corruption.…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
• CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS (bnc#1200788).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686).
• CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege escalation or DoS (bnc#1202700).
• CVE-2022-3176: Fixed use-after-free in io_uring when using POLLFREE (bnc#1203391).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
• CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init() in drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bnc#1204417).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
• CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
• CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local privilege escalation or DoS (bnc#1204470).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bnc#1204439).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
• CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c (bnc#1204637).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
• CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
• CVE-2022-39189: Fixed a flaw in the x86 KVM subsystem that could allow unprivileged guest users to compromise the guest kernel via TLB flush operations on preempted vCPU (bnc#1203066).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bnc#1204653).

The following non-security bugs were fixed:

• ACPI: APEI: do not add task_work to kernel thread to avoid memory leak (git-fixes).
• ACPI: HMAT: Release platform device in case of platform_device_add_data() fails (git-fixes).
• ACPI: extlog: Handle multiple records (git-fixes).
• ACPI: processor idle: Practically limit 'Dummy wait' workaround to old Intel systems (bnc#1203802).
• ACPI: video: Add Toshiba Satellite/Portege Z830 quirk (git-fixes).
• ALSA: Use del_timer_sync() before freeing timer (git-fixes).
• ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() (git-fixes).
• ALSA: aoa: Fix I2S device accounting (git-fixes).
• ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() (git-fixes).
• ALSA: asihpi - Remove useless code in hpi_meter_get_peak() (git-fixes).
• ALSA: au88x0: use explicitly signed char (git-fixes).
• ALSA: dmaengine: increment buffer pointer atomically…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-28748: Fixed a leak of kernel memory over the network by ax88179_178a devices (bsc#1196018).
• CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1199904).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686).
• CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET (bsc#1203290).
• CVE-2022-33981: Fixed a use-after-free in floppy driver (bnc#1200692).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c (bsc#1204171).
• CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
• CVE-2022-3526: Fixed a memory leak in macvlan_handle_frame() from drivers/net/macvlan.c (bnc#1204353).
• CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
• CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c (bnc#1204637).
• CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac (bsc#1204868).
• CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
• CVE-2022-40476: Fixed a null pointer dereference in fs/io_uring.c (bnc#1203435).
• CVE-2022-40768: Fixed information disclosure in stex_queuecommand_lck (bnc#1203514).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bnc#1204653).

The following non-security bugs were fixed:

• acpi: APEI: do not add task_work to kernel thread to avoid memory leak (git-fixes).
• acpi: HMAT: Release platform device in case of platform_device_add_data() fails (git-fixes).
• acpi: extlog: Handle multiple records (git-fixes).
• acpi: tables: FPDT: Do not call acpi_os_map_memory() on invalid phys address (git-fixes).
• acpi: video: Add Toshiba Satellite/Portege Z830 quirk (git-fixes).
• acpi: video: Make backlight class device registration a separate step (v2) (git-fixes).
• acpi: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable (git-fixes).
• alsa: Use del_timer_sync() before freeing timer (git-fixes).
• alsa: ac97: fix possible memory leak in snd_ac97_dev_register() (git-fixes).
• alsa: aoa: Fix I2S device accounting (git-fixes).
• alsa: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() (git-fixes).
• alsa: asihpi - Remove useless code in hpi_meter_get_peak() (git-fixes).
• alsa: au88x0: use explicitly signed char (git-fixes).
• alsa: dmaengine: increment buffer pointer atomically (git-fixes).
• alsa: hda/cs_dsp_ctl: Fix mutex inversion when creating controls (bsc#1203699).
• alsa: hda/hdmi: Do not skip notification handling during PM operation (git-fixes).
• alsa: hda/hdmi: Fix the converter allocation for the silent stream (git-fixes).
• alsa: hda/hdmi: Fix the converter reuse for the silent stream (git-fixes).
• alsa: hda/hdmi: change type for the 'assigned' variable (git-fixes).
• alsa: hda/realtek: Add Intel Reference SSID to support headset keys (git-fixes).
• alsa: hda/realtek: Add another HP ZBook G9 model quirks (bsc#1203699). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
• CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS (bnc#1200788).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686).
• CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET are sent (bnc#1203290).
• CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
• CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bnc#1204439).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
• CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c (bnc#1203322).
• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bnc#1203514).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bnc#1204653).

The following non-security bugs were fixed:

• ACPI: processor idle: Practically limit 'Dummy wait' workaround to old Intel systems (bnc#1203802).
• ACPI: processor_idle: Skip dummy wait if kernel is in guest (bnc#1203802).
• Input: gscps2 - check return value of ioremap() in gscps2_probe() (git-fixes).
• Input: xpad - add supported devices as contributed on github (git-fixes).
• KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility (git-fixes).
• USB: core: Fix RST error in hub.c (git-fixes).
• USB: serial: ch341: add basis for quirk detection (git-fixes).
• USB: serial: ch341: fix lockup of devices with limited prescaler (git-fixes).
• USB: serial: ch341: fix lost character on LCR updates (git-fixes).
• USB: serial: ch341: fix receiver regression (git-fixes).
• USB: serial: ch341: reimplement line-speed handling (git-fixes).
• USB: serial: cp210x: add Decagon UCA device id (git-fixes).
• USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id (git-fixes).
• USB: serial: option: add Quectel BG95 0x0203 composition (git-fixes).
• USB: serial: option: add Quectel EM060K modem (git-fixes).
• USB: serial: option: add Quectel RM520N (git-fixes).
• USB: serial: option: add support for OPPO R11 diag port (git-fixes).
• amd-xgbe: Update DMA coherency values (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt_en: Fix RX consumer index logic in the error path (git-fixes).
• bnxt_en: reverse order of TX disable and carrier off (git-fixes). -…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated.

The following security bugs were fixed:

• CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set (bnc#1198702).
• CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to cause DoS (bnc#1200788).
• CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686).
• CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET are sent (bnc#1203290).
• CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
• CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
• CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
• CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c (bnc#1204402).
• CVE-2022-3545: Fixed use-after-free in area_cache_get() in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
• CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bnc#1204439).
• CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
• CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c (bnc#1204574).
• CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
• CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
• CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
• CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c (bnc#1203322).
• CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory (bnc#1203514).
• CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
• CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's internal memory (bnc#1204653).

The following non-security bugs were fixed:

• acpi: processor idle: Practically limit 'Dummy wait' workaround to old Intel systems (bnc#1203802).
• acpi: processor_idle: Skip dummy wait if kernel is in guest (bnc#1203802).
• amd-xgbe: Update DMA coherency values (git-fixes).
• bnxt: do not lock the tx queue from napi poll (git-fixes).
• bnxt_en: Fix RX consumer index logic in the error path (git-fixes).
• bnxt_en: reverse order of TX disable and carrier off (git-fixes).
• ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() (git-fixes).
• i40e: Fix flow for IPv6 next header (extension header) (git-fixes).
• i40e: Fix overwriting flow control settings during driver loading (git-fixes).
• i40e: improve locking of mac_filter_hash (git-fixes).
• input: gscps2 - check return value of ioremap() in gscps2_probe() (git-fixes).
• input: xpad - add supported devices as contributed on github (git-fixes).
• ip6: fix skb leak in ip6frag_expire_frag_queue (bsc#1202972)
• kvm: x86/emulator: Fix handing of POP SS to correctly set interruptibility (git-fixes).
• locking/csd_lock: Change csdlock_debug from early_param to __setup (git-fixes).
• memcg, kmem: do not fail __GFP_NOFAIL charges (bsc#1204755).
• net/mlx4: Fix EEPROM dump support (git-fixes).
• net/mlx4_core: Add missed mlx4_free_cmd_mailbox() (git-fixes).
• net/mlx5e: Remove dependency in…

This update for the Linux Kernel 4.12.14-197_108 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).

This update for the Linux Kernel 5.3.18-150300_59_60 fixes several issues.

The following security issues were fixed:

• CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
• CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
• CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory (bsc#1205700).
• CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to cause a denial of service (bsc#1204439).
• CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c (bsc#1204470).
• CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
• CVE-2022-41218: Fixed a use-after-free caused by refcount races, affecting dvb_demux_open() and dvb_dmxdev_release() in drivers/media/dvb-core/dmxdev.c (bsc#1202960).
• CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).